"cquirke (MVP Windows shell/user)" wrote in
That was my point. Sooner or later physical security will be broken, either
by accident or on purpose. You need a layered approach.
Agreed, but the same is perhaps more likely when your entire edge is
complex, fuzzy, and only as good as adherence to policy (which was
what failed in this case)
It's much easier to layer security with a central management system
like active directory.
Security is no substitute for safety. In fact, it applies only when
some risks need to be taken in certain contexts and/or by certain ppl;
then you "secure" access to those risks.
But if no-one needs access to those risks, rather rip 'em out.
With SBS you only need two ports exposed to the Internet. Port 4125
is not opened until after the user authenticates via SSL on port 443. All
communications are encrypted with SSL.
That may serve as a solid pipe between the remote PC and the LAN, but
also exposes the LAN to whatever does on on the remote PC..
The security is as strong as your weakest password.
That's pretty weak, then, because trrying to impliment strong
passwords is a lot harder than "don't plug in the cable, moron".
With active driectory strong passwords, changed regularly,
can be enforced.
See...
http://cquirke.mvps.org/pwdssuck.htm
Strong, changed regularly, non-tokenised. Pick two.
Humans just are not going to remember a new truly strong (random
character, full character set, long) password every month without
tokenizing it somewhere (e.g. writing it down), so your security
becomes as weak as your passwords and/or informal token system.
I like to use a hardware firewall (a real one, not a NAT router) as well.
I haven't really got into that as yet. In there's a firewall built
into the router, as there usually is, I leave it enabled with default
settings; I dunno how useful that is.
You trust what you known, as far as you know you can trust it.
As one who knows networking better than I, I accept you'd trust it
further than I would, and get better results than I would.
I agree that for small business' the expense seems hard to justify. I can
put a decent server in for around $2,500 CDN if they are already using XP
Pro (or Vista Business) on the existing workstations.
Yup, the per-cost per desktop blows out as well due to the need for
Pro or Business, and if you need more than the 5 seats that consumer
desktop OSs can peer, then you need extra CALs too.
That's before you add the cost of hiring the expertise to make it
work, and the value depends on the client following the plan.
So in effect, the client becomes dependent on the hired expert and the
network. If all data is on the server and the network blinks, no-one
can do any work... and if the sysadmin goes rogue (or gets "owned"),
there's very little you can do to get the genie back in the bottle.
Compared to just sharing files on an existing computer it seems
like an expensive option. It also introduces a single point of failure
I think it's an appropriate solution when that point of failure
already exists naturally, e.g. where you have a room full of data
serfs who need access to the same database in order to do anything at
all. You're already forced into some kind of cerntralised system,
whether it be a PICK box and dumb terminals in the 1980s, or a server
and dependent desktop clients in the 2000s.
OTOH, consider a group of architects who work on their own projects
and rarely share data, but who need Internet access, printer sharing,
and hey can't we backup over the LAN as well?
What I do for those cases is XP Home (or Vista Basic) unless "too
many" PCs, then one or two XP Pro (or Vista Business) for the main
points of gathering (printer, basically).
On these, I kill admin shares and create an empty dir that is
read-shared. Nothing else is shared other than printers.
Then I have a batch file archive a small and clean data set (getting
crap like downloads, "My Received Files", massive wads of
pics/music/videos out of there) to the read-shared directory. That's
the 2sm Task; at 4 am, one or more of the PCs will then pull these
backups from the other PCs via the read-only share.
So you can end up with "holographic storage", where as long as as
single PC survives, everyone's work falls back only 1 day.
One place where data is stored so the data is easily backed up.
The name of the game with backup is redundancy, hence the above
peer-based cross-backup system (with "last mile" of all gathered
backups to CDR, DVDR or USB)
Most small business owners love the remote access part of it. The
can remote into their desktop from anywhere and work just as if
they are sitting at the computer. Even on dialup response is adequate.
I'd be concerned about the risks there. One crappy user-defined
pasword between my data and the Internet? I don't think so...
The most common complaint of small business owners is they have to
spend too much time at the business. Remote desktop gives them more
time at home even if they are working while they're there.
I'd rather do that via USB stick sneakernet, which has the advantage
of some built-in data redundancy, at the risk of "syncing" the wrong
way. BTW, my "real" self-backup keeps the last 5 backups for a week's
depth, and does not rely on dates to purge the oldest.
In a very basic configuration (no Exchange, ISA, or SQL) SBS is very stable.
It is managed by wizards that are very easy to use. This actually trips up
many IT pros who are too macho to use the wizards and end up messing up the
security by trying to do things their way.
Sometimes it's just easier. For example, it's easier to find
"Firewall" than "keep my computer safe" or some overly-dumbed-down
langauge that forces you to guess how someone may have over-abstracted
what you are looking for. Even Regedit is sometimes easier than
wading through some app's Tools, Options (or is it Edit, Preferences)
especially for settings the vendor hopes you won't notice.
So yes, I can see how that can happen ;-)
With SBS if you restrict remote access to RWW only, the remote computer
can't infect the LAN. All local access is done by RDP over SSL to one of the
local computers. The remote computer only sees screen updates and sends back
key strokes and mouse clicks. It is possible to enable cut and paste from
remote computers but it is easily disabled as well.
O..K.. I can see how that can help, especially if you believe in
sanity of the code - which I find hard to do these days.
The SBS defaults are well thought out. I usually tweak things a bit but in
it's default state it's very secure.
Can you assert exactly the settings you want?
If installing apps on these PCs, do you have as much control over
installation paths, etc. and can you clean up settings, Start Menu
shortcuts, etc.? Because if you're forced to dumb down to defaults,
you're swapping one bunch of risks foir another.
The only open shares are on the server and without authenticating
you have zero access to them.
And that's as good as your password, right?
I dunno... I see the same suspension of disbelief here.
On the physical model those dudes used successfully for a few years
before they broke their own rules, it was "we don't need to harden PCs
because they aren't exposed to the Internet"
Using pro-grade network admin, it's "oh those risks are OK because
they are secured (by passwords), so we don't mind waving the entire PC
at the Internet". It's a more complex surface with more things to go
wrong, and some failures may leave no footprints.
One could argue that the "physical model" was not properly
implimented. If those PCs were not to be connected to the Internet,
why weren't they set to a fixed and unreachable gateway? If you
cannot trust your staff (as these folks clearly could not) then you'd
have to go to locked cases, disabled USB ports etc. to preclude Wifi
bobbins etc. You may even have to do the "limited user rights" thing
to prevent users fiddling with the network settings, which ideally
wouldn't be TCP/IP based anyway.
Mind you, in this case it was user failure, pure and simple, and would
be a firing offence if the "don't plug in the cable" policy was
properly propagated. The only way to (try to) prevent that is to set
yourself up as the users' overlord, so it's not their network
anymore... and from then on, they'd have to be very, very nice to you.
It's been a good discussion. We're getting way off topic but it has been
fun. I love talking about security
I always learn something. In the end
there are several ways to the same goal of a secure small business network.
Yep, and I quite dig the buzz that SBS seems to attract - most big
networking folks don't mention it, but those who know and use it seem
fiercely loyal to it (I'm sure some names spring to mind <g> )
--------------- ----- ---- --- -- - - -
Who is General Failure and
why is he reading my disk?
