Security

I tend to be in favour of tight securrity, but I know that if it's too tight then the system isn't working properly.

the balance would be to secure against intrusion each machine ( firewall, av ) and secure network perimeter with firewall, av, email spam control.

if using wireless, have internal aps secured with keystroke pattern matching, and to only accept from specified mac addys. the aps for corporate clients are more open to access, but in a dmz to keep them from accessing the internal network.
( tighter security on wireless as it's easier to be abused )

Security has been getting out of control for several years now. SOX has simply fed the madness.

But sooner or later, the fad will move on to some new area and common sense will return.

Let's just all hope that the present lunacy ends sooner rather than later. Some of us are almost unable to function in our jobs thanks to the "security" vigilantes.

There is never enough time, money or personnel to monitor every possible security hole or potential misuse. Besides, in one-person shops, you don't want to come across as the thought police.

So, once again, do whats possible and document what you do and why. Law drives corporate policy. For example, the company I work for is controlled by state privacy law, a contract with a principal government entity, and HIPAA.

We have an acceptable use policy and I enforce it. Everyone sings a piece of paper saying the acknowledge a) they have no privacy in the work place and b) they can be monitored at will, for any reason or none. No one can add, change or remove anything on company computers, periods. If you install something, sorry, it now belongs to the the company.

We use ISA on all principal servers, and XP's own firewall on all XP boxes. I keep the ISA logs on all servers forever (or at least until I run out of disk space and have to move logs to tape). I check ISA traffic logs weekly and send department heads regular reports of where their staff hang out when they should be working.

We use no filtering at all - having to explain what you do on the computer to your boss is enough to keep people in line. We have no trouble with liquor, guns, ammo, porn, gambling, shopping and the like - it gets nipped in the bud pretty quick.

As the I.T. manager, I make it public knowledge that I look at all this stuff, and I subject myself to peer review, too.

If anything questionable appears in a log file, three people are immediately notified: a staff member's immediate supervisor, the HR manager, and my boss, the executive director. I will not subject any employee's email, web use and files to a detailed probe unless the HR manager tells me to ask our executive director. We do all this in writing and document what we do and why we do it.

As for spot monitoring, I put a hub between the inside NIC on our firewall and the switch that brings the network together. I use the Debian Linux-based Remote Exploit Toolkit, and EtherAPE to see instantaneous network traffic (inbound, outbound and combined). I know exactly where people are hanging out; if I have questions about why I go ask "Why are you on Ebay, net radio, or whatever?"

In summary:
1. Have a policy. Know why it exists, especially the law behind it.

2. Educate staff about what is expected of them.

3. Keep key decision makers in the loop about what you see.

4. Be personally accountable. The I.T. manager is NEVER above the law they enforce.

5. Document, document, document what you do and why you do it.

My 2 cents worth.

Industry Best Practices is not the best practice for everyone. First, best practices is a culmination of what every big company is doing to make sure thaty their information technology items are secure, that does not mean that there is a lack of common sense in the practices.

Second, companies that blindly follow best practices are in for a big problem when they finally figure out that it is overkill for their systems. Like Firewalling a firewall and firewalling that firewall just for the sake of security is overkill. There are good best practices and bad best practices and each company has to make the decision as to what is a good best practice.

Lastly, When we look at how security is implemented, nine times out of ten it is implemented backwards. Rather than understanding that security is looking at the most common hole and working backwards, they implement security but don't patch the open hole! Then they wonder how they still get viruses and junk!

When we look at security policies that are effective when they are implemented, we have to ask a simple question that requires an answer: Are we trying to keep the bad people out, or are we trying to keep employees from performing their job. Obviously, some think that keeping an employee from performing their job would be the wrong answer, but many times, when we try to keep the bad people out, we tend to make the people who have to do their job from doing it as well.

A security policy has to be enabled where the employee is responsible for the security of their work area. Everything in that work area is includes the workstation, the chair, and what is on their desk needs to be addressed. If they have a locked door or sit in a cubicle means that there are additional processes as well to make sure that confidential information does not disappear. In the many cases where you have more than one company that shares office space, it is imperative that steps be taken in order to handle any kind of security issue.

Desktops and Laptop pose a security threat, but not as bad as you would believe. Desktops with a SYSTEM BOARD PASSWORD where a removal of a battery would not make a difference, is important. Simply placing a Power-On Password that can be removed is not sufficient. Notebooks are the same. They should have the following:

System Board Password
Power on Password
Hard Drive Password

These can be different, or they can be the same, but your employee has to manage those risks if the system does not have different passwords. Why? First, if they get past power on password, and want to make a change in the BIOS, they need the System Board Password. And in order to boot the PC, they need to know the hard drive password or they go nowhere.

They can take the hard drive out and put a different drive in it and run it if it only has a HD password, but generally, they can?t eBay the item or attempt to get the data off of it with dual passwords, which secures your investment. That is what you can do for physical security outside of cabling it to the desk and locking the zippers on laptop bags, and educating users that leaving the notebook in the back of the car is not exactly the smart thing to do.

The other part of security is the ability to be able to detect threats and deal with them at the firewall and the network level. First, A firewall rule where if someone on the network inside our out is attempting to use a particular port for a period of time gets automatically put on the ignore list. Internally, you would disable the MAC address on the network, externally, you would place the IP on a temporary or a permanent ignore list. Second, email viruses and spoofing is a problem. You can get rid of much of the spoofs if you only do business in the US by blocking the rest of the world out. Or if you do, then you can manage it by including those companies you do business with by adding subnets. Third, have a daily updated virus detection system that detects Trojans, viruses, and scripts that are harmful and disables them at the network level. Next, if you use email (and who don?t), the email servers should have anti-virus scanning software that kills the virus and don?t email that it did it to the user. Why a user needs to know that a virus was killed is silly. Why waste the bandwidth with useless information that is going to be deleted by the end user?

There is a wealth of things that can be done in a corporation. Letting users know the system is being watched, that they can be brought up for disciplinary actions for illegal activity and installing unapproved software, PLUS if the system is not to have software installed or other un-needed access, then the global security and local profile should also disable those functions (See global profile for installing software.)

Some of the common sense stuff is right in front of many peoples face, all they have to do is flip a switch or make a policy that uses the security features of the operating systems. As I have said, I do not believe that the lack of common sense is the problem. Over thinking solutions and not hitting the mark is the problem.