Few technology administrators enjoy imposing strict restrictions on end users, especially when the restrictions appear excessive or draconian. Policy implementation is typically reserved for readily evident issues (Internet and e-mail usage, data retention and security, etc.) known to require enforcement.
Thus, it should come as no surprise that few organizations prohibited CD or DVD playback on company PCs, at least before November 2005. Numerous employees took laptops on the road; what harm could come from playing back a CD or DVD after-hours in a hotel? Further, network administrators or support staff pulling all nighters really couldn't be blamed if they chose to cue a Dexter Gordon CD while they worked, could they?
Yes, it turns out.
The Sony fiasco
What happened in November 2005 to change all that? Millions of Sony BMG Music CDs were found to be installing clandestine rootkit programs. Possibly the most feared type of vulnerability, due to rootkits' ability to compromise security while evading detection, the rootkits were being installed as part of a copy-protection effort.
Sony outsourced development of its digital rights management technology to First 4 Internet. First 4 Internet subsequently created a program that required users to accept a licensing agreement before playing back the CD on a PC. When users accepted the licensing agreement, a seemingly benign act, the rootkit was installed.
Windows systems everywhere quickly became infected. Sony was forced to recall the offending CDs. Confusion reigned while rumors flew regarding which CD titles installed the rootkit. Soon calls grew for class action lawsuits and settlement agreements. In the interim, technology administrators were caught in the middle. How could they identify systems that had been infected? How serious a threat did the rootkits pose? No one knew for sure.
Soon exploits began appearing on the Internet. Hackers created attacks that leveraged the vulnerabilities the rootkit's posed. Trojan horse exploits appeared that aimed to give hackers complete remote control over infected systems. Ultimately the issue became so widespread Microsoft was forced to issue a fix through a monthly update to its Windows Malicious Software Removal Tool.
Once the dust cleared organizations everywhere realized that previously secure proprietary and confidential data had been placed at risk simply because some well meaning employees listened to seemingly innocuous audio CDs at the office or using organization systems. Information protected by federal legislation (including HIPAA, and Sarbanes-Oxley), even, had been jeopardized.
CD and DVD policies
To prevent such security vulnerabilities in the future, organizations must now consider implementing CD and DVD policies that prohibit the installation and playback of any prerecorded CD and DVD using organization-owned equipment. In some cases, depending upon the industry in which an organization operates, it may also be necessary to require that no audio CDs or DVDs are installed or played back on any system that connects to the organization's network, either through a remote desktop connection or VPN.
Once a CD and DVD policy is implemented, organizations must also take the appropriate steps to ensure the policy is enforced. Without enforcement the policy will prove useless. Then, the next time a similar fiasco ensues, the organization will lose time and money attempting to determine its level of exposure and the manner in which the new vulnerability will be eliminated.
The time and effort required to identify and eliminate the security vulnerabilities that arise from such an incident should not be underestimated. When news of such an event firsts breaks, weeks can pass in which vendors deny the issues' breadth, consult with third parties to determine the source of the issue and debate a solution. It can even take weeks just to determine which titles, in fact, include the offending software.
All the while, hackers work overtime during these delays to design new hacks and exploits--some fueled by automated Internet bots--in their efforts to attack infected systems. Once installed, as a stealth rootkit was to blame with the Sony vulnerability, there's no simple way to determine whether your network or systems are even compromised.
Thus, policies offer the best defense against recurrence. Implemented and enforced properly, a CD and DVD policy essentially eliminates these issues from concern. While such policies might not prove popular, the organization can point to the confusion, vulnerabilities, attacks and lost time that occurred in the past to warrant the action.
For help determining your organization's CD/DVD risks, and for assistance drafting a proper CD/DVD policy, check out TechRepublic's CD/DVD Vulnerability Assessment and CD/DVD Policy template.
For more information on implementing effective policies, review the TechRepublic articles "Use a policy audit to ensure that your policies are followed," "Learn how to win support for your new IT policy," and "Creating an IT policy that works."
You can quickly implement a CD and DVD policy in your organization by downloading TechRepublic's CD And DVD Policy. Included you'll find a risk assessment spreadsheet that will help you determine the importance of such a policy to your organization's security along with a basic policy that you can use and modify. You can purchase it from the TechRepublic Catalog or download it for free as part of your TechRepublic Pro membership.
