RE: Client End Point Scan

[William Baltas <bill.baltas () cleanwaterteam com>]

Have you looked at a Network Access Control (NAC) solution.  With NAC active in a company all workstations are 
automatically scanned for A/V, firewalls, O/S, patches, and A/V updates.  If a device fails to meet the criteria set, 
the workstation can be denied access to the network or be given access to a VLAN that has remediation servers, or 
directed to the Internet for remediation.  When the workstation becomes compliant with the specified security, it is 
permitted on the corporate network.

As for SSL VPN, the Cisco AnyConnect client has the capability of scanning a PC for common A/V engines (Symantec, 
Trend, McAfee, and a few others) and checking to see if a firewall is active (I believe it will also look for patches). 
 If the client meets the necessary criterion it is permitted as a valid VPN connection, if the system fails, the VPN 
connection is denied.

Bill

-----Original Message-----
From: listbounce () securityfocus com [mailto:listbounce () securityfocus com] On Behalf Of Jeffrey Walton
Sent: Thursday, November 03, 2011 12:23 PM
To: infosec () ampsecurity com
Cc: security-basics () securityfocus com
Subject: Re: Client End Point Scan

On Thu, Nov 3, 2011 at 9:52 AM,  <infosec () ampsecurity com> wrote:
> We have a group that is looking to adopt a bring your own computer (byoc) program, the client obviously has concerns 
> on how they could enforce their minimum requirements (i.e. AV/Firewall protection, full patched system, OS, 
> Memory/CPU if possible, etc.).  Their co-workers would connect over an SSL VPN and it sounds like an Endpoint 
> Analysis solution is what they need.
>
> Could anyone offer any suggestions on a solution?
>
> Also, if an employee attempts to connect and does not meet the minimum requirements the client would like to return 
> prompt on why the system is restricted from connecting.
It does not sound much different than work at home (allowing employees
to use their personal machines).

Have them VPN into a Terminal Server from their cube. For the most
part, you don't have to worry about their configuration since their
machine is a dumb terminal.

Jeff

------------------------------------------------------------------------
Securing Apache Web Server with thawte Digital Certificate
In this guide we examine the importance of Apache-SSL and who needs an SSL certificate.  We look at how SSL works, how 
it benefits your company and how your customers can tell if a site is secure. You will find out how to test, purchase, 
install and use a thawte Digital Certificate on your Apache web server. Throughout, best practices for set-up are 
highlighted to help you ensure efficient ongoing management of your encryption keys and digital certificates.

http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f727d1
------------------------------------------------------------------------


------------------------------------------------------------------------
Securing Apache Web Server with thawte Digital Certificate
In this guide we examine the importance of Apache-SSL and who needs an SSL certificate.  We look at how SSL works, how 
it benefits your company and how your customers can tell if a site is secure. You will find out how to test, purchase, 
install and use a thawte Digital Certificate on your Apache web server. Throughout, best practices for set-up are 
highlighted to help you ensure efficient ongoing management of your encryption keys and digital certificates.

http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f727d1
------------------------------------------------------------------------