security question - how to secure laptops for when they are out of the office?

[Mizugori]

while on the network in my office, a sonicwall acts as their firewall. also they have antivirus installed and it is updated daily. however, when the users occasionally bring their laptop home or travel, they are of course not behind the sonicwall anymore and not connected to the server. the antivirus basically is fine IMHO, it just wont be getting updates pushed from the server, but how can i deal with the lack of a firewall? I am hesitant to install a software firewall because won't it cause a million headaches while they are on the network (and thus behing 2 firewalls)? how can i secure them?

thanks!

 

[elcamino74ss]

you've already stated it. you might also want to look at full disk encryption too.

 

[Mizugori]

i've already stated what?

 

[elcamino74ss]

software firewall is about the only option. Most will allow you to configure a trusted network (your office) and consider everything else hostile.

 

[RebateMonger]

I've never understood why companies want to disable Windows (or any other) Firewall inside the company network. The lack of a firewall was how a couple of major worms were able to invade some very big company networks over the past several years.

In every small business network I've seen, leaving the Windows XP SP2 firewall enabled has caused zero problems. And a large company should certainly be able to determine what, if any, open inbound ports must be opened for any custom applications, since they either WROTE the applications or likely purchased them in quantity from a vendor.

Closing inbound ports is far more important than outbound ports, since outbound ports are mostly useful for AFTER the PC has become contaminated. And as long as all the OTHER PCs have firewalls running, a contaminated PC is unlikely to be able to infect other PCs on the network.

Note that many firewalls (including the XP SP2 firewall) have options to close ALL inbound ports when travelling.

 

[Zugzwang152]

Originally posted by: RebateMonger
I've never understood why companies want to disable Windows (or any other) Firewall inside the company network. The lack of a firewall was how a couple of major worms were able to invade some very big company networks over the past several years.

Agreed. The laptop or other mobile device should protect itself the same regardless of what network it's connected to. Firewalls, antivirus, antispyware, etc. should operate the same way all the time.