Situation:
I have a standalone Windows Server 2003 running Terminal Services supporting six users. The users are using their personally owned computers (typically laptops) to access the terminal server through Remote Desktop. The application being hosted is a mortgage brokering application with extensive financial information on company clients and therefore requires reasonable attention to security considerations.
Requirements:
1) Users want to be able to connect using wireless networking.
2) Users need to be able to connect to the terminal server remotely (typically from home).
3) Users need to be able to connect with their own personal computers.
4) The regular personal use functionality of the users' computers cannot be restricted.
5) The terminal server must be appropriately secure for its financial services application.
6) The solution must be very affordable and not overy burdensome on the end users.
Resources:
1) Windows Server 2003 w/ Terminal Services (2.8Ghz XEON, 1GB RAM, WD Raptor SATA RAID 0)
2) Netgear FVS318 ProSafe VPN Firewall with 128/384 DSL.
3) Netgear WG302 ProSafe 802.11g Wireless Access Point
4) Me :-)
My Ideas:
For wireless network access I have been thinking of implementing WPA with RADIUS authentication on the access point to ensure that only authenticated users can access the wireless network. For remote accesss I can open port 3389 on the firewall, but that exposes the terminal server to the entire Internet (a prospect I find rather unsettling). At yesterday's TechNet seminar, the Microsoft presenter recommended requiring the use of a digital certificate stored on a smart card in conjunction with the username and password authentication. Unfortunately, I am not in a position to purchase smart cards, smart card readers, etc. However, this gave me the the idea of requiring a digital certificate to be installed on the computer in addition to user authentication. That way, even if someone else discovers a valid username and password combination they would be unable to use it to connect to the terminal server unless they also had access to an approved computer.
Questions:
1) Can I do this? If so, how? (authentication, IPSec, vpn, etc.)
2) Should the wireless and remote access security be combined into a single solution?
