{"id":460,"date":"2009-07-25T10:34:10","date_gmt":"2009-07-25T10:34:10","guid":{"rendered":"http:\/\/refraction.co.uk\/blog\/?p=460"},"modified":"2009-07-24T21:45:03","modified_gmt":"2009-07-24T21:45:03","slug":"why-use-windows-7-directaccess","status":"publish","type":"post","link":"https:\/\/refraction.co.uk\/blog\/2009\/07\/25\/why-use-windows-7-directaccess\/","title":{"rendered":"Why use Windows 7 DirectAccess?"},"content":{"rendered":"

I\u2019ve a couple of posts now about Windows 7 DirectAccess (here<\/a> and here<\/a>), and particularly about it\u2019s use of IPv6.\u00a0 It\u2019s all been fairly technical, but despite the title of one of those posts I\u2019ve only briefly touched on what DirectAccess is and why you might want to use it in your organisation.\u00a0 So here goes\u2026<\/p>\n

There are a few trends to consider when you think about DirectAccess (DA) as it\u2019s been built to answer some of the challenges that they pose.\u00a0\u00a0 The first is Mobile Working.\u00a0<\/p>\n

In my experience over the past few years the amount of mobile workers, or at least those that are equipped with laptop computers to allow them to work remotely, has been steadily increasing.\u00a0 With home broadband now available to most people, wireless networks common in peoples homes as well as in hotels and airports, peoples ability to work out of the office has never been greater.\u00a0 And with them goes your corporate data, whether that be on their laptop, or a USB key or in an email to their GMail account \u2013 applying security closer to your data will become more important as time goes on.<\/p>\n

Another trend to think about is cloud computing.\u00a0 \u2018Cloud\u2019 is the new buzzword these days but it covers a wide range of topics.\u00a0 The chances are most big companies are already using cloud services of some sort, whether that\u2019s full on Google Enterprise or a Message Labs email filtering service.\u00a0 Either way, that sort of managed or outsourced service will be a big factor over the next few years, and they introduce a few new things to consider.\u00a0 First, relying on systems and services that you don\u2019t have on your network, or managed by your guys, means that again security needs to be moved closer to those systems and the data they contain.\u00a0 Secondly, if the services your end users access are out on the Internet somewhere perhaps the best way of accessing them remotely might not be via your corporate network.\u00a0 Mobile clients may need to access both your network and the wider internet at the same time.<\/p>\n

These trends combine with a third which is around the changing nature of the security perimeter around corporate information.\u00a0 On the DA class I went on at Microsoft they referred to this as \u2018re-perimeterisation\u2019 which I think is a much better term than \u2018de-perimeterisation\u2019 which is favoured by the Jericho forum.\u00a0 Whilst this is a big subject in its own right, the gist is that the traditional model of securing your information by firewalling off you network and relying on that perimeter to protect your systems hasn\u2019t been sufficient for a couple of years now.\u00a0 We need to start moving security in towards the host and the data.<\/p>\n

So how does DirectAccess help with all this?<\/p>\n

Well DirectAccess provides your organisations remote computers with transparent access to both the Internet and your corporate network.\u00a0 If a DA enabled laptop connects to the Internet, a connection to the corporate network is automatically established at the same time.\u00a0 This connection is authenicated against both the computer and the user, and secured using IPSec between the client and corporate resources it accesses (not just between the client and the gateway).<\/p>\n

The computer can be authenticated either using a machine certificate issued to validated it\u2019s from your domain, or by a health certificate from a Network Access Protection system to validate that the computer is \u2018healthy\u2019 (patched, AV\u2019ed) enough to enter your network.<\/p>\n

As DirectAccess launches the corporate network connection automatically the end user experience is\u2026 well\u2026 invisible.\u00a0 They just logon as usual and they\u2019re connected (assuming that they have internet access of course).\u00a0 What\u2019s more, the connection to the corporate network does not compromise their general internet connectivity \u2013 or visa versa.\u00a0 You can specify the namespace of your internal network (for example intranet.mycompany.com) and any applications that attempt to access resources within that namespace are directed to internal DNS servers to ensure that the right resources are accessed.<\/p>\n

Because DA connectivity is \u2018always on\u2019 computers connected in that way are much easier to manage and support.\u00a0 With traditional VPN access solutions the remote laptops are only really manageable if and when the VPN is connected, meaning maintenance and patching tasks can be hard to achieve.\u00a0 DA clients are visible to to any internal systems of support teams.\u00a0 Patches can be applied, applications delivered and remote control tools used.<\/p>\n

As DA can establish a corporate connection before the user has even logged on you also get the benefit of being able to apply changes to group policy and update the mobile users security token etc. just as if the user was in the office.<\/p>\n

So in short, DirectAccess has the potential to greatly improve both the end users remote working experience, and the IT groups ability to support those remote users.\u00a0 It\u2019s good stuff (but you might want to read about some of the pre-requisites<\/a>!).<\/p>\n","protected":false},"excerpt":{"rendered":"

Why would you use Microsoft Windows 7 DirectAccess to help your mobile and remote workers? How might it help de-perimeterise your network? Is it work the IPv6 hassle?<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6,4],"tags":[307,304,305,13,309,308,179],"class_list":["post-460","post","type-post","status-publish","format-standard","hentry","category-tech","category-work","tag-de-perimeterisation","tag-directaccess","tag-ipv6","tag-microsoft","tag-nap","tag-vpn","tag-windows-7","entry"],"_links":{"self":[{"href":"https:\/\/refraction.co.uk\/blog\/wp-json\/wp\/v2\/posts\/460","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/refraction.co.uk\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/refraction.co.uk\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/refraction.co.uk\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/refraction.co.uk\/blog\/wp-json\/wp\/v2\/comments?post=460"}],"version-history":[{"count":3,"href":"https:\/\/refraction.co.uk\/blog\/wp-json\/wp\/v2\/posts\/460\/revisions"}],"predecessor-version":[{"id":463,"href":"https:\/\/refraction.co.uk\/blog\/wp-json\/wp\/v2\/posts\/460\/revisions\/463"}],"wp:attachment":[{"href":"https:\/\/refraction.co.uk\/blog\/wp-json\/wp\/v2\/media?parent=460"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/refraction.co.uk\/blog\/wp-json\/wp\/v2\/categories?post=460"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/refraction.co.uk\/blog\/wp-json\/wp\/v2\/tags?post=460"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}