How to Meet the Health Check Secure VPN Security Requirements

Overview

The Secure VPN Network Connect session establishes an Internet connection from your remote computer to the University computer network as a trusted device. To reduce the chances of an infected computer passing viruses via this connection, a new service has been implemented called Health Check which checks configuration settings on your computer each time it connects to Network Connect. If the requirements are not met, the computer is at a greater risk of being infected and will be denied access to Network Connect. This does not mean that your computer is infected with a virus. It does mean that your computer is vulnerable to being infected with a virus. In order to pass Health Check, your computer must meet the following criteria:

• Operating system is Windows XP with Service Pack 2 or Windows Vista. (Macintosh and Linux systems are not being checked at this time.)

• Microsoft Automatic Software Update turned on so you can receive the latest security patches.

• The latest version of Symantec Anti-Virus with LiveUpdate turned on so you can receive the latest virus definitions.

• A software firewall must be installed and enabled on your computer.

Windows XP with SP2 or Windows Vista

If your computer has a Microsoft operating system that is older than Windows XP (Windows 98 or 2000), you will have to upgrade to Windows XP or Windows Vista to access network connect. Windows XP or Windows Vista is the required Microsoft operating system because it has significant security enhancements over the earlier versions of Windows. As a University affiliate, you can obtain copies of Microsoft Campus Software, which includes Windows XP or Windows Vista and Office 2003, from Software Licensing Services for use at work and home. SLS is able to provide software at significantly reduced costs through the University's agreement with software vendors.

Microsoft Automatic Software Updates

Your computer must be configured to automatically check for and install Microsoft Automatic Software Updates. The updates are released by Microsoft on the second Tuesday of every month, and address security vulnerabilities and bug fixes for Microsoft products. The following steps will configure your computer to receive automatic updates.

1. From the Start menu, select Control Panel.
   

2. Double click on the Security Center icon.
   

3. Under Manage security settings for, select Automatic Updates.
   

4. Any of the automatic options are acceptable, but it is recommended that users select Automatic with installation on a daily schedule. The default time for installation is 3:00 am, but it can be set to any time that is convenient for you.
   

CSSD also offers an automatic update service from updates.pitt.edu. Information on the service, software download, and configuration are available at the web site.

Symantec AntiVirus and LiveUpdate

The latest version of Symantec AntiVirus must be installed on your computer, and it must be configured to run LiveUpdate automatically. Symantec AntiVirus is the recommended and supported software of the University for anti-virus protection. It is available to all faculty, staff and students of the University for free and can be used in the office and at home use. Symantec AntiVirus can be found on the Toolkit CD, available in campus computing lab, or downloaded from software.pitt.edu.

LiveUpdate is a critical component of Symantec AntiVirus. This feature is activated by default during installation and checks for the latest anti-virus and anti-spyware definitions available from Symantec. When new definitions are available, LiveUpdated downloads and installs them on your computer.

Directions on downloading and installing Symantec AntiVirus are available on technology.pitt.edu in the Help section under Help Sheets and General Information.

Personal Firewalls

A personal firewall is a software application used to protect your computer against intruders when the computer is connected to the network. The firewall can be configured to control network connections to and from your computer, filtering traffic that comes into or leaves your computer, and alerting you to attempted intrusions. Health Check verifies if any of the following firewalls are installed and activated on your computer. This list will be updated as new personal firewalls are made available.

• AOL Firewall (1.x)

• AOL Privacy Wall (2.x)

• BlackICE (7.x)

• eTrust EZ Firewall (5.x)

• eTrust Personal Firewall (5.x)

• Integrity Agent (6.x)

• Integrity Client (4.x)

• Integrity Desktop (5.x)

• McAfee Desktop Firewall 8.0

• McAfee Personal Firewall Plus (7.x)

• Microsoft Windows Firewall (XP SP2)

• Microsoft Windows Internet Connection Firewall (XP SP1)

• Norton Internet Security 2006 (Symantec Corporation) (9.x)

• Norton Personal Firewall 2006 (Symantec Corporation) (8.x)

• Proventia Desktop (8.x)

• Sereniti Firewall (1.x)

• Sunbelt Kerio Personal Firewall (4.x)

• Sygate Personal Firewall Pro (5.x)

• Symantec Client Security (10.x)

• The River Home Network Security Suite (1.x)

• Tiny Desktop Firewall 2005 (6.x)

• Tiny Firewall Pro (6.x)

• Trend Micro OfficeScan Client (7.x)

• Trend Micro PC-cillin Internet Security 2005 (12.x)

• Windows Live OneCare (1.x)

• Zone Labs: ZoneAlarm Pro and Zone Labs Integrity

• ZoneAlarm (6.x)

• ZoneAlarm Anti-virus (6.x)

• ZoneAlarm Pro (6.x)

• ZoneAlarm Security Suite (5.x)

• ZoneAlarm with Antivirus (5.x)

If you do not have a personal firewall on your computer, you can use the Windows Firewall that is built into Windows XP SP2. To enable Windows Firewall:

1. From the Start menu, select Control Panel.
   

2. Double click on the Security Center icon.
   

3. Under Manage security settings for, select Windows Firewall.
   

4. Select On to enable the firewall and click on OK.