lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <BANLkTinGDxXxcwJGcSeMxxA5F10qamGj-w@mail.gmail.com> Date: Fri, 29 Apr 2011 06:45:53 -0400 From: Guy <full-disclosure@...lamatix.com> To: full-disclosure@...ts.grok.org.uk Subject: Re: Computer name should match with your real identity? On Fri, Apr 29, 2011 at 3:26 AM, <taneja.security@...il.com> wrote: > Recently got a policy from admin to change your PC name with your "name" + > organisation name. > System admins typically aren't responsible for policy creation depending on the size of the organization. Was the request made due to an organization policy change, a new guideline, or just "because"? Was the admin given the appropriate authority to request such a change? > I am not doing it for a long time as I feel it could be case of > "information leakage" . > While that's a valid point worth considering, orders are orders, which is why it's important to know under whose authority did the admin request the change. > So need any ref./case study/security policy referencing not to have real > name . > For starters, a computer isn't a person. A more appropriate location to store equipment assignment data is in an asset management/tracking system. This way there's an audit trail and accountability. The equipment becomes the users responsibility, so when/if it's transferred to another user, there's motivation for them to make sure their asset manager is informed. Otherwise, they risk being charged or held responsible if the equipment goes "missing." Also, an environment with roaming profiles or multi-user systems will make the computer name irrelevant/invalid once another user or users logs in. There are probably dozens of other reasons that just aren't worth mentioning. Think most would agree the admin's request is a terrible idea. Perhaps you could recommend an alternative naming convention that will provide more benefit to the organization in the long run. A couple of examples: BIT02DWS9966 - Bureau of IT, Building #02, Desktop Workstation, Property/Asset Tag 9966. BFS07LWS9211 - Bureau of Financial Service, Building #07, Laptop (mobile) Workstation, Tag #9211. PDC01SVWB012 - Primary Data Center #01, Server, Virtual Machine, Web/HTTP, #012 DDC02SPEX022 - Disaster Recovery Data Center #02, Server, Physical, Exchange #022. <location>,<3 char type class code>,<asset#/clusterid/whatever> Can apply this convention to any type of device on the network: SDB for databases, MFP for multi-function printers, HFW for hardware firewalls, etc. To distinguish between dev/test, use a higher number in the suffix, 999, 998, etc. Prod will use 000, 001, 002, etc. Just an initial thought, others may have better suggestions.. Would like to know how other organizations address this issue, though. I personally hate seeing devices on a network with ridiculous names as though the IT infrastructure is some kind of kiddy cartoon world. Gonzo, Nemo, Simba, and the like are not appropriate and provide absolutely no benefit to anyone. If users need to access a resource using "simba", create a DNS alias/entry... "Uh-oh, Sponge-Bob is out of ink, can you reprint the report on the Chim-Chim!!?!on1e??!" Yea, didn't make that up... And just to be clear, the proposed naming convention above isn't something to distribute to end users or folks using the services on a host. Have had developers ask me to audit their web applications and provide a url like, "http://PDC01SVWB996.int.the-domain.org/some-lame-app/MyAwesomeTool.aspx". No. Create a DNS entry, don't distribute the actual host name... Good luck. Regards, Guy www.nullamatix.com Key: 0x353DA923 _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists