Telecommuters On Security Alert

By RUTRELL YASIN

As more remote users connect to corporate networks from home computers, demand is growing for a new class of personal firewall and intrusion detection system.

Remote PCs connected to the Internet via DSL and cable modem services can be linked to the network all the time, yet they lack the protection and policy enforcement of a corporate firewall, security experts said. Without adequate protection these PCs are exposed to hacker attacks through their virtual private connections.

To protect vulnerable PCs, InfoExpress this week will unveil an “enterprise class” personal firewall that lets IT managers extend their corporate security policies to remote users. CyberArmor Suite 1.1 sports preconfigured client firewall software that notifies users and administrators of attacks.

Meantime, PGP Security, a division of Network Associates, last week unveiled PGP Desktop Security 7.0, which combines a personal firewall, intrusion detection, virtual private networking and encryption in a single package.

A company's overall security “is only as good as the home PC security,” said Mike Hager, vice president of security at Oppenheimer Funds, an investment firm.

“Desktop security is a wide open market,” especially as more employees work from home, said Hager, who is developing a pamphlet for Oppenheimer employees on how to secure home PCs.

Market research company International Data Corp. predicted there will be more than 20 million broadband users in the United States by 2003. Sixty-four percent of those users plan to use broadband for remote access to corporate networks, IDC reported.

To adequately protect the home user as well as the enterprise, “a personal firewall has to have the ability to be included in an enterprise policy,” said InfoExpress CEO Stacey Lum.

To that end, CyberArmor includes rules that automatically adjust client settings to match current activity, such as whether the user is on the Internet, is using the VPN or is connected to the corporate LAN, Lum said.CyberArmor also includes a Policy Manager for editing user profiles and policies; CyberServer, which logs user events and threats into a database; and CyberConsole, which provides Web-based updating of user systems. CyberServer is priced at $4,995 and runs on Windows NT. The CyberConsole costs $295 per seat. Client software, which runs on Windows platforms, costs $49.

With PGP Desktop Security's personal firewall and intrusion detection system, users can build a two-layer security perimeter around PCs. PGP's CyberCop intrusion detection system blocks major denial-of-service attacks, such as SYN floods, Ping floods, Smurf, Bonk, Ping of Death and Back Orifice. The intrusion detection system also blocks hostile intruders and uses SMTP-based alerting systems to warn administrators of threats. The second line of defense includes packet filtering, using personal firewall technology. Administrators can preconfigure the packet filtering rules prior to deploying desktop security to meet their specific user requirements.

Desktop Security also features encryption for e-mail, online data files and transactions. A gateway option lets IT managers force all traffic through a VPN tunnel to the corporate network.

Desktop Security runs on Windows and MacOS 8.5 and later. The suite will be available next month for $36 per node for 500 nodes.

As some security vendors shore up remote access connections for home users, others are focusing on small and midsize businesses.

V-One Corp. last week rolled out SmartGuard, a VPN appliance. Powered by a 500-MHz Intel processor, SmartGuard delivers a plug-and-play box that secures thousands of concurrent user connections, said V-One CEO David Dawson.

Western DataCom, a supplier of encryption technology, is using SmartGuard to let trading partners securely access its corporate database. The company will let about 150 distributors “come in and check inventory and status of orders,” said Philip Ardiere, the company's CEO.

SmartGuard sports a stateful inspection firewall, which uses Network Address Translation to hide internal IP addresses. The box can also detect and thwart hacker-scanning attacks.