From: Tremaine Lea (tremainegmail.com)
Date: Thu May 22 2008 - 23:11:55 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Hi Daniel,

There are a great many reasons why this is a bad idea, and I'm sure you
actually know most of them. If your management isn't buying the
rationale behind not allowing untrusted systems on the network, my
suggestion would be to put them on the spot and ask them to absolve you,
and your team, of any responsibility for that system and resulting
security/regulatory incidents that arise from it being unmanaged.

In writing.

Then place any/all ACL's necessary to prevent domain systems from
connecting to, or being connected to, by that system.

Of course, I'm rather dying of curiosity as to why they feel a simple
file server shouldn't be managed and secured by the IT group. That's
just... odd.

Cheers,

-
Tremaine Lea
Network Security Consultant
Intrepid ACL
"Paranoia for hire"

On Thu, 2008-05-22 at 09:51 -0700, Daniel Sichel wrote:
> My management here wants to put a server on our LAN, not administered
> by us (the IT department) and use a share on it to serve files and
> data to our workstations. They do not understand why having a server
> with a file share that is NOT part of our secure infrastructure
> represents a threat to the computers accessing it. Keep in mind this
> is an all Windows network. Sooo, if you guys can succinctly explain
> why having a trusted computer trust an untrusted computer is a
> problem, that would be helpful. Keep in mind we are talking to
> management here. It’s kind of like trying to explain why, when you are
> in the United States, it’s a bad idea to drive on the left hand side
> of the road. It’s just so basic it’s not documented anywhere. So,
> please help me explain why netbios and file shares on machines not
> within your network are bad ideas.
>
>
>
> Thanks,
>
>
>
> Daniel Sichel, CCNP, MCSE,MCSA,MCTS (Windows 2008)
>
> Network Engineer
>
> Ponderosa Telephone (559) 868-6367
>
>
>
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iQEcBAABAgAGBQJINkQLAAoJEKGa22zRy9WC9fIH/22pNU4CyrDroibZrXCd6NDT
W6mzrmCDF0x/ytw4aIJPxJ4lbPW9ne2Lnu2hD9ZPmbGomemWvzi9dPa5Rn2W2bTa
oXg5ELCaIsRzlRdk+HE+NJ2PCu7e2GrIQruhKWhppnI+G1wOz47GybtIJn+KiUd+
4f5mqMKeYiWPLhhhpuqsPHm/4gy8Rt9y9UzjRh5urahW7a66Lgr62ECDY/do0vBB
u110qXiJ+WrWMx3fyPsReXaPIyRgmDZVvKGzY4GLWJz9yMr5nP/My9tjfszPtZn8
V/gVhnZLbO6xnccKNfpi2sDpbEEWTtxwRaRopnbX+t9pWEKZbHOH6lg4LNZfEZ8=
=En6E
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]