Don’t Forget About the Desktop
In writing this month’s blog, it is tempting once again to write about one of the hot acronyms like BYOD or VDI that seem to get much of the attention these days. If I were having writer’s block I could always pump out another article on cloud computing which as a subject that seems to soak up all the oxygen in IT blogs and articles of late. It’s easy and fun to write about these subjects, yet, when you take the network down to its very essence, there is one very important element that remains just as important as it was a decade ago before all of these hot topics were barely a conception. That element is the user desktop. It’s boring, it’s mundane, and it’s the probably the most vulnerable aspect of your network today.
It’s easy to forget about the desktop, but it is a key component in today’s Endpoint Security model. We can no longer solely depend on a powerful firewall to keep all the bad stuff at bay. With the fruition of wireless, the Consumerization of IT and the increased knowledge base of today’s average user compared to a decade ago, the desktop must be protected and locked down. According to CIO magazine, a recent survey showed that more than 600 IT leaders reported that they had experienced a security breach as a result of consumer gadgets allowed in their network.
Gone are the days when you could depend on a simple antivirus application to protect your users from trouble they may expose themselves too through the Internet or file sharing. Antivirus client suite applications are complex today. One of the most popular one today remains Symantec Endpoint Security. In addition to basic antivirus, SEC features a desktop firewall, intrusion prevention system (IPS) and network access control (NAC) for further protective measures. These multiple features are indicative of other similar products today. It uses a proactive threat scanning, rootkit removal, and advanced application and device control which is constantly monitoring applications in real time. SEC also allows you to centrally manage all of your desktop clients from a single interface.
Today’s desktop environment demands more than just antivirus though. You need to manage your desktop as well, ensuring that users work in a streamlined efficient manner. You want to prevent them from accessing key aspects of the operating system, prevent them from making key configuration changes and circumvent helpdesk calls that cost you money. Windows Group Policy is a great tool to manage your user desktops and it is part of the Windows Server operating system. Group Policy allows you to hide operating system components such as the control panel, map drives and printers, assign and remotely install applications automatically and hundreds of other tasks. The addition of Group Policy Preferences a few years ago provides GUI based management as well as additional management features as well.
Desired Configuration Manager is a term popularized by Microsoft System Center Configuration Manager 2007. It is the concept of monitoring and assessing the compliance of computers with regard to their operating systems and applications. SCCM is a great asset for the network administrator, allowing him or her to implement Zero Touch Deployments of operating systems and applications and serve as an asset intelligence utility, ensuring that all of your desktops are compliant when it comes to licensing, updates, and network access protection.
SCCM 2012 improves on the popular 2007 version, adding concepts such as user centric management –providing the flexibility to make the desktop available on any device, at any time, and from any location. It also introduces the concept of Remediation to DCM abilities. In mediation, SCCM 2012 analyzes your desktops and comparing them to baseline configurations that you pre-establish and in some cases, such as for registry or script based applications, implement auto-remediation to reinstate these baselines. This prevents configuration shift or drift from occurring throughout your network.
Tools such as Group Policy and SCCM 2012 are powerful tools but both have distinct limitations when it comes to managing users and how they interact with third party applications. For instance, Group Policy can enforce configuration settings for Internet Explorer and prevent users from accessing its various configuration components, however, it can’t do anything when it comes to other browsers such as Mozilla and Chrome. This has left an opening for third party solutions such as PolicyPak. PolicyPak is a simple management solution that utilizes your current Windows Group Policy infrastructure to deliver configuration settings for dozens of third party applications such as Mozilla, WinZip, Chrome, AutoCad, Flash, Lync and Java JRE just to name a few. Besides delivering the desired configuration settings, PolicyPak will even disable or hide entire configuration tabs, further locking down your applications from your users.
The desktop is easy to overlook in this era of the cloud, but your helpdesk calls are dominated by desktop issues, many of which can be prevented with proper endpoint security methodologies and desired configuration management. With the proliferation of wireless devices, BYOD and desktop virtualization, it’s easy to lose control of the user desktop fairly quickly. Make sure that it’s you that retains control, not your users.
