Strong Authentication
Without the security barrier of physical access (i.e. no
longer the fact that a staff member has to be present in an
office to log on), the reliance of single factor
authentication like a user ID and Password is dangerous. The
use of strong authentication, more commonly referred to as
two factor authorisation is needed.
VPN (IPSEC)
Communication cross the internet is the same as transmitting
information across an un-trusted and hostile network. Hence
encrypting VPN traffic between both points to ensure
information interception can not take place is essential.
VPN (clientless)
Using SSL to invoke encrypted communication through a web
browser is
the same IPSEC type VPN, and additionally reduces and if not
eliminating the need for a VPN client on the users PC. The
advantages are increased freedom and reduced support, the
disadvantage is that the removal of a client allows anyone
with a web browser to attempt a connection. Thus the
significance of strong authentication and user awareness
becomes more prevalent.
Client &
Device Security
Securing the laptop, pc and the devices that they can access
will ensure all points of threat are managed. Consideration
for encrypting the hard drives and device memory should be
considered. Denying unauthorised devices will ensure that
data is not accidentally lost or maliciously stolen and
prevent an innocent memory stick or Ipod for instance, from
being a back door into the network for malicious code,
virus, worms, and spyware. |
