General discussion
-
Topic
-
Protection from internal employees
LockedPlease provide me with list of Information, Tools for securing network & servers from inside (from our employees).
We are using NT 4.0 with Exchange 5.5 at present, with plans to migrate to 2003 AD/Exchange 2003 soon.
Internal security issues –
1. When a user logins to the domain controller, his password travels (data packets) over LAN ? so anyone using a Sniffer tool can capture it & read it. Can we prevent this at all?2. It?s a common secret that NT Passwords can be hacked down using hacking tools (Lhopt etc) ? any prevention or intrusion detection systems available, so even if anyone runs those software & starts to probe the domain controller ? we can catch him before any passwords get revealed.
3. Any user in network can delete files/data from shared folders or VSS ? can we know who, when did that ? maintain logs?
4. We have a FTP Server being shown to outside world, anyone having ftp-user password can zip critical company data / info, put it on FTP server & download it at his home (or outside our network), can we maintain any logs (we already have IIS logs enabled).
5. We?re using Exchange 5.5 with Outlook 2000 clients & ASAP Enterprise Gateway for Antispam solution. Can we offer better protection for sending / receiving emails? Maybe encrypt emails, use PGP?
There may be more such issues I would have missed, please let me know about them & of course ways to stop or minimize them.
How do companies work on these fronts?If we need to buy new software, tools, extra systems for implementing the above protection ? please let me know.
I want to implement & achieve the best internal security setup for our Office.
Akash
Akashdeep_b@yahoo.com