full-disclosure - Re: Need some help with management

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Fri, 23 May 2008 10:10:53 -0400
From: "Castigliola, Angelo" <ACastigliola@...M.COM>
To: "Daniel Sichel" <daniels@...derosatel.com>,
	<full-disclosure@...ts.grok.org.uk>
Subject: Re: Need some help with management

Daniel,

I think you will find that this is a common problem in the industry.
There are going to be times where non-company owned assets are going to
need to plug into your network with business justifications such as a
vendor visiting onsite or in your case where the vendor agrees to manage
their asset on your network. I understand as a network administrator you
see the risk of having a machine on your LAN that you\your team did not
personally secure (un-trusted) however it is imperative that you balance
the security of your network with the business needs of your
organization. In this situation it is important to develop a policy that
acknowledges this as a known risk and establish guidelines to reduce the
risk such as requiring all non-company owned assets that utilize your
LAN to have antivirus installed with the latest updates, secured with
the latest patches, etc. The vendor will need to be informed of the
policy and understand that he needs to comply with this policy to ensure
the security and stability of your corporate IT infrastructure.

Angelo Castigliola III
Information Security - Application Security Architecture
Unum

* acastigliola@...m.com

________________________________

From: full-disclosure-bounces@...ts.grok.org.uk
[mailto:full-disclosure-bounces@...ts.grok.org.uk] On Behalf Of Daniel
Sichel
Sent: Thursday, May 22, 2008 12:51 PM
To: full-disclosure@...ts.grok.org.uk
Subject: [Full-disclosure] Need some help with management

My management here wants to put a server on our LAN, not administered by
us (the IT department) and use a share on it to serve files and data to
our workstations.  They do not understand why having a server with a
file share that is NOT part of our secure infrastructure represents a
threat to the computers accessing it. Keep in mind this is an all
Windows network. Sooo, if you guys can succinctly explain why having a
trusted computer trust an untrusted computer is a problem, that would be
helpful. Keep in mind we are talking to management here. It's kind of
like trying to explain why, when you are in the United States, it's a
bad idea to drive on the left hand side of the road. It's just so basic
it's not documented anywhere. So, please help me explain why netbios and
file shares on machines not within your network are bad ideas.

Thanks,

Daniel Sichel, CCNP, MCSE,MCSA,MCTS (Windows 2008)

Network Engineer

Ponderosa Telephone (559) 868-6367

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/