What are possible approaches and arguments for securing corporate IT systems with most computers being portable?

Question

I was employed as the only system administrator by a company where half of computers are portable ones being taken away for work at home, business trips, visits to clients, etc. having access to practically everything while connected to internal corporate networks.

And most users of computers, even desktops, are administrators. In Windows workgroup(s), no Active Directory/Domain Controller.

• Update: 35+ Windows 7, XP, Vista workstations and two Windows 2003 servers, one running for terminal services (serving to all the accounting applications), another Windows 2003 Server is for websites/portal and external access from internet. The office (internal networks) is distributed over 2 main locations (one is the main office and another is producing facilities in another city) and the main office has 2 buildings with communication over WiFi.
  The employees (sellers, accountants, lawyers) plug portable computers into internal cable network while at office
  See mor eonformation on my specific situation in my question How to make sure that previous sysadmin has not compromised corporate IT security? [closed]
  Update End

What are the most urgent first steps for securing/re-organizing such IT corporate infrastructure and arguments to convince the top management in their necessity?

Answer 1

I would restrict based on what type of data they need access to.

Do they need to store any information locally? If so what kind of data? You may need to force full disk encryption if dealing with sensative data ie SS#'s, CC's etc. You may also have a legal requirement depending on your industry to do so.

If they just need access to MS-Office type files you could run terminal services application publishing and all of the work would be done on the server OR since you mentioned that everything is in a workgroup setting that you might be better off running a program called go-global by graphon. This is definately cheaper than terminal services and you could try out the trial to see if it will work for your application. check out http://www.graphon.com/

How many systems are there and what are they? (XP workstation, win 7 laptop, win2k3 server that isn't running as a domain controller, etc.)

Was there a specific reason why the network is setup as a workgroup?

What kind of data are you looking to protect?

Answer 2

Trust nothing. All mobile devices should be placed on their own network segment, which is doesn't have access to the entire infrastructure. This untrusted network should be treated no differently than the open internet. Make sure you expose only the services that are needed to this untrusted network.

Make sure all mobile devices have anti-virus software. I am still skeptical of anti-virus software for phones. Make sure devices are updated regularly.

Answer 3

Most of this question is beyond my ken, but I have a small suggestion. When it comes to physical security (specifically, the recovery of lost or stolen devices), I'm generally a fan of these guys:

http://preyproject.com/

I've never misplaced any of my property before, but I'm generally a fan of their entire system. It strikes me as intuitive, powerful, customizable, scriptable, etc. I really can't think of anything I would change.

By way of disclosure, I have no affiliation with this company. I'm just a satisfied customer.

Answer 4

One of the biggest must haves for any portable devices is LoJack. I've been installing the software on all my work devices for a few years now, and while I haven't had to see it in action, the software is very solid - with a 97% stolen device return rate - with Wi-Fi tracking, although now that many laptops have GPS chips the software now includes that capability also, therefore increasing the return speed.

Aside from that, full-disk encryption (Bitlocker or something similar) is a must, although if for some reason you only need to encrypt some files - TrueCrypt is a must.

Finally - if you can get fingerprint readers on your devices, that can be a nice added layer. Although some devices have facial recognition I know that on the Android a vulnerability was found where using a picture of the device owner fooled the software however I'm not sure if the same issue applies to laptop cameras.

Answer 5

You should look at some of the large professional services firms which may have 100k mobile users with laptops.

• do not allow administrator access
• do not allow them to download files unless they are scanned first
• patch regularly and update anti-virus
• use a platform assessment stage on your VPN solution to prevent access if the laptop is not up to date
• use a firewall configured to prevent split-tunneling
• configure the browser to only connect via the VPN and whitelist websites

Will add a link once I find the similar question were have answered previously

Answer 6

In a business, security is a business decision as much as anything else is. To be truly secure, you can't use equipement you can't control, and that includes mobile computers. But to put that kind of restriction on a business will probably not save in security liability as much money as it will cost in actual lost revenue.

So trying to change the behavior of the suits who bring in the money can be a little problematic. Even if you're right.

Instead, you may want to re-think where you draw your lines. Instead of being trusted, perhaps workstations should be considered hostile and secured and managed individually, locally, independent of the network. "Central" data, whatever that might mean, would then be scanned and vetted on the way in from the workstations based on the assumption that all workstations are attackers. Access to central resources is allowed only through properly-secured and authenticated channels. Non anonymous, passwordless access.

Also, it's a good idea to get into the habit of "cloud" storing all important documents (where "cloud" could be any sort of internet-delivered file synchronization tool; e.g. dropbox, sharepoint, etc.), and regularly wipe and re-provision all company-owned mobile computers.

For the user, it's liberating to be able to take any laptop and have your data simply populate onto it, and it makes hardware failure hardly even an inconvenience. And from your perspective, it hugely simplifies security; every 3 months you wipe it all and start clean on every device.