Publié le 29-04-2011 13:04 sur la mailing-list Full Disclosure

Pub : Tous les logiciels antiphishing gratuits disponibles sur Internet

On Fri, Apr 29, 2011 at 3:26 AM, <[email protected]> wrote:
> Recently got a policy from admin to change your PC name with your "name" +
> organisation name.
>

System admins typically aren't responsible for policy creation
depending on the size of the organization. Was the request made due to
an organization policy change, a new guideline, or just "because"?

Was the admin given the appropriate authority to request such a change?

> I am not doing it for a long time as I feel it could be case of
> "information leakage" .
>

While that's a valid point worth considering, orders are orders, which
is why it's important to know under whose authority did the admin
request the change.

> So need any ref./case study/security policy referencing not to have real
> name .
>

For starters, a computer isn't a person. A more appropriate location
to store equipment assignment data is in an asset management/tracking
system. This way there's an audit trail and accountability. The
equipment becomes the users responsibility, so when/if it's
transferred to another user, there's motivation for them to make sure
their asset manager is informed. Otherwise, they risk being charged or
held responsible if the equipment goes "missing."

Also, an environment with roaming profiles or multi-user systems will
make the computer name irrelevant/invalid once another user or users
logs in. There are probably dozens of other reasons that just aren't
worth mentioning. Think most would agree the admin's request is a
terrible idea.

Perhaps you could recommend an alternative naming convention that will
provide more benefit to the organization in the long run.

A couple of examples:

BIT02DWS9966 - Bureau of IT, Building #02, Desktop Workstation,
Property/Asset Tag 9966.
BFS07LWS9211 - Bureau of Financial Service, Building #07, Laptop
(mobile) Workstation, Tag #9211.
PDC01SVWB012 - Primary Data Center #01, Server, Virtual Machine, Web/HTTP, #012
DDC02SPEX022 - Disaster Recovery Data Center #02, Server, Physical,
Exchange #022.

<location>,<3 char type class code>,<asset#/clusterid/whatever>

Can apply this convention to any type of device on the network: SDB
for databases, MFP for multi-function printers, HFW for hardware
firewalls, etc.

To distinguish between dev/test, use a higher number in the suffix,
999, 998, etc. Prod will use 000, 001, 002, etc.

Just an initial thought, others may have better suggestions.. Would
like to know how other organizations address this issue, though.

I personally hate seeing devices on a network with ridiculous names as
though the IT infrastructure is some kind of kiddy cartoon world.
Gonzo, Nemo, Simba, and the like are not appropriate and provide
absolutely no benefit to anyone. If users need to access a resource
using "simba", create a DNS alias/entry...

"Uh-oh, Sponge-Bob is out of ink, can you reprint the report on the
Chim-Chim!!?!on1e??!"

Yea, didn't make that up...

And just to be clear, the proposed naming convention above isn't
something to distribute to end users or folks using the services on a
host.

Have had developers ask me to audit their web applications and provide
a url like, "http://PDC01SVWB996.int.the-domain.org/some-lame-app/MyAwesomeTool.aspx".

No. Create a DNS entry, don't distribute the actual host name... Good luck.

Regards,

Guy
www.nullamatix.com
Key: 0x353DA923

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Votre compte Facebook a-t-il été infiltré ?

24-05-2012 à 12:09 - 0 commentaire(s)

Info zataz - Une vague de faux messages vise des milliers de comptes Français Facebook. Prudence aux photos sexy diffusées.

Fuite de données pour iPhone

22-05-2012 à 00:43 - 0 commentaire(s)

Info zataz - Un iPhone jailbreaké couplé avec Tweak Bulletin permet de passer outre le mot de passe d´ouverture du téléphone.

Téléphone portable ZTE piégé

22-05-2012 à 00:38 - 0 commentaire(s)

Le fabricant chinois de téléphone portable ZTE a confirmé la présence d'une porte dérobée dans l'un de ses smartphones sous Android.

Le Bureau de Justice US piraté

22-05-2012 à 00:31 - 0 commentaire(s)

Info zataz - Des milliers de données sensibles volées par des Anonymous au Bureau of Justice US.

Anonymous contre pédophiles

22-05-2012 à 00:09 - 0 commentaire(s)

Info ZATAZ : Plusieurs dizaines d´informations concernant des pédophiles présumés venant du réseau Darknet diffusées par des Anonymous.

Vulnérabilité sur les site de FHM, ELLE et Forbes

20-05-2012 à 20:38 - 0 commentaire(s)

Info zataz - Des failles découvertes sur les sites des magazines FHM, ELLE et Forbes peuvent mettre en danger les lecteurs internautes.

Anonymous menacent le gouvernement québécois

20-05-2012 à 20:28 - 0 commentaire(s)

Info @zataz - Le gouvernement Québécois veut faire interdire des manifestations étudiantes. Les Anonymous répondent en lançant des attaques informatiques.

Class action de 15 milliards contre Facebook

20-05-2012 à 20:23 - 0 commentaire(s)

Facebook rentre en bourse, des internautes lancent une Class Action de 15 milliards de dollars contre Facebook.