Steve Berry

UK

Infrastructure Architect

Talk about being extremely risky !

From the info supplied, I completely fail to understand the rationale behind this.
If Corps do this, and even *one* of those machines gets compromised ( assuming a basic software config for all ) they'll *all* be compromised.

They're relying very heavily on existing client based firewall products.

If an exploit is found on the firewall products they're using (as is possible), they'll be leaving themselves way too open and we're talking a multinational Corp here which should be exhibiting a highly responsible set of ethics ! Not to mention the admin costs of securing 18,000 directly connected laptops.

I'd rather have a standardised perimeter/DMZ firewall based setup where if security is breached, at least they should have the processes/procedures in place to track where the problem was and take the appropriate action to harden the network accordingly.