IPsec Filters

IPsec filters can be used in many different ways on clients. Between the discussion about IPsec filters on servers above, and we have probably beaten that horse to death. As a general recommendation, we recommend that you use IPsec filters to prevent your clients from talking to each other.

Software Restriction Policies

SRP is more difficult to use on clients than on servers, because clients are more general-purpose machines. Setting up SRP to allow a client to actually function is a significant upfront time investment. However, if you spend the time doing this, you will be rewarded with a much more secure machine. We recommend that you use SRP as much as possible to protect clients from malicious code.

Anti-Malware

Antivirus software is the traditional malicious code prevention technology. The problem with antivirus software is that it is only signature based. It cannot prevent viruses that it does not know about, which SRP can by allowing only trusted code to run. As a defense-in-depth measure, antivirus is tremendously important, but it is important to understand its limitations.

Do not forget about other types of anti-malware programs either. Anti-spyware is rapidly becoming a requirement as well. Of course, if you run as LUA, it is unlikely you will get much spyware on the system, but it is very useful if you have to run as an administrator.

There is also the problem that not all machines can use antivirus tools. For instance, we do penetration testing, and the antivirus products delete the tools we use in that job. Therefore, we cannot run them. As a general rule, however, we recommend using antivirus products on most, if not all, clients.