Companies consider it important to check whether or not remote computers meet corporate security profiles before they gain VPN access, but endpoint checking cannot address all the problems the machines might cause.
Because endpoint security can prevent infected machines from spreading malicious code to corporate networks via VPN connections, it has become a standard offering of the most remote-access VPN vendors including Aventail, Check Point, Cisco, Citrix, F5 Networks, Juniper and Nortel.
But the technology also has inherent shortcomings. It cannot guarantee that a particular computer will be free of infection when it joins the network. For instance, a key area for endpoint software is to check for antivirus software, and it relies on periodic updates of signature libraries to be effective.
It takes a certain amount of time for antivirus vendors to discover viruses, identify signatures for them and update their signature libraries. During that interval, the virus could infect a machine that is running the latest version of corporate prescribed antivirus software. The endpoint check would find the computer in compliance with security requirements and admit it to the network, where it could introduce the virus.
"The problem with endpoint security is that in concept it's a great idea," Yankee Group analyst, Zeus Kerravala, said. "In practice it has problems."
At the recent Black Hat Security Conference, this type of endpoint security was called a shortcoming at a controversial session that poked holes in network access control (NAC) schemes.
"It all breaks down to what is being checked, and is the information helpful or not?" CTO of NAC vendor, Insightix, Ofir Arking, said.
Much of the problem lies with how fast businesses can update the client software as new vulnerabilities, exploits and malware are discovered. For example, when a flaw is found in an OS that leaves it vulnerable to attacks, patches are issued, but in many cases are not installed immediately.
The time it took to issue patches and check whether they break other applications on corporate computers delayed installing them, Arkin said. The business also had to schedule time to install the patch and roll it out to all of the computers it maintained further delaying when the operating system was made safe.
The business can update its endpoint-checking software to seek the patch as part of the security check it runs on endpoints. This process could take weeks or months, Arkin said. Regardless of how quickly virus updates or patches were issued, new attacks could not be prevented using endpoint checkers.
He said endpoint checking didn't ensure unauthorised users were kept off the network or that sensitive information wasn't transferred over VPN links.
It could also interfere with user productivity, Yankee Group's Kerravala said. Many endpoint security checkers can divert noncompliant machines to what is known as a remediation site, where the software needed - including virus signature update, operating system patch or personal firewall - can be downloaded. It sounds good on paper, but it has a major flaw. It interrupts the workflow.
He painted the scenario of a salesperson about to enter a meeting who tries to log on to the VPN to download the latest version of a presentation, only to be denied access because the operating system on the computer needs a patch. Even if the endpoint-checking software redirects the machine to a remediation site, the time it takes to download and install the patch is likely to delay seriously the delivery of the presentation. This can keep VPN administrators from using endpoint checkers.
It was possible to issue one-time exemptions so users, such as the salesperson who needs the presentation, could reach the VPN without passing the endpoint check, he said. But if the problem arose repeatedly and continued to block important work, the exemption could replace the rule.