full-disclosure - Re: Need some help with management

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <04c901c8bc3c$fc8fa0b0$f5aee210$@com>
Date: Thu, 22 May 2008 15:52:30 -0300
From: "Kurt Dillard" <kurtdillard@....com>
To: "'Paul Schmehl'" <pschmehl_lists_nada@...rr.com>,
	<full-disclosure@...ts.grok.org.uk>
Subject: Re: Need some help with management

If your team isn't going to be managing this server who is? 

Ask him this: would it be ok for your penpal from Russia to bring his family over and move into your boss' spare bedroom for a few months until they find their own place? Come on, it will be fine, you've been trading emails with this guy for a couple of years now. He told you he has a job lined up over here so he won't be a financial burden or anything. His kids sound like fun too, your boss' family will love them!

You don't just want to try to shoot down the idea without having alternatives prepared. If all you do is try to negate business initiatives you'll find all of the managers trying to bypass you in the future. You need to be seen as a strategic enabler rather than a blocker. I suggest you determine what the business reasons are for this decision and then try to find a better solution that protects your organization's sensitive data and systems while addressing the original requirements. Do they want to share data with a key partner? Do they want to outsource some work? What purpose will the system serve?

-----Original Message-----
From: full-disclosure-bounces@...ts.grok.org.uk [mailto:full-disclosure-bounces@...ts.grok.org.uk] On Behalf Of Paul Schmehl
Sent: Thursday, May 22, 2008 2:25 PM
To: full-disclosure@...ts.grok.org.uk
Subject: Re: [Full-disclosure] Need some help with management

--On Thursday, May 22, 2008 09:51:01 -0700 Daniel Sichel 
<daniels@...derosatel.com> wrote:

>
>
> My management here wants to put a server on our LAN, not administered by us
> (the IT department) and use a share on it to serve files and data to our
> workstations.  They do not understand why having a server with a file share
> that is NOT part of our secure infrastructure represents a threat to the
> computers accessing it. Keep in mind this is an all Windows network. Sooo, if
> you guys can succinctly explain why having a trusted computer trust an
> untrusted computer is a problem, that would be helpful. Keep in mind we are
> talking to management here. It’s kind of like trying to explain why, when
> you are in the United States, it’s a bad idea to drive on the left hand
> side of the road. It’s just so basic it’s not documented anywhere. So,
> please help me explain why netbios and file shares on machines not within
> your network are bad ideas.
>

OK.

So, Mr. PHB, why is it that your chauffeur stays with your limo when you're not 
there?  Because you don't want to trust your limo to just anybody?

:-)

-- 
Paul Schmehl
As if it wasn't already obvious,
my opinions are my own and not
those of my employer.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/