Paradigm Consulting Co. » Policies

Still Think You Want Those Admin Rights Over Your PC? Think Again.

Peter Nikolaidis — Mon, 10 May 2010 13:00:33 +0000

In case you missed a previous post or two on the topic of why end users should not have administrative rights over their PCs, BeyondTrust has released a very compelling report on this issue. But first, let me ask the reader a few questions.

First off, what if I had a very simple security fix, requiring no new software to be purchased or installed, and with minimal configuration changes, that could block 64% of all Microsoft vulnerabilities reported in 2009? Would you be interested? What if I told you we had a fix that could also prevent 94% of Internet Explorer and 100% of Internet Explorer 8 vulnerabilities reported in 2009? How about blocking 100% of Microsoft Office vulnerabilities reported in 2009? Still not enough? How about blocking 90% of critical Windows 7 vulnerabilities reported to date?

As you should have guessed by now, the fix for all of these is the same: removing administrative rights from end users over their PCs.

While there are still some (poorly written) desktop applications which require administrative rights to run, I have found these to be relatively few in number these days, and once the initial configuration has been done, most programs run just fine as an ordinary user. Despite the additional configuration required by some programs, including hardware drivers, that needs to be done by an admin, the cost of setting these up the right way is generally far less than recovering from the damage caused by a serious malware outbreak.

The press release and the complete report are available from BeyondTrust’s website.

Password Quiz

Peter Nikolaidis — Mon, 22 Feb 2010 14:14:13 +0000

This month’s SANS Ouch! (Vol.7 No. 2) newsletter asks the question “What is your Password IQ?”

I’m reprinting the questions (with permission) in this post, and will post the answers in a subsequent post to let you rate your own password knowledge.

What’s your Password IQ?

1. How often should you change your password?
a) Every 30 days
b) Every 60 days
c) Every 90 days
d) When IT tells you to

2. One of your co-workers is working on a critical report this weekend
and needs access to some of your files. How should you give her your
password?
a) Send it in an email message
b) Call her on the phone and tell her the password
c) Don’t give it to her or anybody else
d) Write it on a piece of paper, seal it in an envelope, and mail it to
her

3. What is the most common (and so the weakest) password used in 2009?
a) password
b) 123456
c) qwerty
d) abc123

4. What characters should you use in a password to make it strong?
a) Letters only
b) Numbers only
c) Letters and punctuation
d) All of the above

5. How long should a strong password be?
a) Five characters
b) Eight characters
c) As long as possible
d) Size doesn’t matter

6. Now that you are an expert, choose the strongest password from this list:
a) Mickey.Mouse
b) M1ck3y.m0u53
c) 3.1416**
d) Ad@46-Hiz
e) Aristotle

The full SANS Ouch! newsletter, and others, are available at the SANS website.

ABA Recommends Dedicated PC for Online Banking

Peter Nikolaidis — Fri, 22 Jan 2010 11:36:42 +0000

Earlier this month the American Bankers Association (ABA) has issued practical, simple advice which could dramatically enhance everyone’s online banking security. And, I predict, it won’t make any difference because people are unlikely to do it.

The advice is to have a PC dedicated to online banking. If you weigh the convenience and cost savings of having access to online banking, versus time spent on the phone or traveling to and from a bank to conduct your business, the expense of a PC dedicated to this task, to continue to enable online banking, will likely be recouped within a matter of weeks, if not days.

The three arguments I’ve heard against this are:

We don’t have enough money in the bank for anyone to want to hack it. (Or, “no one is interested in us because we’re too small.“)
Then it sounds like you have everything to lose! Isn’t it more important to protect what assets you have, regardless of size?
We’re protected by our bank’s security.
No, you’re not. Bank websites get hacked frequently. Don’t believe me? Just do a Google search on the subject. Furthermore, the banks are not required to refund your money! You do not have the same protections as you do with credit cards on bank accounts. Finally, it’s not usually the bank that gets hacked – it’s your computer.
We can’t afford the expense.
The cost of a lightweight PC dedicated to this task is most likely lower than most of my clients’ electric bill, heating bill, or liability insurance for one month. You can afford the cost. But can you afford getting hacked and having your assets drained?

This is the same advice we gave on this blog last year. It’s sound. It’s simple. It’s cheap. Get a new netbook for a couple hundred dollars and use that for online banking. Is this not worth the risk of your business losing tens of thousands of dollars from its bank account? Please, if you do online banking at home or at work, at the very least, practice it from a non-Windows computer not running Internet Explorer. Better yet, prove me wrong and get a cheap PC and dedicate it to your online banking needs. Never go to any website other than your bank’s with it. Another alternative would be to boot from a live CD of your favorite Linux distribution, such as my favorite, Ubuntu.

References:

What the Google/China Hack Means to You

Peter Nikolaidis — Sun, 17 Jan 2010 04:56:25 +0000

Friends and listeners to the Fresh Ubuntu Podcast will know that I frequently raise concerns about Google and the information that it acquires about all of us. My concerns normally are along the lines of “just imagine what Google can do with all of that information.” However, I’ve never brought up what could be an even bigger concern: “What if someone else were to get a hold of all of that information?”

Let’s assume, for argument’s sake, that Google does abide by its own code of conduct and isn’t evil. They’re still amassing a staggering amount of data about nearly every Internet user. Now, with more and more companies “Going Google,” Google has access to data that it wouldn’t in the past. Now, they aren’t just indexing your website, blogs, or even chats and emails. Now they’re indexing your corporate documents – you know, the sensitive things you’re “not supposed to send via email?”

While I am quite confident in Google’s security capabilities, no one is perfect. And like my aikido instructor used to say, there’s always someone stronger, or quicker than you. Last week, Google met its security match when their servers were hacked.

While I won’t delve into the economic and political issues which revolve around this hack (see footnotes for plenty of reference links), there are plenty of lessons we can take away from this:

By most accounts, Google’s servers were hacked by good, old-fashioned social engineering:

“Using a sophisticated spear-phishing campaign, the perpetrators included malicious links exploiting the bug in emails and instant messages sent to employees…”

This means that the attackers were not hammering through firewalls or reprogramming routers – they had people click links on what they thought were legitimate emails and exploited security flaws in common desktop software to gain access.
Users accounts which were hacked were most likely running with administrative privileges over their desktop systems.
If Google can be hacked, anyone can. By extension, if your data is with Google, you can be hacked as well.
Trusting Google does not just mean “trusting that Google won’t do anything evil with my data.” It also means “trusting Google will never make a mistake which accidentally opens my data up to anyone else.”
Substitute the word “Google” with any popular online service or enterprise firm that has a lot of (your) data (e.g. Facebook, Salesforce, Amazon). This is not a problem just with Google.

References:

Bank Sued for Losses Due to Alleged Weak Security

Peter Nikolaidis — Tue, 29 Sep 2009 22:41:13 +0000

In a previous post, I wrote how small businesses are being scammed by European cyber-hackers. In a related story, Computerworld reports how Pacto Construction Co. in Portland, ME is suing Ocean Bank of Delaware because the company lost hundreds of thousands of dollars due to allegedly weak security on the part of Ocean’s online banking system.

The main alleged weakness is the lack of two-factor authentication by Ocean Bank. While I am not sure that this places all of the blame in Ocean’s hands, and I think that Patco should be at least partially responsible for their losses if it is found that their own systems were compromised, a victory by the plaintiff in this case could set an interesting precedent to financial institutions who have not implemented strong authentication mechanisms in their online services. Banks and credit unions – take note! However, a victory by the defendant will likely send a very different signal, more to the tune of “If you bank online, you take your chances.” Small businesses and individuals – take note!

This week’s Data Security Podcast also has an excellent interview with the attorney who filed the suit on behalf of Patco.

Further Evidence That Personal Internet Use Should Be Restricted at Work

Peter Nikolaidis — Wed, 23 Sep 2009 11:27:20 +0000

This week’s Data Security Podcast had two items that really piqued my interest. The first was an article about an Ohio hospital which suffered data loss due to a malware infection. The malware was sent by the boyfriend of a hospital worker. Apparently he intended to follow his girlfriend’s movements on the Internet on her home PC. What he did not count on was her opening her email at work, and subsequently infecting a hospital computer. Quoting the PC World article,

“Between March 19 and March 28 the spyware sent more than 1,000 screen captures … via e-mail. They included details of medical procedures, diagnostic notes and other confidential information relating to 62 hospital patients. He was also able to obtain e-mail and financial records of four other hospital employees as well…”

This incident goes a long way to show that the biggest threat can often come from inside. Yes, while the boyfriend was the root cause, had the hospital employee not been allowed to access her personal email from work, her system would not have been infected in the first place.

In a separate news article, Panda Security reports that a hacker site is offering to crack Facebook accounts for the low low price of $100. Setting aside the question of whether the site is a “legitimate” hacking site (who’s to say they won’t just take your $100 and walk away?), I found it interesting that a Facebook account is now worth 3 times the street price of a social security or bank account number, which my sources say are going for $20-35 a piece.

Using Microsoft Outlook to Access Other Users’ Mailboxes

Peter Nikolaidis — Fri, 12 Jun 2009 13:44:10 +0000

If you have a Microsoft Exchange server at your business, Microsoft Outlook has the ability to access more than one mailbox at a time. This is a useful feature if multiple users need to share access to the same email address, or if someone needs to cover another person’s email (when an auto-responder won’t suffice) while on vacation.

By default, you cannot access anyone’s mailbox except your own. Your system administrator or the owner of the mailbox must grant this right, and before that, you should verify that accessing another user’s mailbox is within your company policies and you have proper permission to do so. It’s also nice to let the user who owns the mailbox that you will be accessing it in advance.

Note that, especially in small businesses, this is usually done by the one person logging in as the other user. This is always a bad idea, as you lose all accountability. In other words, if Bob logs on as Sue and does something wrong, it looks like Sue did it, and she can’t prove otherwise. Passwords should not be shared. If you think you need another user’s password, then you do not have the appropriate permissions to do your job. Again, see your supervisor and system administrator if you believe this is the case.

Once you have been granted access to the other user’s mailbox, you can access it in two ways. If you will only be doing so occasionally, and generally only require access to a single folder (e.g., the Inbox) then this method is simpler.

Logged in with your own account, open Microsoft Outlook. Click File | Open | Other User’s Folder…

Enter the name of the user, e.g., “Joe Smith” or “Orders,” (whatever the name or email address of the user) whose folder you want to open. Note that you can click the “Folder type” menu if you want to open something else, like the user’s Calendar or Contacts.

Once the name is in place, simply click “OK”. You are now looking at the other user’s Inbox!

If you will be frequently referring to the other user’s Inbox (or other folders), then it makes sense to add their mailbox to your Outlook configuration so that it opens every time. If you use the navigation bar, their mailbox will show up there every time you open Outlook, and you can simply click on the folders you want to browse.

To do this, you again need to get proper permission and authorization from your system administrator and management.

Once this is done, logged in with your own account, open Microsoft Outlook.

If you are using Outlook 2007, click Click “Tools” | “Account Settings…” then click on your Microsoft Exchange account, and click “Change…”

If you are using Outlook 2003, click “Tools” | “Email Accounts…”, make sure that “View or change existing e-mail accounts” is selected, then click Next.

Click “More Settings…”

Click “Advanced”

Under “Mailboxes,” click the “Add…” button. Enter the name of the user whose mailbox you wish to access, then click “OK.” Click “OK” again, then “Next,” then “Finish.”

The other users folders will now appear in the navigation pane on the left side of Outlook, and you can refer back and forth between their mailbox and yours any time.