HP Access Control Client Software manual Tests for Minimal Endpoint Integrity

Designing Access Controls

Finalize Security Policies

You might select tests such as these for a policy intended to test guest endpoints before letting them use your network to access the Internet. You eliminate the most common threats from unknown equipment without frus- trating guests with policies they cannot meet.

1.Does your policy mandate that endpoints be free of viruses, worms, and other malware?

Check the cell for that test.

2.Does your policy mandate that endpoints have all patches (“hotfixes” for Windows or “security updates” for Mac OS X)?

Check the cell for every version of Windows that might run on endpoints that connect to your network. Check the “security updates” cell if your network might need to accommodate Mac endpoints.

Table 3-94. Tests for Minimal Endpoint Integrity

	Viruses,	Windows	Windows	Windows	Windows	Windows	Windows	MAC
	Worms,	2000	2003 SP1	2003 SP2	2003	XP SP2	XP Hotfixes	Security
	Malware			Hotfixes	Hotfixes	Hotfixes		Updates
Activate
this test?

3.For Windows machines, do you require a particular SP?

Fill in the required SP for every version of Windows that might run on endpoints that connect to your network.

Table 3-95. Tests for Minimal Endpoint Integrity

Windows 2000 Windows 2003 Windows NT	Windows XP
Server

Required SP?

Tests for Medium Endpoint Integrity. The tests above eliminated the most immediate threats. Your security policy might mandate other tests that help endpoints remain protected with anti-virus software and personal firewalls.

These tests are often used to test your own network’s equipment (private zones). After all, an organization that has purchased anti-virus software can reasonably require its endpoints to use that software. However, you might also activate some of these tests for high security public zones, particularly those that offer a degree of access to the private network in addition to Internet access.

3-122