|
|
Overview
The software can download silently and without any user action. Of course, you may have some indication but many novice users and those who just don't read the messages may choose the "Yes" option thinking their browser is asking them to download a legitimate plugin.
This is how it all begins. Sitting in a bank facility and hearing the intercom message "shut down ALL computers immediately" being stated is quite frightening. I was there to hear the words and watch what took place. The upsetting part was when employees took advantage of the tragic moment to leave the facility for an early lunch. Many of those who remained laughed over the incident.
The Business Solution
All appropriate departments must sign off for the procurement of computer systems, their software and hardware configurations and the maintainance/update procedures.
The final approval for procurement is by the department responsible for company computer security. On a regular scheduled basis this department should be audited by an independant organization to ensure that the best business and technical practices are in use. There should not be any compromise allowed on accountability and responsibility here. Too many jobs and personal lives can be adversely effected through permissiveness.
| Special Considerations
With Firewalls
- limit firewall accounts to only those absolutely necessary, such as for the administrator. If practical, disable network logins.
- use authentication tokens to provide a much higher degree of security than that provided by simple passwords.
- Challenge-response and one-time password cards are easily integrated with most popular operating systems.
- remove compilers, editors, and other program-development tools from the firewall system(s) that could enable a cracker to install Trojan horse software or backdoors.
- do not run any vulnerable protocols on the firewall such as tftp, NIS, NFS, UUCP, or X.
- the finger protocol can leak valuable user information, consider disabling finger.
- on e-mail gateways, consider disabling the EXPN and VRFY commands, which can be used by crackers to probe for user addresses.
- do not permit the firewall systems to ``trust'' other systems; the firewall should not be equivalent to any other system.
- disable any feature of the firewall system that is not needed, including other network access, user shells, applications, and so forth.
- turn on full-logging at the firewall and read the logs routinely.
|
