I met this guy on the plane to Lagos and he invited me to use his internet café. You going to say that telnet to work's financials system wasn't secure? Heck, nothing nasty's happened so far so it must have been okay, right?

since I learnt (by visiting a friend) that Tiscali's shiny new wireless router is WEP only, I'm not surprised at anything. Security is not important to anybody, be it a government, a corporation or a home user.

The flipside is that the country is now indeed full of free hotspots.

Norton/Symantec telling us that viruses are on the up? Spyroot luckily informing us that malware and spyware are increasing? I do like these adverts dressed up as stories...

Sheesh! If any corporate is using Tiscali as their ISP ... (the Romans used to say "caveat emptor" meaning "let the buyer beware")

Oh! if a radio router is "only WEP" then two adjectives I would not apply to it are "shiny" and "new"

Everybody knows that SecureID is cracked, right?

nobody said my friend was "corporate" and the date of manufacture on the box is 03/2007. any other ignorant comments?

my note was only meant to emphasize that companies (such as ISPs) still couldn't care less about security. So, did you get the point now?

There should only be one recommendation to any organisation concerned about information security. That is to conduct an assessment of the risk and make up your own mind.

I'm sorry but recommedations to go out there and buy, buy, buy more technology before anything else are backward in their approach to security management and really not the story that vendors or anyone involved in the security/risk management field should be promoting.

I'll give NTA this though. Testing/audit whatever name you wish to call it is vital to understanding whether your investment in technical security controls is effective. Secondly using a third party makes quite good sense. You can't very well ask the person administering your systems/controls to check themselves. This is known as segregation of duties and life is full of examples where we do this to reduce risk.

Unfortunately you get people who take VPN security too seriously. My workplace specifically ban my linux machine (or other people's Macs) from connecting to VPN because they can't be arsed to test whether IPTables is as good a firewall as the stateful firewall that comes with the windows-only version of the Cisco VPN client, so they set something that won't connect you if you aren't using it. This doesn't make an awful lot of sense to me, I suspect they're just lazy sods who can't be arsed to deal with anyone with the imagination to use a different platform at home. So unfortunately I have no choice but to pollute my home machine with windows and dual boot. Gits.

fixit_f,

To authorise the connection of a new device/OS to the company's VPN the IT department has to audit the device to ensure it satisfies certain criteria. Going forward they would also be responsible for ensuring that future releases don't introduce any problems, as well as keeping up to date with patches and ensuring that all users do the same. This all incurs significant administrative overhead and possibly additional skills and expertise.

When they purchased the product from Cisco it came with certain assurances from the vendor that carry a lot of weight. A lot more weight, in terms of corporate risk management, then a bunch of academics on a mailing list extolling the virtues of this 'Linux' thing.

You may expect them to make an exception becuase you're 'special' and you 'know what you're doing', but it frankly isn't worth the risk (to the company, and the IT dept as individuals with responsibilies), and to do it properly isn't worth their time. If home working is a requirement then I suggest you install VMWare on your Linux system and then request the company purchase a copy of XP that you can install on it and use this to do your work.

(I use Linux and it's great and I wish I could install it on my work PC but I understand why I can't)

I think that fixit_f's point was that their IT dept places more trust in a basic firewall from Cisco than an open source version on another OS. Would you really trust an IT dept that couldn't be bothered to do even a little research about common security tools?

My experience with Cisco VPN is that the same VPN functionality is provided by all the clients that Cisco provide for various OS - with regard to providing an IPSec based, secure channel between client and LAN. If the machine is question is allowed on the LAN when in the office and has a proven firewall in place then I can not see an issue with trust when it comes to setting up a VPN connection. Also, I would be interested to know if the VPN client check ensures that the Cisco firewall is active as a user can disable the functionality.

Now if the issue is about controlling which OS that can access the LAN then that is a different issue entirely.