Section 7.9 Desktop Policy
7.9 Desktop Policy
By desktop we mean any system on a user's desktop that is used directly, such as Windows and Macs. A few will have Linux or UNIX. It is assumed they are connected to the LAN (local area network) and the users are not expert SysAdmins and do not know much about security. Most of what users "know" about security they learned from sensational articles in trade magazines and reassurances from vendors. They certainly do not have the time or interest to secure their systems. Therefore, it is the most important policy that any unsecured desktop system be treated as just that, unsecured. There is some good virus detection software available that could help with this problem. I think that it is fair to say that some desktop systems will become infected with viruses or Trojan horses and that the design of the company's network and important software should take this into consideration. It would be unusual for a virus or Trojan to be so sophisticated and targeted that, after it took control of a PC, it would capture, say, the password to a company's client/server-based order entry system and generate bogus orders. Still, for high-security (important) applications, these systems should not have access to the Internet, nor should they have floppy or CD-ROM drives that a user could use to unknowingly load rogue software purporting to be, perhaps, a screen saver. Certainly, no software should be allowed that causes execution of arbitrary code that is received from the Internet unsolicited. This rule is violated by Microsoft's Office Suite, with disastrous results. This well-known security bug in the Suite allowed the ILOVEYOU worm to cause an estimated $15 billion in damages around the world in a few days in May of 2000, according to Lloyd's of London. (Some people question this estimate.) The damage would have been much worse had companies not learned a little from the Melissa worm a year before. By "learned a little," it is meant that many companies set up sophisticated firewalls that could guard against known threats and have put plans in place for fast response to similar problems in the future. Most did not learn enough to not allow execution of arbitrary unsolicited code.
It is important to note that although the vast majority of Linux boxes do not suffer from this problem, it is due to common configuration and not to any inherent invincibility. It is possible to configure Linux boxes to execute arbitrary unsolicited code from the Internet or from a company's LAN. It is critical to check for this possibility. There are two principal places where this capability can be configured:
|
| Top |
EAN: N/A
Pages: 260