full-disclosure - Re: [inbox] Re: Fwd: Comment on: USB devices spreading viruses

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Sun, 23 Nov 2008 21:22:41 +0530
From: "Mike C" <mike.cartall@...il.com>
To: imipak <imipak@...il.com>
Cc: Full Disclosure <full-disclosure@...ts.grok.org.uk>
Subject: Re: [inbox] Re: Fwd: Comment on: USB devices
	spreading viruses

On Sun, Nov 23, 2008 at 7:20 PM, imipak <imipak@...il.com> wrote:

> Exibar wrote:
>
> > wow, disabling files to run from the root of all drives would never, ever
> > fly in a corporate environment.  Although I do like the idea on stopping
> > autorun malware, it would work... but oh the calls to the helpdesk! ;-)
> >
>
>
> Each of those support calls is an opportunity to find out why a user's
> trying to run unauthorised software and either help them to find a way
> to do what they want with existing apps, or get a new app reviewed and
> authorised for use -- if it's a genuine business need. Alternatively,
> sometimes they need an introduction to Doctor Cluestick, if they're
> trying play poker online, install dancing hamster screensavers or what
> have you.


According to the article, lots of important data was lost. Its not hard to
conclude what *kind* of data. Such a thing happening inside an intelligence
agency is indeed worrying (as n3td3v pointed out)


>
>
> Of course, blindly thwacking people / dragging them to HR by the hair
> when they're really just trying to do their jobs is
> counter-productive. The calls also show us where we, security, are
> falling down. Perhaps it's poor awareness training (if the user didn't
> know that they shouldn't run unapproved software, or why we have that
> rule, or how to get a new app approved); or could be that the official
> route is being seen as too slow or bureaucratic, in which case it
> needs fixing. And so on.
>

All I hope is we can fix the issue. Hopefully in the near future.

MC

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/