suggestions (1 of 3)
introduction:
there are a number of things that are vulnerabilities at the highest levels of: MS WIN OS and MS AD and MS SQL SERVER? and before you do any of these things, think it through and check with you CIO and/or network manager since inter-departmental politics will be important?
---
MS AD. . .
---
1. Inventory of all network IDs are to be reviewed quarterly --or more often --First time you will need to do all of these things (but the good news is that once done, it is a matter of handling new IDs)
2. check for accidental (and deliberate duplications) of IDs (e.g., ?HOWARD? and ?H0WARD?? note the ?zero? in place of the ?oh? )
3. Obsolete IDs (e.g., Jane Smith gets married and HR makes you perform the IT portion of the change-of-name, only you forget to delete ?JANE SMITH? after creating ?JANE SMITH-KLIEN?)
4. Neglecting to set expiration dates for IDs assigned to consultants, interns, temp employees, etc.;
5. Neglecting to disable IDs assigned to vendors for use during updates and/or debugging;
6. Incomplete descriptive info for each ID in the AD?s description? usually job title, phone #, etc.; when ID is associated with an application, then the application and its version
7. Cross-referencing IDs with current staff roster (get that from HR)
8. Establishing liaison with HR to get revised (total) roster every month (i.e., first Monday, last Friday, etc.) and then look for the deltas?
9. Establish policy for departing employees to be ID will be disabled on the date of separation
10. Establish policy for employees out on extended leave to be ID will be disabled on the start date of leave
11. Identify all IDs used off-site? VPN, dial in, public computers in hotels, etc.
12. Determine the MACs for laptops, office desktops and home desktops in order to run scans for anomalous usage
