From: "Geo." 

"Mike N."  wrote in message
news:6m7e33tb9fiv3n2fqj8kgo89amriftukh6{at}4ax.com...

>>I don't patch machines on the internal network, there is no need. On a
>>secure internal network you can run unpatched forever. My comments in the
>>other thread was in the use of NT4 where it would be exposed to the
>>internet.
>
>  I hope you mean server machines - regular machines would still be
> vulnerable via the browser, and can attack the servers, unless they are
> firewalled off from users as well.

I mean servers and desktops, and since 1995 they have had limited internet
access (only business related stuff) and email (without the ability to
receive attachments directly) and in all that time we have had zero spyware
and zero virus infections on the internal network.

We have a couple machines that are attached to the external network, these
are community machines shared by all when someone needs more access than
allowed on an internal machine. They get hit regularly but we just reimage
them or boot a knoppix CD.

It can be done, you just have to know what is required for users to do
their jobs and what they don't need.

Geo.

--- BBBS/NT v4.01 Flag-5