Last month's eruption of the Storm Worm, and the persistence of other worms such as the Slammer worm, which made its debut nearly five years ago, points to the ongoing need for a comprehensive approach to the threats that worms and viruses pose. The transmission route of the Storm Worm is not particularly sophisticated, and relies on the user to click a link in a phony e-card.

With the increase in the number of mobile workers, many of whom don't feel that security is their responsibility, IT departments must develop a coherent strategy to combat these incursions. User education never hurts, but it is rarely effective. Despite the near-religious use of anti-malware programs to scan incoming email, a more subtle route into the corporate network may be causing problems.

Many mobile workers use a combination of personal and company-provided hardware and software. A good place to start may be by determining the number of workers who normally conduct company business on their home computers. Establish policies for the proper handling of company data and insist that sensitive corporate or customer data stay on corporate computers.

One relatively easy approach is to extend licensed anti-virus protection to employees' personal computers. Although this increases the anti-virus licensing costs, the amount of IT time this will save, and the added layer of security will pay dividends well into the future. If licensed, updated anti-virus software is extended to the user's home computer, the corporate network's exposure to viruses, worms and other malware may be reduced, and a persistent source of infection can be controlled. The cost of licensing anti-virus software is certainly less expensive than the time it takes to clean up an accidental infection, particularly if the infecting worm is destructive.

Another strategy is to provide step-by-step documentation to help employees turn on firewalls and other protective software on their personal computers. Again, the goal is to minimize the contact the corporate network will have with material from "dirty" sources. Establish policies that cover what open wireless networks may be used for. If a mobile worker must handle sensitive data on the road, invest in a secure cellular or satellite service that eliminates the need to use open wireless connections, such as those found in coffee shops, hotels, and convention venues.

Insist that laptop users regularly upgrade their anti-virus software. Regular scheduling of updates may not be enough, since mobile users are often not on line at the prescribed update intervals, and sometimes disable or delay the update scheduler to conserve battery life or improve the computer's performance.

You may not be able to control what your road warriors do while they're out of the office, but it's ok to establish anti-virus and anti-malware update policies, data handling policies and rules about how and when an open wireless connection may be used. If you are going to go this route, compliance may hinge on the availability of an acceptable alternative to whatever "easy route" is being offered to your mobile users, even if this increases the cost putting someone on the road, or allowing them to work from home.