Dealing with Network Politics and Insecure Users?

Rob asks: "I work at a large university as an IT support person for one of the college's Novell networks, and I frequently find that my hands are tied on security issues--highly paid, highly respected professors do not like to see the words 'Access Denied', not even on their secretaries' screens. They routinely share their passwords, leave their machines unlocked, and go weeks on end without rebooting. They demand Administrator access on their local machines. They demand Internet Explorer have minimal security (but it's our fault when they get a piece of spyware). So, Slashdot community, I ask you this: how do you limit a user's access without making it look like you're limiting their access?"

Comments

Dupe them

[Bin_jammin]

Tell them they're getting a mandatory system upgrade, then put them in Kiosk mode, give them access to email, whatever office apps they have, and whatever other critical functions they need. If they ask for more, tell them it's been obsoleted. After all, they've got tenure, they're smart, right?

Re:Dupe them

[UberGeeb]

Bah. Charge the department for services rendered when you have to fix things due to the professor willfully ignoring the stated rules.

Re:Dupe them

[funkman]

Exactly. Lay down some groundrules. If getting spyware or launching a worm on campus, or taking the time to debug the non-standard machine needs done - then charge the department back. Then the department head has a battle to fight with respect to budget.

Benificent Totalitarianism

[ssclift]

Face it, totalitarianism lives and thrives among system admins for a really good reason. Your only solution, I think, is to play the dictator and do it with a happy-friendly smile. Recycle some old Communist propaganda posters to get people in the right spirit.

And... as I tell my colleagues when they have Window's problems: hey, you have a Ph.D. in computers, you fix it.

Re:Benificent Totalitarianism

[Anonymous Coward]

Find some small group to blame that matches their paranoia. (If they don't have any paranoia, start some. Check their email for likely targets.) Explain that the selfish actions of this group threatens them all, and that a few temporary security restrictions will needed to combat this threat to [the fatherland/the university/their tenure]. (The temporary is important, but don't get tied down to any specific dates.) Try to recruit them to watch each other for slackers, saboteurs, and agents for [other department]. Study the works of others for more ideas.

Re:Benificent Totalitarianism

[Anonymous Coward]

step 1: Find some small group to blame that matches their paranoia. step 2: Explain that the selfish actions of this group threatens them all, and that a few temporary security restrictions will needed to combat this threat to [the fatherland/the university/their tenure]. (The temporary is important, but don't get tied down to any specific dates.) Try to recruit them to watch each other for slackers, saboteurs, and agents for [other department]. step 3: ??? step 4: Profit!!!

Re:Benificent Totalitarianism

[rbochan]

And... as I tell my colleagues when they have Window's problems: hey, you have a Ph.D. in computers, you fix it.

from the mod-fortune files...
"OK, so you're a Ph.D. Just don't touch anything."

Re:Dear Slashdot,

[frankm_slashdot]

I've managed to maintain good karma thus far but i think id like to reply to this anyway and risk the down modding..

Dear CluelessAdmin,
If you would like to ask questions to the slashdot readership, please utilize the "Submit Story" link on the left hand side of your page.

It is disrespectful to ask unrelated questions in other peoples threads.

Thank you,
- Frank J. Mattia

Here

[KDan]

is the ultimate guide.

Enjoy!

Daniel

It's a vicious cycle...

[jbarr]

"...highly paid, highly respected professors do not like to see the words 'Access Denied', not even on their secretaries' screens.."

...that someone has to break. Depending on the political environment, IT may or may not have the authority to impose such restrictions. If IT does not, then it would be prudent of IT to inform those who do have the authority of the risks, consequences, and measures that can be taken to ensure a secure computing environment. When a virus or a rogue program infiltrates the mailboxes or directories of these "highly paid, highly respected professors" and destroys their work, or better yet, if their work is stolen and ends up in the public domain without their credit or consent, then they'll be the ones asking why IT isn't doing their job.

Re:It's a vicious cycle...

[Anonymous Coward]

Ummm - Didn't you just restate the problem without offering a solution?

"...if their work is stolen and ends up in the public domain without their credit or consent, then they'll be the ones asking why IT isn't doing their job."

Correct, that's why he's asking for help - So he doesn't get fired when they come asking why he isn't doing his job... Your advice is that it's a vicious cycle?

Re:It's a vicious cycle...

[saintp]

That's a good call. I also work in IT at a university, and the department was kind of toothless until our network got hosed for a week last year after a *major* infection of two viruses simultaneously. Since then, we haven't had many complaints about things being locked down.

Nonetheless, you'll still run into professors who are just plain averse to change. We give shell access to one of our academic servers, and earlier this year, I shut down telnet access in favor of ssh. A small change, but with more people using wireless, I thought it wise. Even though, for most people, the change amounted to choosing a different protocol from a drop-down menu, several fought it as hard as they could. Direct quote: "Well, my username has never been hacked. I don't see why you need to do this." The notion of being "proactive" on security completely escapes some people.

Q: How many professors does it take to change a lightbulb?
A: CHANGE?!?!?!?

So, in summary, as another user said, lock 'em down and don't take any flak. If they share their password, change it for them. (They should thank you for your diligent service.) If they insist on running IE with no security, put Firefox on everything as a "security initiative." (Better yet, MOSAIC.) If they don't like being denied access to certain resources, tell them that you'll give them access to it -- in return for the right to publish their home directory or "My Documents" folder on the web. After all, other people are denied access as well!

Remeber: Fearmongering isn't just for the media and the government anymore. When George Tenet makes wacko comments about limiting access to the Internet because the terrorists will come in through your fiber, turn that into a campus-wide announcement. Forward every "new virus" announcement you get to all the professors. Once their quaking in their Birkenstocks, they'll be much happier to hand some control over to you.

Disclaimer: I'm only half serious about most of this.

Re:It's a vicious cycle...

[QuantumRiff]

Go over their head. go to the damn president if thats what it takes. A good way to get changes made is say (after an outbreak), well, your computer cuased our IT staff to put in 20 hours of overtime. Which one of your budget accounts should we bill that to?

My IT department has a rather drastic statement in our AUP. Since we purchase, fix, and maintain all the PC's on our campus, our rule is, We control it totally, or it doesn't go on the network. If they want to run as admin, or don't want to bother with antivirus, or just want to buy Gateway PC's (eww!) they aren't allowed on the network. We have a class that uses a Cable modem to play on the internet. I'd offer those "important profs" all the access they want, but bill their department for a 64k ISDN connection. Keep it off your network. Nothing sucks worse than some idiot getting a nasty worm and affecting hundreds of students who are (GASP!) trying to learn.. We bought and run the network, and if they don't like it, they can run their own..

Re:It's a vicious cycle...

[jbarr]

Ummm - Didn't you just restate the problem without offering a solution?

"...if their work is stolen and ends up in the public domain without their credit or consent, then they'll be the ones asking why IT isn't doing their job."

Correct, that's why he's asking for help - So he doesn't get fired when they come asking why he isn't doing his job... Your advice is that it's a vicious cycle?

My "advice" was more of a comment than advice. That said, the fact remains that many organizations have very sketchy authority structures and it sounds to me that in Rob's case, IT security policy authority needs to be defined. What Rob describes is a situation of very demanding colleagues. The professors, though highly paid and highly regarded are hired to teach, not dictate IT security issues. That's what IT people are paid to do. But this is the real world, and thus his question.

Probably the most important thing Rob needs to do is to determine once and for all who has final authority on IT security issues and then take action based on that authority. And get that in writing if possible. If it is determined that IT has final authority, then it is up to IT to enforce these issues, regardless of what a high-paid professor says. Unfortunatly, Ron only mentions a Novell network, but does not describe the clients. Are they Windows? Linux? etc. Many of the specific issues Rob describes can easily be managed by implementing very common security policies.

The difficulty comes when IT simply does not have the final authority in these matters. My guess is that the professors technically do not have the final authority to determine security policies--they just appear to have authority by being vocal in their positions. If IT does not have final authority on IT security issues, then it it up to IT to present a convincing case to those with the authority to try to get proper security policies in place and enforced.

I think we can all agree that the professors should not be the ones calling the IT security shots, but again, if they technically do, then it is up to Rob to take all the necessary proactive IT security measures and document everything he does. He needs to cover his butt.

Re:It's a vicious cycle...

[flonker]

When they share their passwords, change it for them, and tell them that an automated system detected that their account had been compromised, and "here is your new password". It's much easier to blame things on an automated system, even if you wrote it.

Trust the computer. The computer is always right. The computer is your friend. The Computer says so.

Re:It's a vicious cycle...

[Anonymous Coward]

Direct quote: "Well, my username has never been hacked. I don't see why you need to do this."

I hope your response was "So you're saying that because it's never been hacked (that you know of), that it never *will* be hacked?"

Re:It's a vicious cycle...

[nine-times]

Depending on the political environment, IT may or may not have the authority to impose such restrictions. If IT does not, then it would be prudent of IT to inform those who do have the authority of the risks, consequences, and measures that can be taken to ensure a secure computing environment.

This is really important. The big issue here is, power and responsibility cannot be separated. If IT has the power to impose restrictions, then impose them. You can try to put a friendly face on it and everything, but ultimately, if it's your prerogative, then it's your prerogative. There will always be some random computer-illiterate egomaniac that feels slighted no matter what you do.

If, however, you do not have the power to enforce rules and make changes, then be very clear with whoever does have that power: If you don't impose the security recommendations made by the IT staff, the IT staff cannot be held responsible for the security holes present on the network. Put it in writing and keep a copy: "These are my recommendations..... If you don't follow these recommendations, here are some possible consequences..... What's your decision?" Try to get the response in writing and keep a copy of that.

I mean, ultimately, if it's not your responsibility and you have no power to do anything about it, then you can only raise the issue with the person who has power. If they're telling you it is your responsibility but that you have no power, then that's your real problem, not security issues.

That being said, if you just want to put a happy face on the process, bundle your access restrictions with upgrades and fixes.

If their computer is running slow from spyware, then while you're removing it and patching their system, lock down their access. Pretend you've installed something that, as a side effect, restricts their access, but it's really a "security fix" that will prevent spyware in the future. It's true enough-- you've fixed the security scheme in such a way as to prevent further access. Pretend it's completely out of your hands-- Microsoft did it. The computer is stupid. People who don't know anything about computers love it when the computer guy says the computer is stupid.

If you can, install a bunch of improvements and software updates that the user will find noticeable-- like I've done it while installing a PDF writer, for example. Hope that this will associate in their minds the idea of these "security improvements" with improved functionality.

Finally, and this is important, get out of their office quickly and answering as few questions as possible. Avoid contact for a little while and hope they just get over being annoyed and grow accustomed to their new access level.

Oh, and keep drilling it into their heads that the reason those sites that require low security in IE are *broken*. I don't care if the sites say IE isn't set up properly, it's because the page is *broken*. The people who made that site are *stupid*. Or they're *hackers*. Just keep saying it.

Re:It's a vicious cycle...

[Robert The Coward]

Under this string sometime management doesn't listen. I recently had an issue that resulted in a network outage of almost 3 Days. Not six months ago I said that having a signal T1 convering the mail servers and web servers was an issue that could cost the company alot. It did there was a fiber cut that took almost 3 Days to fix. We the presendent of company was yell about the outage it was said it is to bad we don't have the backup T1 like we requested 3 Months ago if we had that then would could have just moved all the trafic thought that. Guess what new T1 goes live in January as well as 3 Other thing on the list of recommended changes that were said to cost too much until they found out the cost for not making the changes.

I agree things need to be documented if he is in a enviroment were people get fired for telling prof no then just document the issues and possible problems then we a breakout happens as you known it will fix the problem as fast as you can and then make sure that you do a memo outline the cause of the problem. Make sure you include cost for clean up and something like and as outlined in memo on 1/1/00 these changes will prevent it from happen in the future.

That shows that you did you best and how you sugest fixing the problem. Also make sure that the prof that cause the problem because he would follow the rules has to at least loss access to there system for a few days as you have to rebuild the system to fix the problem. I would make sure that you move all his files somewhere else on the drive so that he has to ask were to find them and makes him relize just how close he came to lossing his important data.

Re:It's a vicious cycle...

[Pxtl]

How about this: Setup the system in a properly gestapotronic secure mode. Then, start making forms. Paper ones. If a prof requests somethign stupid, fax him the form to fill out and sign. The form includes a complete description of the risks, giving you, the IT guy, a big filing cabinet full of deniability.

Tell them that they're getting special IT administrator priviledges and so they have to sign as "admin-users".

Re:It's a vicious cycle...

[Spoing]

1. Trust the computer. The computer is always right. The computer is your friend. The Computer says so.

Along those lines, people that argue with you will not argue with a sign...they will obey it almost always. So it is written, so it will be done. Simple conditioning.

Re:It's a vicious cycle...

[Spoing]

1. Which one of your budget accounts should we bill that to?

Exactly. You may not get the money, but insist on it and take collecting seriously -- though not so rabbidly as to get the overtime issue slapped down. That could harm other legitimate requests. Hopefully, you'll only have to go through that once ... with small reminders later.

Re:It's a vicious cycle...

[Spoing]

1. If their computer is running slow from spyware, then while you're removing it and patching their system, lock down their access. Pretend you've installed something that, as a side effect, restricts their access, but it's really a "security fix" that will prevent spyware in the future. It's true enough-- you've fixed the security scheme in such a way as to prevent further access. Pretend it's completely out of your hands-- Microsoft did it. The computer is stupid. People who don't know anything about computers love it when the computer guy says the computer is stupid.

*SNIFF* My. Long. Lost. Brother! I have found thee! *SNIFF*

Re:It's a vicious cycle...

[Anonymous Coward]

Under this string sometime management doesn't listen.

"Under this string?" What does that mean?
"sometimes".

3 Days

"days".

cost the company alot.

"a lot".

It did there was

"It did. There was" or "It did; there was".

We the presendent of company was yell about the outage it was said it is to bad we don't have the backup T1 like we requested 3 Months ago if we had that then would could have just moved all the trafic thought that.

"Well, the president", "was yelling", "outage. I said", "too bad", "3 months", "ago. If", "traffic to" or "traffic through".

I agree things need to be documented if he is in a enviroment were people get fired for telling prof no then just document the issues and possible problems then we a breakout happens as you known it will fix the problem as fast as you can and then make sure that you do a memo outline the cause of the problem.

Holy shit. I give up. Were you drunk or high when you posted this?

Re:It's a vicious cycle...

[AsbestosRush]

+1 Paranoia reference

Re:It's a vicious cycle...

[AsbestosRush]

I'd have to disagree with the sign thing. How many people test the "wet paint" sign?

Re:It's a vicious cycle...

[Spoing]

If you tell the same people 'the walls here have just been painted', how may will touch it? Signs are more authoritative. Kind of like emails or memos in an office; you've been put on notice.

Besides, the only negitive to touching paint is that your fingers get sticky for a few moments, though the color washes soon enough. "Please take a ticket" seems to be more effective; you don't take a ticket, and someone else may 'get ahead' of you. Even if the room is mostly empty.

Additonally; if someone ignores a sign, and another person notices, there is an expectation that there is something either wrong or 'naughty' (as in slyly bad) going on. If the sign weren't up,

Re:Dear Slashdot,

[WhatAmIDoingHere]

Unrelated?

Every single ask /. is "Tell me how to do my job, /.!"

And this one is no different.

He's asking us to do his job for him for free, while he gets paid for it.

And, hey, what happened to google? Did they close down already?

There needs to be an ask /. rule that says "If you can find an answer on google in under 5 minutes, you cannot submit this story"

Learn to say "no"

[fmaxwell]

I ask you this: how do you limit a user's access without making it look like you're limiting their access?

You don't. You limit their access and tell them that they have to live with it. Explain to them that security is inconvenient and that they have to be adults and accept it. It's your job to secure the network and it's their job to teach the students, so make a deal with them: You won't tell them how to teach their courses and they don't tell you how to run the network.

Re:Learn to say "no"

[josecanuc]

That's all fine and dandy until you're unemployed because someone with a lot of clout tells your boss that you're being "uncooperative".

If you have to go up against those kinds of people, you'd better have a comprehensive written security policy with the full backing of the entire IT department (and if that's just the one person, then the IT "person"'s boss as well), as well as the higher administration.

Re:Learn to say "no"

[override11]

I run into this with a sister company here. You need to engineer a situation that illustrates how the current low security causes your company to loose money, in front of the professors as well as your management, and then offer a solution of increasing security. When you get your management on board with increasing security, it will work. What rankles the professors is that someone lower on the totem pole is dictating to them what they can and cant do (its an ego thing). Take it to the next level, and they wont complain. :)

Re:Learn to say "no"

[fmaxwell]

That's all fine and dandy until you're unemployed because someone with a lot of clout tells your boss that you're being "uncooperative".

If you have that little respect from your boss, then your job was not very secure to begin with.

If you have to go up against those kinds of people, you'd better have a comprehensive written security policy with the full backing of the entire IT department (and if that's just the one person, then the IT "person"'s boss as well), as well as the higher administration.

Absolutely. I was making the assumption that anyone responsible for network security would have a complete written policy, with rationale to explain the reasons behind each aspect of the policy. Again, if your boss and his superiors don't respect you enough to back you, then you should already be looking for work already.

Re:Learn to say "no"

[bluGill]

In a typical business you are correct. However this is a university where the professors are boss. If the CEO of a big company gets mad at you personally, then your job is on the line no matter how much your boss likes you. At best your boss will suggest you send out resumes, and take any offers.

Professors have a lot of power in a university. If they really hate your IT department, they will hire their own IT guys to run things how they want it. Doesn't matter if how they want it is wrong, they directly bring a lot of money into the university so they word goes.

Re:Learn to say "no"

[Intrigued]

The other option is to go legal on them. Put in place an open waiver system. If they don't want to cooperate with the limitations, let them sign away any complaints that they have rights to make. When their system fails and they complain, pull out the waivers and explain why they shouldn't bypass security procedures but you would be happy to assist them in recovering whatever you can.

Make sure that they sign a separate waiver for each issue. It keeps the issue present in their minds, removes deniability and a pile of documentation helps you keep your job.

Many large companies have a waiver system for that very reason.

Re:Learn to say "no"

[tanguyr]

I don't think this is any different in the corporate world - explaining to a senior manager that he doesn't have access to that system isn't any easier. The key is in how you communicate it. Telling people that that's the way it is and "they have to live with it" is basically rude, and rudeness begets rudeness. The difference is, unlike the intern down the hall or the members of the freshman class, the senior manager / important tenured professor really doesn't have to take any stick from some gnome in IT services. I think the key is to explain to them why you are imposing these restrictions (try to accentuate the good you are doing for them without being patronizing. Don't use the phrase "i could explain but your head would explode". Surprisingly few people outside IT find that very funny.)

It is inevitable that you will occasionally run into people who will not listen to reason, and who are highly enough placed that they don't have to. That's fine, stay calm, just make sure that you get any deviation from the security baseline in writing so you are covered in case something goes wrong (at this point you want to avoid the phrase "i told you so").

Re:Learn to say "no"

[bluGill]

Well yes, but in the corporate world most people are not that high, for them what IT says goes unless things are really really bad. In the university world you have a larger number of people with senior management clout. Worse, in the corporate world there is likely a CIO who is about as high as the others who should (but often won't) back you up, while in the university world the CIO doesn't have as much political power.

Re:Learn to say "no"

[tanguyr]

i'm not sure i agree. i've never worked for a university so feel free to dismiss this as the musings of an idle mind, but it seems to me that once you factor in students the depth of the heirarchy at the average university and average corporation would probably fall into roughly equal ranges. After all, the bofh didn't have to change his tactics that much when he got a "real" job ;)

Anyhow - even if there are more people who can tell you to go piss up a rope when you come by with your anti-virus ("but it makes my machine so slow!"), you should just look at that as an incentive to hone your communications skills, since "I AM THE LAW" doesn't cut it in those cases. Most people are (mostly) rational - even those who don't understand computers with the fluency of the average basement dwelling IT staffer. They don't want viruses or spy ware on their computer, they don't want some kid going through their email or using their credit card to order pornography on the net. It's your job to stop these things happening to them, but you need their help to do that. Some people might not be that rational - they turn everything into a pissing match and figure that they actually make more points by demonstrating that the rules don't apply to them. Don't worry too much - but do make sure to get it in writing. If something happens these same people might well go after you since your "incompetence" caused them all these problems, but hopefully you have enough of a reputation for friendly service by now that the rest of the reasonable people will see your side of the story. On the other hand if you spent your time acting like a two bit tyrant nobody will step up for you when (and that's a "when") something does get through and questions get asked.

(Long winded) moral of this story: you catch more flies with honey than you do with vinegar.

Re:Learn to say "no"

[buysse]

What rankles the professors is that someone lower on the totem pole is dictating to them what they can and cant do (its an ego thing). Take it to the next level, and they wont complain.

Incorrect.

As far as I can tell, a significant portion of academia believes that nobody may dictate what they can and cannot do. This group considers it a critical part of academic freedom, and in many cases rely on the insecurity for the way they work. I've heard of faculty threatening to unionize for less.

The problem runs much deeper than a simple "Get their boss to tell them." It doesn't matter if the president of the University decrees it; there are many professors that just won't care, and won't see the problem. I've had to argue with people about whether they should have a password at all, much less a strong one.

"If someone wants to see my work, I welcome them, and nobody would have any reason to destroy my work." Even if the account is compromised, many won't care because that doesn't affect their work -- it may cause some minor disruption, but nothing compared to changing the way they work. To make the system secure, you have to prevent Dr. Alice giving her password to Grad Student Bob so that they can share files. They have to change the way that they've worked for the past 15 years, and in general, that's not going to happen.

Even something as simple as removing administrator-level access to the desktop is almost impossible. Often, there are even valid reasons, like strange software that doesn't run without it but that is actually essential to their research, or the need to install and run extremely esoteric software that's not in general use. This isn't the corporate world where >90% of users are fine with {Outlook|Notes|etc.} and MS Office, and maybe a couple of custom apps that are widely deployed to a group of people. Each researcher often has unique requirements.

Even focusing on the almighty {Dollar|Euro} probably won't help, because at least in the US, NSF and NIH regulations prohibit charging a grant with some of the basic costs, like telephones and network connectivity. If the support staff were charging for service, the funding streams *could not* pay it, under federal law. The last time I really looked at this was years ago, so it may be more relaxed now, but I doubt it.

If anything, academia has more inertia than government.

Re:Learn to say "no"

[Glonoinha]

To expand on this, stop calling user access levels 'rights' or 'privileges' - call them 'responsibilities'.

'Admin rights' sounds cool.
'Admin privileges' sounds like something I am entitled to because I am powerful.
'Admin responsibilities' - screw that, that's what we pay IT to do.

Additionally, when they hose their box, you can look at them and say 'hey - you specifically requested the responsibility to admin that box, so go admin it.'

You can get folks to give up their admin access as soon as it sounds like work.

Re:Learn to say "no"

[Daniel Ellard]

... so make a deal with them: You won't tell them how to teach their courses and they don't tell you how to run the network.

And their counter-offer will be: you won't work there any more, and they won't tell you how to run the network at your new place of employment.

Professors with tenure are worse than any PHB you can imagine.

Re:Learn to say "no"

[fmaxwell]

As far as I can tell, a significant portion of academia believes that nobody may dictate what they can and cannot do.

Then won't they be surprised when they find that they no longer have administrator access?

This group considers it a critical part of academic freedom, and in many cases rely on the insecurity for the way they work.

Then they may have to change the way that they work.

It doesn't matter if the president of the University decrees it; there are many professors that just won't care, and won't see the problem.

So what? I may not see a problem with my having access to Percocet, but it doesn't mean that the pharmacist is going to give it to me without a prescription. It's the system administrator's job to see that the network is secure, regardless of whether the professors understand, or care about, the need for network security.

Even something as simple as removing administrator-level access to the desktop is almost impossible.

No, it's not. You log in, change the permissions and/or passwords and it's gone.

Often, there are even valid reasons, like strange software that doesn't run without it but that is actually essential to their research, or the need to install and run extremely esoteric software that's not in general use. This isn't the corporate world where >90% of users are fine with {Outlook|Notes|etc.} and MS Office, and maybe a couple of custom apps that are widely deployed to a group of people. Each researcher often has unique requirements.

I'm in the corporate world and there are plenty of vertical market apps that you've never even heard of. We just purchased one license for a specialized modeling and simulation package and it's costing us about $40,000 for two years. The number of sites running that software can be counted on one hand. So let's lose the attitude about how special academia is.

If a package that they use requires administrator privileges, put the system running it behind a firewall. Block all traffic other than that specifically needed to run the package. If it's a standalone package, then take the system off of the net completely. Enforce the policies at the MAC level.

The bottom line is that there are prima donnas in industry, government, and academia -- and you can't just throw security out the window every time that one of them finds it inconvenient. If they have a specialized app that truly requires administrator access, wall-off that system(s) on which it runs so that it(they) can't harm the rest of the network. You don't put the rest of the network at risk just because some professor finds security to be a hassle. What's next? Allowing unvaccinated kids to attend school because their parents find that taking the kids to the doctors is annoying?

Re:Learn to say "no"

[Anonymous Coward]

Another difference is that the bosses in academia are often professors -- they end up going to administration for a couple of years, serving their time, and going back to their research. Taking away anything from a researcher who raises hell won't happen. Try telling the CFO that he can't use a Blackberry, especially if the CIO's his golf buddy.

Re:Learn to say "no"

[fmaxwell]

Another difference is that the bosses in academia are often professors -- they end up going to administration for a couple of years, serving their time, and going back to their research. Taking away anything from a researcher who raises hell won't happen.

Then leave if you are in charge of network security. You will be the scapegoat when some prima donna professor's unsecured PC gets infected with a virus that blasts the Internet and the rest of the campus with virus-infected e-mail.

Try telling the CFO that he can't use a Blackberry, especially if the CIO's his golf buddy.

Our security team here s perfectly happy to confiscate the Blackberry, cell phone, digital camera, or Blue Tooth headset of anyone who tries to enter a secure area -- whether they are the President, CEO, CFO, or head of IT.

Re:Learn to say "no"

[Anonymous Coward]

Our security team here s perfectly happy to confiscate the Blackberry, cell phone, digital camera, or Blue Tooth headset of anyone who tries to enter a secure area -- whether they are the President, CEO, CFO, or head of IT.

That's *not* what he's saying - nobody said anything about secure areas, this is about regular baseline security measures.

Then leave if you are in charge of network security. You will be the scapegoat when some prima donna professor's unsecured PC gets infected with a virus that blasts the Internet and the rest of the campus with virus-infected e-mail.

Or maybe just keep a copy of any mails/memos you may have sent to the professor warning him of the possible consequences of not abiding by the security policy, and his replies, copies to management, etc. etc.. Chances are the professor will be too ashamed to make much of a stink about the whole thing since he's the one who will wind up looking stupid, and if he does... go see the administration with a copy and ask them to look up "wrongful termination" in the dictionary.

This is all part and parcel of being a professional. Calling someone a prima donna when the extent of your own advice seems to be screaming "I can not work this way! I'll be in my trailer!" is somewhat ironic.

Re:Learn to say "no"

[fmaxwell]

Or maybe just keep a copy of any mails/memos you may have sent to the professor warning him of the possible consequences of not abiding by the security policy, and his replies, copies to management, etc. etc.. Chances are the professor will be too ashamed to make much of a stink about the whole thing since he's the one who will wind up looking stupid, and if he does... go see the administration with a copy and ask them to look up "wrongful termination" in the dictionary.

It's not the professor with the unsecured PC who makes the stink. It's the students who found that their personal information was being e-mailed by a virus on the professor's unsecured PC. It's professor Y who received an e-mailed virus from professor X's unsecured PC. It's the ISP whose mail server got blasted by the unsecured PC. It's some random user on the Internet who got spam from some professor's zombie machine.

Calling someone a prima donna when the extent of your own advice seems to be screaming "I can not work this way! I'll be in my trailer!" is somewhat ironic.

I gave two pieces of advice:

1. "You limit their access and tell them that they have to live with it. Explain to them that security is inconvenient and that they have to be adults and accept it."

2. If you are being held responsible for securing a network but are not allowed to do so, then leave.

I don't believe in sitting around, wringing my hands, and saying "woe is me." If I am in charge of securing a network and people won't let me do my job, then I'm not going to spend my days waiting for failures and gathering evidence. If the all-powerful professors can stop you from taking away their administrator rights, then they can surely whip your butt in a political in-fight when it comes time to assign blame for a network security failure.

Re:Learn to say "no"

[Anonymous Coward]

It's not the professor with the unsecured PC who makes the stink. It's the students who found that their personal information...[snip]

The trail will lead to the PC of professor X. You have evidence that professor X didn't let you secure his pc - didn't let you do your job. He might be in trouble - or not, depending on his position, etc.. You certainly aren't.

If I am in charge of securing a network and people won't let me do my job, then I'm not going to spend my days waiting for failures and gathering evidence.

I'm sorry, but you are being naive. It is a fact of life that there will always be someone who doesn't have to follow the rules - even the all-important security rules. George Bush can carry a pen knife on a plane if he wants to and there's not much anybody can do about it - but I don't think that's why the head of homeland security resigned. Professionalism is about flexibility. Tantrums are for children.

Re:Learn to say "no"

[fmaxwell]

The trail will lead to the PC of professor X. You have evidence that professor X didn't let you secure his pc - didn't let you do your job. He might be in trouble - or not, depending on his position, etc.. You certainly aren't.

If you are known as the guy in charge of network security, you will be blamed for lapses in security. You may be able to convince your boss that it wasn't your fault, but everyone else will blame you for it.

I'm sorry, but you are being naive.

Bulls***. I'm in my mid-40s and have been a computer professional all of my working life. I may be jaundiced, but I am not naive.

It is a fact of life that there will always be someone who doesn't have to follow the rules - even the all-important security rules.

No, that is not a fact of life. I have worked at multiple firms where the computer security rules apply to everyone. The people with administrator access to the networked computers are the people in the IT department. Managers don't have admin rights. Developers don't have admin rights. Secretarys don't have admin rights. I did work for one company where a developer was fired (Not warned. Not chastised. Fired.) for tunneling through the firewall to access his personal system -- and not for nefarious purposes.

Professionalism is about flexibility. Tantrums are for children.

You're the one who seems to believe that it's appropriate for professors to throw tantrums when they are told that they can't have admin rights to networked computers. I don't. If the administration gives-in when professors throw childish tantrums, then the professional thing to do is to find a job where they take security seriously and can succeed in your role.

Re:Learn to say "no"

[Anonymous Coward]

I'm in my mid-40s and have been a computer professional all of my working life. I may be jaundiced, but I am not naive.


And in all that time, can you honestly say that you've _never_had a root password that you "shouldn't have"?

Re:Learn to say "no"

[fmaxwell]

And in all that time, can you honestly say that you've _never_had a root password that you "shouldn't have"?

Completely honest answer: I never got a "root" password except when someone in the IT/IS department voluntarily gave it to me. They gave it to me because they knew that I had the technical savvy and expertise to not be a security threat to their network. Whether they had the authority to give it to me, I cannot say.

But I can say that I never got it by demanding to management that I have it. I never got it by telling people how important I was or how important my work was. Exceptions weren't made for me because I played golf with the right people.

It's one thing for the IT folks to say 'this guy knows his stuff and can be trusted' and someone telling the IT staff that 'Person X is very important and you must give him root access to his PC.'

Re:Learn to say "no"

[Anonymous Coward]

It's one thing for the IT folks to say 'this guy knows his stuff and can be trusted' and someone telling the IT staff that 'Person X is very important and you must give him root access to his PC.'

it all boils down to the fact that you have to be flexible and that rules - even security rules - do have exceptions.

Re:Learn to say "no"

[fmaxwell]

it all boils down to the fact that you have to be flexible and that rules - even security rules - do have exceptions.

As long as the guy in charge of network security gets to decide where the exceptions are, that's fine (except when it comes to a SCIF).

To use an analogy, if a doctor decides that it's okay to discharge a surgery patient a day early, that's fine. But the decision for an early discharge should not be made by someone in accounting and passed down to the doctor as an edict. (I'm arguing how it should be, not how it is.)

Re:Learn to say "no"

[Anonymous Coward]

As long as the guy in charge of network security gets to decide where the exceptions are, that's fine (except when it comes to a SCIF).

so, every time an admin grants you a little more than you should have, do you think the head of network security signed off on that? Do you think he even knew? Then again it wasn't in a SCIF (or "black area" or "four eyes zone" or whatever the kids are calling it these days) - and neither is this.

The fact that network security professionals recognize that there are multiple zones with different levels of security is just another aspect of flexibility in security. Think about it this way: the ultimate security is easy enough to implement - just turn all the machines off. But then you're out because the network is suddenly useless. So you make exceptions. You try to make rules or procedures out of these exceptions, mostly because it makes it easier to implement and administer as the size of your infrastructure grows (and the guys in audit got all starry eyed too). If we look at the different scenarios here for granting a professor "Administrator access on their local machines" there's very little trouble they could get into that you couldn't stop on the wire (unless they feel they need to send millions of emails as part of their study, of course. maybe they're sociologists or something). We can argue that back and forth for a while, but the point is, its a strategy.

Another one in this thread is here.

You could easily mix and match between these and other strategies (help here ;)) as long as you stay flexible.

Which you can't do if your first reaction is to throw all of your toys out of the pram.

Re:Learn to say "no"

[fmaxwell]

If we look at the different scenarios here for granting a professor "Administrator access on their local machines" there's very little trouble they could get into that you couldn't stop on the wire (unless they feel they need to send millions of emails as part of their study, of course. maybe they're sociologists or something).

As I wrote many messages ago:

"If a package that they use requires administrator privileges, put the system running it behind a firewall. Block all traffic other than that specifically needed to run the package. If it's a standalone package, then take the system off of the net completely. Enforce the policies at the MAC level."

We aren't diametrically opposed here. What I'm railing against is the scenario where someone in charge of network security is forced to give Professor X root access and a wide-open firewall just because Professor X finds security to be inconvenient. If you're in that situation, it's a no-win scenario.

Re:Learn to say "no"

[Anonymous Coward]

And as I pointed out, this is just one of many possible strategies - it was offered as an example of a solution, not a solution by itself. My whole point is about flexibility: the kind where you work to find a solution to a problem or situation and not just walk off in a huff.

We aren't diametrically opposed here. What I'm railing against is the scenario where someone in charge of network security is forced to give Professor X root access and a wide-open firewall just because Professor X finds security to be inconvenient. If you're in that situation, it's a no-win scenario.

We could not be more diametrically opposed. You are a technocrat - you believe that your superior understanding of technology gives you the right to lord it over people who know less - people who may have political clout even if they don't know thing one about computers. And you throw a fit whenever the world contradicts this perception. You don't object to the fact that there are exceptions to the security rules, and you don't see anything wrong with you, for example, having some extra privileges since you "know what you're doing" but the fact that a senior professor - someone who actually generates revenue or prestige for the university - is in a position to exert some pressure on mid level IT gnomes who are there to serve really seems to get your goat.

Re:Learn to say "no"

[fmaxwell]

We could not be more diametrically opposed.

Now that you have expressed you luddite viewpoint of the world, I am proud to be on the other side.

You are a technocrat - you believe that your superior understanding of technology gives you the right to lord it over people who know less - people who may have political clout even if they don't know thing one about computers.

That is correct -- just like a doctor believes that his superior understanding of medicine gives him the right to decide whether or not you get access to morphine, Prozac, or Erythromycin. It doesn't matter how much "political clout" you have, the decision belongs with your doctor. And decisions about network security belong with those who have the technical expertise to make those decisions.

And you throw a fit whenever the world contradicts this perception.

You are the one throwing the fit because my +5 Insightful comment does not agree with your status-centric world view.

You don't object to the fact that there are exceptions to the security rules, and you don't see anything wrong with you, for example, having some extra privileges since you "know what you're doing" but the fact that a senior professor - someone who actually generates revenue or prestige for the university - is in a position to exert some pressure on mid level IT gnomes who are there to serve really seems to get your goat.

When the IT staff makes a decision about exceptions to security rules, that's fine and as it should be. They have the technical expertise to make that call. Just like a doctor can decide to put you on a ten-day regimen of antibiotic even if the standard rule is a seven-day regimen. The guy in charge of network security at a university is not a "mid level IT gnome." He's a professional who is probably the intellectual equal of many of the professors whose asses you think should be kissed.

You're the same type who thinks that star football players should not have the same academic standards as everyone else because they "generate revenue or prestige" for the university. "But Bubba is our star receiver and alumni donations are based on football! Bubba shouldn't have to be literate, attend classes, and be under the same acedemic rules as other students. While we are at it, we should make exceptions to those financial rules and go ahead and buy him that Lexus that he wants -- just to make sure that he doesn't go to some other school next year." Yep. That's your idea of how the world should work.

I've really had my fill of people like you. You're the ones who thought that it was fine when a politician used his influence to keep his son from serving in Vietnam -- even though it may have resulted in some other couple's son dying. You think that insurance companies should be able to pressure doctors into prematurely discharging patients from the hospital. You think that it's proper for a politician convicted of manslaughter to serve less time than the average shoplifter -- and then have the conviction removed from his record. You believe that anyone with political connections should get preferential treatment from cradle to grave. I am proud to disagree with you.

Re:Learn to say "no"

[Anonymous Coward]

That is correct -- just like a doctor believes that his superior understanding of medicine gives him the right to decide whether or not you get access to morphine, Prozac, or Erythromycin...

My doctor would like me to quit smoking and eat less red meat. His "superior understanding of medicine" nonwithstanding, he understands that it's not 100% up to him. If he had attended the fmaxwell school of medecine his bed side manner might be "if you don't become a vegetarian and take up marathon training right now, I'm out of here mister! I can not work this way!"

And just for the record, this is not about status and prestige and getting ahead by kissing ass. This isn't some right wing rant about the use of influence. As to what this discussion has to do with politicians being convicted of manslaughter, I have no idea. Did they kill someone with a copy of service pack 2? Focus.

This is about flexibility. If you can't be flexible, don't worry about walking out of your job, the decision will eventually be made for you and then you can work on your next four thousand slashdot comments.

Re:Learn to say "no"

[fmaxwell]

My doctor would like me to quit smoking and eat less red meat. His "superior understanding of medicine" nonwithstanding, he understands that it's not 100% up to him. If he had attended the fmaxwell school of medecine[sic] his bed side manner might be "if you don't become a vegetarian and take up marathon training right now, I'm out of here mister! I can not work this way!"

You're trying to change the subject. It is 100% up to your doctor, the person with the expertise, as to whether you get morphine, Prozac, or Erythromycin. He decides. You don't. It doesn't matter how much "political clout" you have. You can make a limited set of decisions which affect only you -- just as and end-user on a network can.

And just for the record, this is not about status and prestige and getting ahead by kissing ass. This isn't some right wing rant about the use of influence.

Yes, it is, since you brought terms like "political clout," "prestige", and "revenue" into the discussion. And you are the one who referred to those responsible for network security with the desparaging term of "mid level IT gnomes." You have made it abundently clear that you believe that someone with "political clout" should not have to abide by the same rules as everyone else -- even it it endangers others on the network.

As to what this discussion has to do with politicians being convicted of manslaughter, I have no idea.

It's yet another example of "exceptions" being made for those with "political clout", something you have espoused over and over. It's another example of being "flexible" for someone in a position of power.

This is about flexibility. If you can't be flexible, don't worry about walking out of your job, the decision will eventually be made for you and then you can work on your next four thousand slashdot comments.

No, this is not about flexibility. It is about network security, something that you cannot seem to grasp. And my expertise in computer security has helped to keep me employed. My employer isn't looking for me to be "flexible." They want me to author and enforce network security policies that protect their interests while abiding by agreements that they have made (that is just one aspect of my widely varied responsibilities).

It's funny how you think that the persons responsible for network security should be "flexible", applying rules only to those of lesser influence, but that professors should not have to be "flexible" enough to work within network security rules put in place to protect every user on the network.

Re:Learn to say "no"

[Anonymous Coward]

You're trying to change the subject. It is 100% up to your doctor, the person with the expertise, as to whether you get morphine, Prozac, or Erythromycin. He decides. You don't. It doesn't matter how much "political clout" you have. You can make a limited set of decisions which affect only you -- just as and end-user on a network can.

OK, first of all: Hello? Mr Pot? This is Mr. Kettle.

Secondly: your doctor serves you. Not in any "yes, master, a brain for my master" kind of way, but if you ask a doctor you'll see that they consider what they do a service: what they do - more than that, who they are - is about helping their patients. You make them sound like cops trying to stop people scoring "morphine, Prozac, or Erythromycin".

You have made it abundently clear that you believe that someone with "political clout" should not have to abide by the same rules as everyone else -- even it it endangers others on the network.

We've already established that if someone "endangers others on the network" it means you're not doing your job. Yes, it will mean more work. Yes, there are strategies you can use to allieviate it. It's one of the points we were agreed on just recently, remember?

And as for "mid level IT gnomes" - well, I won't get into any "aspects of my widely varied responsibilities", but trust that I don't work in accounting (but I work with them).

No, this is not about flexibility. It is about network security, something that you cannot seem to grasp.

Security is all about flexibility: it's about the trade offs between brick walls and open doors. Anybody who works in security will tell you that if you are too strict your users will just make an end run around you and you will wind up even worse off. If you don't give them admin access on their machine, they'll just bring in a laptop and use that (remember that we are discussing a university setting). You can probably patch the desktop remotely, the laptop is another matter.

Re:Learn to say "no"

[fmaxwell]

OK, first of all: Hello? Mr Pot? This is Mr. Kettle.

Glad to meet you.

if you ask a doctor you'll see that they consider what they do a service: what they do - more than that, who they are - is about helping their patients.

Just as someone responsible for network security serves the company/organization that he works for.

We've already established that if someone "endangers others on the network" it means you're not doing your job.

And you can't do that job if you are being forced to turn over admin access to people who pose a security risk on the network. You rejected the notion that such machines would be firewalled off or removed from the net as a matter of policy. If you can't require that the machine be disconnected from the net or that it be firewalled to limit protocols and addresses to the bare minimum, how do you "do your job" to protect network security?

And as for "mid level IT gnomes" - well, I won't get into any "aspects of my widely varied responsibilities", but trust that I don't work in accounting (but I work with them).

I don't work in accounting, but I work with them when preparing the annual capital expenditure budget for my group. I am not, as you apparently assume, a network technician who works in the corporate IT/IS department. I work at an aerospace/defense firm in a fairly high-level technical/managerial role.

Security is all about flexibility: it's about the trade offs between brick walls and open doors.

You are ignoring the shades of gray. Network security is about designing a policy which complies with laws, regulations, and meets the needs of the organization. The laws and regulations may have to do with protecting classified data or they may have to do with protecting student privacy. You don't compromise network security just because someone finds it inconvenient. You work with them to try to find a way minimize the inconvenience, but you do not give up and hand over the password because some well-connected professor doesn't like having to call someone to install software.

Identifying "needs" is important, too. Does Professor X need administrator access to do his job or does he just want it? Does he need port 25 (SMTP) open to the outside world or does he just prefer it? Does he need to be able to install software or does he just dislike putting in requests for someone to install the software?

Anybody who works in security will tell you that if you are too strict your users will just make an end run around you and you will wind up even worse off. If you don't give them admin access on their machine, they'll just bring in a laptop and use that (remember that we are discussing a university setting).

What is "too strict"? If I'm protecting your privacy as a student, how strict should I be with university's security policy? Should I give admin rights to computer-challenged professor X, even though he has your personal information (home address, phone number, private student-professor e-mails, grades, etc.) on his PC? What if you are a professor at another university who is working with professor X on a research project? Should I risk the confidentiality of your research by giving professor X admin rights?

If you make violations of the organizations network security policy grounds for termination, then people will not violate that policy. Network security should not be a technology war between those responsible for it and those who don't like it. If you continually violate the organization's policy on sexual harassment, you get fired. Why should the network security policy be any different?

Anyone who works in security will tell you that it is inconvenient and that many people resent limits being placed on them. They will also tell you that it is important to help people work within the network security policy. But they will not tell you that being "flexible" is the key to success, either professionally o

Re:Learn to say "no"

[Anonymous Coward]

You rejected the notion that such machines would be firewalled off or removed from the net as a matter of policy.

I did? Where? I remember saying that most of the problems you could handle "on the wire" - that hardly sounds like me "rejecting" anything, now does it? Stay focused.

I am not, as you apparently assume, a network technician who works in the corporate IT/IS department.

I assumed that you were a developer, although I am beginning to think that you might be a sixteen year old with a spell checker.

Just for the record: I *am* an operator in my company's network department.

You are ignoring the shades of gray.

Lord grant me patience. I tell you that security is about trade offs and you tell me I'm ignoring the shades of grey. You, who seems to think that security is all about rules cast in stone that must apply to everyone or else the world will come crashing down around our ears. The central thesis of my whole argument has been that security relies on flexibility, whereas your world seems to revolve around storming out like a prima donna whenever things don't go your way... but I'm the one who is ignoring shades of gray.

You don't compromise network security just because someone finds it inconvenient.

I don't compromise network security for any reason whatsoever. As a flexible professional, I have worked out how to give clients what they want without compromising network security. You make it sound as if local administrator rights should only be granted at the end of two years of formal training. Are you telling me that the IT gnomes where you work are so weak that if a single user were able to get their hands on the administrator password to their local machine the whole place would come crashing to a halt? That's not security, that's just security theatre.

If you make violations of the organizations network security policy grounds for termination, then people will not violate that policy.

We are discussing a school environment. If you had paid any attention to the original story (there isn't even an article to read) you would have grasped that obviously there is *no* such policy in place here.

Anyone who works in security will tell you that it is inconvenient and that many people resent limits being placed on them. They will also tell you that it is important to help people work within the network security policy. But they will not tell you that being "flexible" is the key to success, either professionally or technically.

Let me get this straight: You don't work in security. I work in network administration (which enforces information security at my company) - and yet you are somehow qualified to tell me what "anyone who works in security" knows? Please don't even bother answering that, I quail at the very thought of the bombastic bullshit you will pull out next.

Let's get *this* straight: you do accept that there are exceptions to security policies. You accept that the security department should be allowed some leeway in which to apply their judgment - which is why it's ok for them to give *you* the root password (since you know what you're doing). The heart of your problem is the idea that the security department can be forced, by political pressure, to make these exceptions. The irony here is that, given your repeated advice above, I can just imagine you as one of these professors stridently claiming that:

"If I don't get administrator access on my computer, I am LEAVING! I cannot work this way! I'll be in my trailer!"

Re:Learn to say "no"

[fmaxwell]

I did? Where? I remember saying that most of the problems you could handle "on the wire" - that hardly sounds like me "rejecting" anything, now does it? Stay focused.

Your selective memory disorder is rearing its ugly head. You wrote: "this is just one of many possible strategies - it was offered as an example of a solution, not a solution by itself." That was your rejection of my assertion: "If a package that they use requires administrator privileges, put the system running it behind a firewall. Block all traffic other than that specifically needed to run the package. If it's a standalone package, then take the system off of the net completely. Enforce the policies at the MAC level."

So make up your mind: Do you accept the notion that such machines (machines where admin rights were granted to someone not qualified to use them responsibly) would be firewalled off or removed from the net with no exceptions? First I recommended it. Then you rejected it. Then you recommended it. Then I said that we were in agreement. Then you rejected it again, saying we were diametrically opposed and that it should not be done as a matter of course.

I tell you that security is about trade offs and you tell me I'm ignoring the shades of grey.

You wrote: "Security is all about flexibility: it's about the trade offs between brick walls and open doors." Something does not have to be either a brick wall or an open door. It can be something in-between.

I don't compromise network security for any reason whatsoever.

Earlier, you wrote: "The trail will lead to the PC of professor X. You have evidence that professor X didn't let you secure his pc - didn't let you do your job. He might be in trouble - or not, depending on his position, etc.. You certainly aren't." That is proof positive that you are willing to compromise network security and then try to cover your ass with a paper trail when something goes wrong. Another flip-flop. First you recommend caving (or "being flexible" as you put it) to political pressure and keeping a record for when/if there is a security breach. Then you claim that you never compromise network security for any reason whatsoever.

Are you telling me that the IT gnomes where you work are so weak that if a single user were able to get their hands on the administrator password to their local machine the whole place would come crashing to a halt?

No. I'm telling you that the users where I work have access to company-proprietary information as well as classified/restricted information and that malicious software that made it on to their computer while they were logged on as root could disseminate that information via e-mail, FTP, HTTP, HTTPS, or other protocols. I would have thought someone in network security would have recognized that. And for the record, we don't have "IT gnomes" at my work. We view, and treat, the people in IT/IS as computer professionals.

Let me get this straight: You don't work in security. I work in network administration (which enforces information security at my company) - and yet you are somehow qualified to tell me what "anyone who works in security" knows?

As to my qualifications, I design computer security policies and supervise people who enforce them. And I obviously do it at a firm that takes it a lot more seriously than the one at which you profess to be employed. I headed up a team at Cordant which received a C2 evaluation for a workstation and I designed, at the architectural level, a security coprocessor which took the OS out of the TCB. At my current job, I authored the security policy and procedures, and designed a network, which protected restricted (as in the government classification) and proprietary (my firm's and that of other vendors) simulation software and data in a private point-to-point network with a foreign entity. I should have said "any competent person who works in security." My bad

Get a backbone

[Yankel]

You either have a network policy or you don't.

I deal with this kind of stuff on a different level. I manage an intranet and need to deal with people wanting things 'their way,' only to have them complain when their way is the wrong way.

I get them to e-mail me acknowleding that this is against my recommendations or against policy X. When it blows up the first time, I fix it and hopefully gain his or her trust.

If he or she is still pig-headed one major experience or a couple minor ones, put solving their problem at the bottom of your list of priorities. Remember, you hold the power.

Just remember to have them acknowledge in writing or via e-mail that whatever they're demanding is against your recommendation or policy if you can't convince them to back off.

And if you run out of ideas, just follow Simon's lead http://bofh.ntk.net/Bastard.html.

Re:Get a backbone

[fuzzybunny]

This is pretty well-stated. The problem is that in a lot of environments, the admin is in a "lose-lose" situation.

As a consultant, I try to advise clients on what's the optimal thing to do for their own good in the long run, but also cover my ass with documentation and so. As a sysadmin of any kind, you often tend to run into issues where, even if you can show "I told you so", no matter how civilly or correctly it's documented, presented, whatnot, it's still your fault.

Remember also that professors are not usually the most rational of people--someone whose grant money feeds a large amount of IT services is not going to be as easy to corral as a middle manager who has to answer to a more highly defined company hierarchy.

That said, your statement about trust is about one of the most insightful things I've seen in a while.

Regardless, there are a _few_ passive mechanisms you can use if "having a strong security/usage policy", "getting on well with users" and "changing jobs" are not an option.

Things like http traffic inspection (transparent proxying), a good running/incremental backup model for desktops (with that much access they _will_ fuck it up) combined with an easy rescue & restore mechanism, and one-way firewalling (outbound OK, inbound not OK) in front of the group of people most likely to collaborate over a network (research team, prof & secretary, whatnot) are a good start.

Make a document

[keesh]

Get them to sign a document accepting full responsibility for all data loss, nasty crashes etc. on their machine. Make sure you include a list (several pages long if possible) of examples of things which they must accept responsibility for if they don't follow the normal security procedures. Either they'll be scared into following the rules or you'll be totally safe when the shit hits the fan.

Re:Make a document

[the_womble]

Right approach, but unless you have a really buck passing organisational culture it should not be necessary to even get it in writing.

I have worked for two companies where at least some people had admin on their own machines. But these were places where people did not pass the buck to IT if they messed things up. On the other hand IT did help even if it was your fault - which did not actually happen too often.

The advantages of having admin were that you could fix problems yourself (if you knew how), and you could install software without bureaucracy. Worked well enought there - vertainly a lot better than things worked at places with very strict policies.

remote management...

[rusty0101]

remotely manage their machines, using any of a number of tools.

Restrict logons to one instance.

Use the administrative tools available to restrict the hours a professor may be logged in to match his or her published office hours, and enforce automatic logouts for extended (more than one hour) idle times.

When a workstation has been detected to be infected with a virus, or spyware, remotely set the gateway for that workstation to 127.0.0.1, disable the switch port the workstation is connected to, and set the dhcp record in the dhcp server specific to the mac address for the workstation to also set the gateway to 127.0.0.1 until the workstation has been cleaned.

Feel free to advise the professors involved that you will get to them as soon as you have handled the network issues for the university president, and his or her immediate staff, as well as the people who are paying you.

Lastly set their network storage space to read only pending confirmation that that space does not contain any viri.

Should be simple enough to go take a look at the BOFH journals and improvise from there.

-Rusty

Re:remote management...

[bluelip]

>>Restrict logons to one instance.

Good idea.

>>Use the administrative tools available to restrict the hours a professor may be logged in to match his or her published office hours, and enforce automatic logouts for extended (more than one hour) idle times.

Sounds good. What happens if he wants to work from home though?

>> When a workstation has been detected to be infected with a virus, or spyware, remotely set the gateway for that workstation to 127.0.0.1, disable the switch port the workstation is connected to, and set the dhcp record in the dhcp server specific to the mac address for the workstation to also set the gateway to 127.0.0.1 until the workstation has been cleaned.

What happens when the virus/worm/what-have-you wants to infect machines on the local subnet. A gateway is not necessary to access machines on the same subnet.

>> Lastly set their network storage space to read only pending confirmation that that space does not contain any viri.

Readonly? Why? so someone else can open an infected file? Maybe allow directory scans, but to allow readonly access means you have an inkling there may be a virus around. With that knowledge, you should take all precautions. That would include blocking read access as well.

Re:remote management...

[rusty0101]

>>Use the administrative tools available to restrict the hours a professor may be logged in to match his or her published office hours, and enforce automatic logouts for extended (more than one hour) idle times.

>Sounds good. What happens if he wants to work from home though?

That's why they have admin access to their workstation at home. It is up to them to have a mechanism for taking their work home, or not.

Acutally the worst offenders of this would be the under and post grads who are doing the late night crunch time work. They however will either be using lab computers (if they even exist any more) or their own computers in their dorms or apartments.

>> When a workstation has been detected to be infected with a virus, or spyware, remotely set the gateway for that workstation to 127.0.0.1, disable the switch port the workstation is connected to, and set the dhcp record in the dhcp server specific to the mac address for the workstation to also set the gateway to 127.0.0.1 until the workstation has been cleaned.

>What happens when the virus/worm/what-have-you wants to infect machines on the local subnet. A gateway is not necessary to access machines on the same subnet.

This is why you admin down their network port. If you have full admin privleges to set the gateway to 127.0.0.1, you should be able to set the ip address for the user to 127.x.x.x, where x.x.x is the 24bit sequence number for the infection count. This should correlate back to a database record identifying exactly what virus was detected, or if there is some other incident in question, what happened. Note as well that an entire class A network is available under 127.x.x.x, none of the traffic directed to will ever appear on the wire.

Ok, I am ignoring the fact that there are bugs in the wild that will spoof the source address, and thus can send traffic that appears to be from a valid IP address. This is why you disable the network port on the hub or switch, and is the real reason you want to be able to manage the hubs and switches that are part of your network.

A lot of Cisco switches also allow you to lock a MAC address to ta specific port, and will automatically disable other ports if you plug an unauthorized nic into them. I can't speak for other switches, though I suspect Extream supports similar features.

>> Lastly set their network storage space to read only pending confirmation that that space does not contain any viri.

>Readonly? Why? so someone else can open an infected file? Maybe allow directory scans, but to allow readonly access means you have an inkling there may be a virus around. With that knowledge, you should take all precautions. That would include blocking read access as well.

Actually I was considering non-shared network storage. Storage space made available to the end user to use for backups. Since you have already locked out the user, making the space read only means that the user may be able to collect documents via a laptop, or other device, and yes this does allow for the prospect of an infected file being brought back down, but if the prof wants to take his Ph.D. disertation home and work on it, and perhaps deal with the prospect of having an infected file that he has to work with, I gaurantee he is going to scream a lot less if he can get at it read only, than if it is completely unavailable.

Now I grant you Doctoral candidates in the computer field are generally real geeks. The head of the department at my alma matter safegaurded his own thesis by giving copies to all his friends. I understand he needed to make to copies.

-Rusty

Re:Dear Slashdot,

[Methuseus]

If you can find the answer to this on google in 5 minutes, let me know, because I'm not even sure what to look under!

Inforce What You Can

[msisden]

Install antivirus and set it up to run updates as frequently as possibly.

Block ports that the user shouldn't need.

Install Firefox.

Set up an administrator account on said computer for the IT staff. Then go through and reassign rights to certain folders so that said individual can't touch it, but you can (ie/ for those antivirus settings, so they can't do something dumb like disable it).

Make sure all the standard software that should be installed works after you perform the above, otherwise they will chew you out about it and rightfully so.

Another solution, which could be used in conjunction with the above, is to make a standard reload image that you can slap onto a computer (using Norton Ghost and others). Every time the individual screws up their computer, take it away for several hours, slapping the image back on and then just sitting on it for a while. The loss of productivity will eventually hurt them, but you can explain it as time spent re-installing things from scratch. Decide on how you want to handle restoring their user files.

I wouldn't Need Admin Rights, Except...

[justanyone]

Disclaimer: I'm NOT a SysAdmin, I'm a developer.

I could really live without admin rights on my box at work. Really. Almost. Except for the bunch of stuff that I have to do that demands that I have it.

Most employers (and a Uni is the prof's employer, so this is about the same) have a 'standard build' which includes lots of software that most people need. The trouble is they never get the mix right for me, the developer. UBS Warburg had a damn good IT department (to cite the best employer I've ever worked for) but they didn't know about http://ultraedit.com/. They were very responsive with new software, but it was still a delay.

For general mode programming, I don't need new software but for maybe once a month, and I can stand a 2 hour or even 4 hour delay to get it installed. This is fine and thus I don't need admin rights for it.

The employer I most recently worked for (not UBS) is okay but they're typical of the industry (as a former consultant I've worked for about 20 companies in the past 14 years). Their standard build is not my standard build.

The times I need admin rights are:

• Correcting the system clock (if they had a timeserver I wouldn't need this);
  
• Adding the appplications they never get right:
  • UltraEdit
  • Filezilla
  • Mozilla/Firefox
  • Cygwin
  • Quicktime
  • Acrobat Reader
  • PowerDesk
  • ActiveState Perl
  • Folding at Home
  • MySQL & MySQL admin
  
  
• Evaluating New software;
  
• Running Apache on my own box - starting and stopping the service;
  
• With several of my admittedly small C# .NET programs, adding them as a service, starting, and stopping them;

Of course, my employer could have installed all the programs I've named and that would get me through the tough times, but the problem comes when I'm doing the other stuff.

Admittedly I'm a huge power user. But, there's no reason a departmental secretary needs admin rights. She shouldn't be installing that much stuff her/himself.

An organization that has that many rampant security violations obviously needs consequences for those violations. I can say that if I shared a password to my personal account, or a production account even, I would expect a reprimand from my manager. If it was a business critical system, I could be warned and then fired very easily.

Frankly, moving to Linux would not correct the basic organizational problems of disregard for data security. When a prof finds his tests were stolen and thus has to write an entirely new set of questions (a LOT of work, and strangely, I've done it as a Teach. Asst.), they'll think again about security.

If you schedule a computer switch-up, meaning taking all boxes away and redistributing them, you might force the issue of what software should be installed (get licenses for it if needed), putting data on server shares that are backed up regularly, and changing admin passwords. But I DON'T ENVY YOU THE TASK (grin). Of course, there's easier ways - reset admin passwords, announce a reinstall of the OS and thus they'll need to move all their files to a server share, require passwords be changed once every semester and enforce having a number and mixed case in the password, etc.

-- Kevin Rice
"Soon to be laid off from BankOne due to JPMChase Merger (don't want to move to NYC); looking for a Perl / C programming in Chicago Northern Suburbs - know of anything? Hints? Email me, kevin@justanyone.com with 'job' in subject line (due to spam filter)"

Re:I wouldn't Need Admin Rights, Except...

[Aphexian]

Disclaimer - I AM a sysadmin, not a developer.

And when someone comes to me with a list of non-standard applications that have to be installed ASAP or they cannot do their job (oh my god, how will we ever survive as a company if I don't make this one overzealous power user happy in the next 30 seconds), and smack in the middle of the list is:

Folding at Home

Guess what? Straight to the bottom of the pile. Don't waste my time because you like to play.
There are people out there trying to get work done. And their computers don't have spare cycles because they are doing work. That's what "our standard build" is centered around.

Re:I wouldn't Need Admin Rights, Except...

[Dogers]

I'm a sysadmin, but a nice one.

I'd install everything but Folding. If you drop it to the bottom, you're getting at odds with staff, deliberately delaying him working - someone whos likely a revenue generating employee. The last thing you want is to get a bad name in the company. ("Oh, dont go to X, he's difficult")

And how can you say people-who-are-working's computers dont have spare cycles? Even our terminal servers have spare cycles, if they didnt, the users would be banging down my door!

Re:I wouldn't Need Admin Rights, Except...

[chris_mahan]

I am a developer.

I needed jedit, ftp, and firefox with webdeveloper extensions. They said no way.

I said to my boss (and I kid you not): "I feel I will be unable to perform at the level of competency I promised to this company during the interview. I don't think it's fair to you or I, so I will have to reeavaluate my employment commitment."

Automagically my account was unlocked and all that stuff was installed under 2 hours, by me. It's been good ever since. Oh, and when I asked my boss for a dev linux server, he said: take whatever's unplugged in the server room. Because I demonstrated that I knew what the fuck I was doing. (no I don't run as root, you twit)

Ok. I feel better now.

Re:I wouldn't Need Admin Rights, Except...

[BJH]

Don't forget his urgent need for Quicktime. Last time I looked, most development didn't involve watching movies on your PC...

Re:I wouldn't Need Admin Rights, Except...

[ThomaMelas]

Depends on what he's doing. Our Devs here work with a number of video codecs and encoders. Quicktime isn't an outragous request.

Re:I wouldn't Need Admin Rights, Except...

[Anonymous Coward]

I'd install everything but Folding. If you drop it to the bottom, you're getting at odds with staff, deliberately delaying him working

I don't think so. I'd do exactly the same; I'd put him to the bottom of the pile.

Why? I have a list of people who need software installed. By including Folding At Home, he's demonstrating that he'll put virtually anything that crosses his mind on the list. That means the importance I place on his "needs" is much, much lower than the importance I place on the average person.

It's not about punishing him, it's about getting your priorities straight. This guy submitted a wishlist. Everyone else is submitting what they actually need to get the job done. Everyone else should be the priority.

Re:I wouldn't Need Admin Rights, Except...

[Anonymous Coward]

Running Apache on my own box - starting and stopping the service;

Run it on a > 1024 port. You only need admin privs because the default is port 80. The same applies to some of your other items.

Re:I wouldn't Need Admin Rights, Except...

[Dogers]

Bah, I would have complained about the "take anything thats not plugged in" ! :)

Re:I wouldn't Need Admin Rights, Except...

[Anonymous Coward]

1. * Folding at Home

A worthy project that you don't need to run to do your job. Got any more winners? :/

Re:I wouldn't Need Admin Rights, Except...

[Anonymous Coward]

...or if you really _MUST_ use port 80 and/or 443 on your workstation get apachectl added to sudo.

Re:I wouldn't Need Admin Rights, Except...

[Anonymous Coward]

That's true on *NIX systems, but not Windows. Any user can run Apache on Windows on any port if it has appropriate access to the error log, the access log and any content it wishes to serve.

The reason the grandparent wants/needs administrative privileges is for "starting and stopping the service." By default, Apache installs itself as a service on Windows 2000/XP so it runs when the computer boots (and thus before any users log on).

To my knowledge, only administrators can start/stop system services. It is, however, possible to run it manually instead of as a service and you could even set it to run when you log on. As long as port 80 isn't bound by some other process (and any software firewall present allows it to bind port 80), it'll be able to listen on it. Note that while I have not tested this on XP SP2 yet, I have reviewed the list of networking changes to make sure this behavior hasn't changed.

Re:I wouldn't Need Admin Rights, Except...

[Glonoinha]

The only problem is that for every guy that really knows his shit, there are 5 others that are complete bozos that install spyware and what have you, fucking things up for those of us in the first group (and the hard part is - those 5 think they belong in the other group.)

If you are in a serious bind, need random apps and what have you installed in your environment and getting the 'Lock Down Blues' ... get one app approved, buy it yourself if you have to : VMware Workstation 4.5, and tell them once it is installed they can lock your computer down as hard as they want. Needless to say, I work in a locked down environment (tight as a drum) and I'm happy (and productive) as a bumble-bee in springtime.

If you haven't heard of VMware, read my Journal (scroll down a little.)

Re:I wouldn't Need Admin Rights, Except...

[BJH]

Mozilla, ActiveState Perl and MySQL? Read the list again - he's a web 'developer'.

Re:I wouldn't Need Admin Rights, Except...

[barzok]

Right, and he's probably putting videos on a website, thus he'd need QuickTime.

Highly paid?

[Otter]

...highly paid, highly respected professors do not like to see the words 'Access Denied', not even on their secretaries' screens.

If it's any consolation, you (or at least your boss) gets paid more than they do. The rest of their compensation package is in self-importance.

Re:Highly paid?

[bluGill]

10 years ago when I was in school tenured professors got as much as $80,000 per year, and less than half of that is spent teaching. (note that the first years they spend a lot of time preparing for class, but once you have taught physics a few times you know how to do it, and this time is all spent before they get tenure). No they are not rich, but they are making double what the average person makes, at least in the US.

Re:Highly paid?

[danaris]

Well, I don't know where that was, but my father has taught at a liberal arts college in the Northeast for nearly 20 years now, and had tenure for most of that time, and he barely makes $60K. So professor certainly isn't always a job you want to get into for the money...

Dan Aris

Re:Highly paid?

[bcattwoo]

I think it depends on the field that you teach in as well. A professor in science/engineering research who pulls in hundreds of thousands of dollars (or sometimes millions for medical research) a year in grants is going to be able to command a higher salary than someone in the social sciences, who will probably be lucky to cover his own salary. I know of a certain chemistry/chemical engineering professor in the UNC system that is getting well over $200K/yr between his regular salary, summer salary, patent licensing, etc. Of course his salary pales in comparison to the football and basketball coaches.

Say its just a bug?

[djsmiley]

Weird one this but i've heard it used when i was at college in the UK....

Everytime a problem came up which the IT staff COULD fix instantly but couldn't be arsed to because we were just "lowly" firstyears then they would say "Oh its a bug, you will have to work around it".

And that was it, we could ask if they were planning to fix it, and they would claim they are waiting for a new version of the software. Shame is in this day and age, people EXPECT bugs, so much so that when one causes a problem, they find away around it.

Re:Say its just a bug?

[goatan]

Everytime a problem came up which the IT staff COULD fix instantly but couldn't be arsed to because we were just "lowly" firstyears then they would say "Oh its a bug, you will have to work around it".

If it was that simple why don't you fix it after they claimed they couldn't and then let there boss know that they where not doing there job.

And that was it, we could ask if they were planning to fix it, and they would claim they are waiting for a new version of the software. Shame is in this day and age, people EXPECT bugs, so much so that when one causes a problem, they find away around it.

And often that is the truth until the Bug is fixed you will have to use a work around also if a bug has a work around it is a much lower priority to fix than one the doesn't have a work around, there is nothing more annoying than being pestered by someone who can do there work even if it is a little inconvienient when trying to fix a real show stopper.

And that was it, we could ask if they were planning to fix it, and they would claim they are waiting for a new version of the software.

I really can't tell if you're joking or not. But if you're not joking they were very likely telling the truth.

Re:Dear Slashdot,

[frankm_slashdot]

Actually,
ethics-related debates and thats all this can be simplified to.

on the one hand.

even if he is a clueless admin who cant defend himself against smuck professors - he still has the right to ask dumb questions. it just lowers peoples opinion on him... i hate freedom preachers... but its the truth.. its his right. and should be assumed.

on the other hand...

its up to the editors to exercise their right to dump off the crap stories they find appropriate and even put up some crap stories if they like.. basically they have the right to run the site how they want...

and on the last hand,

we as users have the right to complain about anything we want... even if it makes people think less of us.

so how far down does the buck get passed untill someone accepts responsiblity for what happens here? certainly not the questioner... hes asking a question to a public forum knowing full well the odds of getting it asked on the homepage..

certainly not the end reader.. no one forces us to come here... which brings us to the editors..

so while they have the right to put anything they want on their site... its in their best interest to not post crap... and when they do.. its in our best interest to complain.. its how they'll know theyre posting crap..

opk im done with this.. and tired.. goodnight.

Gee, I don't have this problem ...

[ninewands]

Security policies at the U where I work are set by the Office of the Provost. IT is a part of Division of Academic Affairs and my boss works directly for the Dean of the College of Engineering. Enforcing the University's security policies is easy when they come from that high up.

His (my boss's) attitude is "we do not support student or faculty administered machines, other than to shut them down when they get compromised. If you want Administrator or root access to your machines, professor, you get to keep both halves when it breaks."

Of course, our favorite trick to discourage use of telnet and XDMCP is showing the prof his username and password in a sniffer log from one of his compromised machines.

Re:Gee, I don't have this problem ...

[ryltar]

I also work for a large university and have the same type of problems, but our solution seems to be unique compared to most of the other posts. Almost everyone has admin rights to their own computers, but the network admins run some kind of program that continuously checks computers for viruses, trojan horses, and unauthorized servers. If it finds any of these things it then blocks the computer from accessing the campus network by MAC address. The computer then has to be certified by a technician that it has been cleaned, patched, etc. before they will unblock it. Some departments have their own IT departments to take care of this, but many don't and end up sending the computers to the main campus IT department where I work. The kicker is that we charge the department $40/hr to fix their system so there is definitely some incentive to keep their systems clean. Otherwise their departmental budgets will all go to keeping their computers in working order.

give them "Administrator"

[QuietRiot]

Rename Administrator "toor" and create an account "Administrator" with more then they have, but not all, permissions.

Policy, policy, policy

[martin]

oh and did I mention policy.

If they aren't adherring to a written policy then there should be 'measures' available in the policy you can take.

If you haven't got a policy - write one.

Re:Policy, policy, policy

[teddlesruss]

Amen to that, a written policy that each person has to agree to is the first line of control. And unless you have control you won't be able to manage the network.

Secondly, transparent proxy. It's great, the users don't actually see any "Nazism" so they don't kick up, and you get the advantage that you know exactly what traffic is going through your firewall and can even scan it.

Either you maintain the machines, or they do

[bluGill]

If you maintain the machines, they do not get admin access. Install a lot of useful software on these machines, and be responsive to requests for more software.

If they maintain the machines, you don't have a copy of the admin password. They get access to your servers (which you back up of course) as a user. If they want their local machine backed up they have to do it themselves. If your normal network monitoring reveals this machine has a problem (often meaning it is running a spam bot), you turn it off at the network connection, and refuse to turn it on until it has been re-imaged. Once in a while you could check for illegal software (child porn, or anything else illegal), and turn anyone with it into the police, but do it via documented procedures.

Luckily, its a Novell network

[Kiaser Zohsay]

... and Novell lets you add or remove FileScan rights. If they don't have access, take away filescan too, so they don't even see it. Then give them access (and visibility) to only exactly what they need.

I'm pretty sure there is no equivalent to filescan rights at the server level in NT. There might be a way to do it in *nix, but I don't know off the top of my head what it is.

Make the problems worse...

[OdieWan]

The university I work at uses a simple approach; if a machine is compromised and the person is silly enough to ask for help, or if the compromise is remotely detectable, they immediately cut its network drop. They refuse to reinstate it until a member of IS has been by to reformat the drive and reinstall from scratch, no matter how simple a "cleaning" operation would be.

It's amazing how many people get around to asking "How could I have avoided this" the second or third time they lose their computer for a day or two...

Re:Make the problems worse...

[Yankel]

The trick is to do this with empathy. "I told you so," won't get you anywhere.

Where I work, there are "supported applications" and "unsupported applications." If you've installed an unsupported app, then you're pretty much up the creek if the problem can't be solved in five minutes or less. You lose your computer for a day.

Fortunately, larger companies tend to have a standard image for each model that install over the network, so it's your time that's lost, not the IT guy's. He just presses a button and lets it run.

Do most universities run like this -- with bulk purchases of hardware for staff, or is equipment purchased as needed?

Re:Make the problems worse...

[OdieWan]

They typically use a good cop/bad cop approach; "the big nasty network admin made me take down your computer, I'm just the poor slob who has to reinstall everything."

At our place, computers are almost always purchased piecemeal out of research grant, so there is no standardization on hardware, OS, or software, aside from the presence of site licenses for some of the more standard kit.

My Fav (For getting users off of IE)

[wbav]

Okay, so this takes a little BS skill, so be warned.

First, you install Firefox and you tell the user to use it as IE is inherently prone to spyware and corruption issues. (In your case you can add in that these issues go away if you are no longer administrator on the local machine.)

After about 2 weeks, copy your own iexplore.exe and open it in a hex editor. Switch the first two bytes in the exe. Then have the victim's login script move the old iexplore.exe and copy the new iexplore.exe into the Internet Explorer directory. (Network shares.) Let things simmer for a while. Eventually, be it windows update or whatever the user will reboot and hit your script. Bingo IE no longer works.

When you get the call you ask the user, have they been using Firefox? When they say no, tell them that you need to take their computer for a day to fix the problems IE has caused. Repeat the process till the user stops using IE.

By making it clear, that the cause for the machine repairs is IE.

Special Note:
This does not work well on CS Instructors or other people who look closely at login scripts. If you find such a person, it is easy enough to shame them into using Firefox by asking "how someone who's obviously as smart as them would ever use IE?"

Good luck on this.

Re:My Fav (For getting users off of IE)

[jgoguen]

This does not work well on CS Instructors or other people who look closely at login scripts.

That's why you do it as a small C program.

• Copy the iexplore.exe file to some obscure directory and edit it
• Copy the unmodified iexplore.exe to some directory so you always have a "clean" file (as if IE can be clean...)
• Write a C program to copy the "new and improved" file to the Internet Explorer directory
• Rename both iexplore.exe files as something other than a .EXE file. Make sure it looks like an important file for that folder.
• Write a small C program to copy the "new and improved" IE file to the Internet Explorer directory
• Add a registry entry to make the program run on startup. To make sure it doesn't happen right away or often, make it only work on days divisible by 6 or something like that.

Note that thanks to how deeply IE is hooked into Windows, this may have other undesirable side effects. Of course, if you're doing this you probably want said side effects to happen anyway.

Re:My Fav (For getting users off of IE)

[wbav]

Funny part is, as far as I can tell, this actually has no side-effects. All the code used for the rest of the system is in dlls, this only affects the browser code.

Easy.

[Anonymous Coward]

1. Make everyone security equivalent to admin.
2. When it breaks, blame the problem on terrorist network activity.
3. Go play golf.

you set the rules

[Dr.Opveter]

Either they don't get admin access and their machines keep working or you do give the admin access and they have the opportunity to mess up their machine. I'd make it a policy to not spend too much time trying to fix their machine infested with malware/spyware, missing dll's, deleted application files etc. Penalty to pay for seriously messed up machine: you get a nice clean brand new install (takes you 2 minutes pulling an image of the OS on the machine if you take some time to set things up properply). Just my 0.02

not to troll, but...

[Anonymous Coward]

highly paid, highly respected professors do not like to see the words 'Access Denied', Something that always annoys me is that administrators often think their time is more valuable than everybody elses and act, well, rather spoiled. You are an administrator, not an f'ing emperor. Often times busy people like professors or managers need computer assistants just like they need filing assistants, scheduling assistants, etc. Unfortunately, sometimes you need to adapt to the job, the job will not adapt to your immature preconceived idea of what it should be.

I guarantee that your time is worth far less than theirs, and in fact, getting you to do some of these things would probably end up saving the university money in the long run.

Re:not to troll, but...

[clickster]

I think you're missing the point completely. Let me get you back on track. The problem is that, as an admin, you were hired to make the network secure, and thus are RESPONSIBLE for its security. But often basic security measures are thwarted by people who feel that they shouldn't have to follow secure policies. i.e. giving their elevated-access password to their secretaries, writing their passwords on stickies and putting them on the bottom of keyboards. If the secretary was supposed to have that level of access, they would. If it's really needed, the prof can request that the sec's access level be increased. But if he gets a "no", that's the end of it. Kind of like when I'm given a key to my company's building and told that it's only for my use. I don't decide for myself that I think the policy is crap and hand it to someone else. If follow the friggin policy. If I take a few hours off for personal time, I turn that time into HR. I don't decide for myself that it's a crap policy and I shouldn't have to account for a mere two hours of off time. Again, I follow the friggin policy. Most people follow policies like this, but when it comes to IT policies, they feel as if "policy" and "suggestion" are not synonyms. Yes, some admins can be unreasonable. Take it over their heads and see if those above them feel the same way. I've had jerks for bosses and jerk who led other depts. that set policies that affected me. But I follow those policies. Why? Because it's my job.

Re:not to troll, but...

[chriso11]

The parent has a point. IT reminds me of HR - two functions that believe that they have inflated importance.

I am not in an educational organization, I work in an engineering role. First off - my company's primary product is not IT support. Don't forget that. While I do understand that users often make stupid decisions, your job is to keep the employees working. DON'T get in their way. Only when the user's actions are disrupting OTHER users should you take action. If the user does something stupid, then fix it. That is your job - you are (for lack of a better term) a technical maid.

An analogy of IT is in a car, IT would be the engine oil. No, it's not absolutely required for the car to go, but the car won't get very far without it. The better the quality of oil, the more efficient the engine is, up to a point. Don't make the mistake of thinking that IT is GAS.

Re:not to troll, but...

[topham]

The problem is IT isn't treated like your local mechanic, if you (general) treated your mechanic the way people treat IT he would tell you to take your car elsewhere.

When a mechanic tells you it will take 3 hrs to fix your car, but confirms it might be less and he'll call you as soon as it's done you accept it.

When IT says the problem will take 3 hours to fix you tell them they have an hour.

When the mechanic says sorry, it took longer than 3 hours because ... , you'll be upset but let him do his job.

When IT says sorry, it's going to take longer than expected you tell them to wrap it up and fix it later. Later never comes and the problem migrates until it hits critical priority and they have 15 minutes to fix what would have taken an hour more to fix previously, but now they aren't sure how to proceed since it was left in an unknown state.

And, you blame them for the problem in the first place; regardless of their lack of any prior involvement.

Re:not to troll, but...

[Robert The Coward]

Part of the blam for that goes to microsoft. They have been telling people the windows is so good anyone can manage them. So the people who take care of computers and networks are viewed more as a trained monkeys and are treated as such about the same as most people treat a cashier or bank teller.

Re:not to troll, but...

[goatan]

An analogy of IT is in a car, IT would be the engine No, it's not absolutely required for the car to go i would strongley disagre no engine can run for more than a minute or 2 before permantley seizieng.

but the car won't get very far without it.

First you say oil isn required for the car to go and then you say it is. Your analogy suggests that companys would sieze up if they didn't have IT!.DON'T get in their way. Only when the user's actions are disrupting OTHER users should you take action. If the user does something stupid, then fix it. That is your job - you are (for lack of a better term) a technical maid.

My current IT department us to work on exactley those lines we would only ever react to to users requests we were in effect technical maids, we would have major outages once a week at least. Recently we have changed to a more profesional approach and taking some control away from the users quess what major outages have almost completley cleared up. Now quess which way of operating the user prefer.

While I do understand that users often make stupid decisions, your job is to keep the employees working.

This is what we are now able to do, which couldn't before when we were acting as technical maids responding to users. now we are advising and working with users and it works a lot better.

let them have it

[Darth_Burrito]

Give me the strength to change the things I can. The courage to accept the things that I cannot. And the wisdom to know the difference.

There's only so much you can do in a situation like that. Give them the reasonable to semi-reasonable things they want and try to protect them without getting in their way. Most importantly, don't be adversarial with these guys unless someone is a big problem and it is clear to users and staff alike that the person is a problem.

So, what's the problem?

[Pig Hogger]

Iand go weeks on end without rebooting.

They clearly are not using windows! So, what's the problem???

Tighten the screws slowly

[erth64net]

Sometimes policy overides politics, but many times that's not the case. If your written policy supports the action, then start slowly locking the systems down.

Other than the small group who seeks a power-trip or "administrator badge", you'll find that the bulk of those requesting admin/root access to a system are those who feel the need to do something at that level. Maybe it's a broken Win32 app which requires a lot tweaking to run as a non-administrator, maybe the SysAdmin never setup sudo (properly?). In any case, the user is likely just seeking the access needed to do their job (or what they believe to be is their job).

Start by locking things down slowly. When something breaks, blame it on "a bug" and quietly back-off the restriction until you can figure out what/why something happened. Then either deturmine why/if its needed, fix it, lock it down, and move on. Make sure your IT group/boss supports this action - they love to play along with things like this, as it gives them more power to do their job, enfore policy, secure/stablize the systems, and at times to tell those arrogant users (usally in-front of their boss) "Computer working great? Good. Oh by the way, that access you said you needed, you havent had it for three months...". Oh god, I love to be in the room when we do that!

Intresting thing is, in the business world, the user insisting on the higher-level access is usally having issues elsewhere in their job. I've seen the bulk of employees leave/quit anywhere from a few weeks to a few months after completing this stunt.

Overall, this technique has worked great for me in public/education enviroments and still works very well in the business world.

Re:Tighten the screws slowly

[squiggleslash]

When something breaks, blame it on "a bug" and quietly back-off the restriction until you can figure out what/why something happened.

I've seen sysadmins do this before.

The problem is that many of the people who are asking for more administrative control over their own machines do, actually, know what they're doing. While it's certainly true that a lot of people who do not know what they're doing want administrative privileges over their PCs, it's equally true that almost everyone who knows their machines, who's familiar with proper security, who knows what Central Services isn't covering, and who finds their "security systems" get in the way, wants administrative privileges too.

And when you lie to that group, they know it.

My advice to the average central administrator is to find solutions to problems instead of lying about them or turning into a control freak. People generally want control over their own machines, so it's important to give them that control.

Decentralize the network. Allow teams limited access to the network in return for complete control over their own machines. Manage a handful of central servers that provide certain services to everyone, but rarely need a password of the type that would have to be shared with others. If people are sharing passwords, find out why and provide alternatives (many modern email systems, for example, allow people to authorize each other to be able to look at each other's mailboxes, Exchange does, for instance. That's a common reason in academia to share passwords. Show them how. I've yet to come across a sysadmin who does this.)

Firewall teams from each other.

Provide the option of managing people's PCs if they want it, but if so the whole team's PCs are managed, not just their's. If they still want unmanaged PCs, provide an additional subnetwork that's firewalled off, just as their's is.

Anyone who "wants their PC fixed" if it's unmanaged, and the fix is because of viruses or worms or whatever, gets one option: a format and an operating system reinstall, with the latest Ad-Aware/etc tools installed. That's not being mean, because most of the time that's all they want.

The critical problem is that most organizations have one network and connect everything to it. There's little reason to do this. Be flexible, the people you work for have different jobs. They're not identical drones, don't treat them as drones.

Re:Tighten the screws slowly

[Anonymous Coward]

> My advice to the average central administrator is to find solutions to problems instead of lying about them or turning into a control freak. People generally want control over their own machines, so it's important to give them that control.

Problem with this is, people want control but not responsibility. When something breaks or starts running poorly, guess who gets the call to "Fix This AT ONCE! I can't WORK!"

Re:Tighten the screws slowly

[squiggleslash]

My response to this is as above:

Anyone who "wants their PC fixed" if it's unmanaged, and the fix is because of viruses or worms or whatever, gets one option: a format and an operating system reinstall, with the latest Ad-Aware/etc tools installed. That's not being mean, because most of the time that's all they want.

If someone has opted for self-administration, and they need help, it should be made plain to them that's the level of help they'll get if they choose self-administration. Give them the choice.

The only reason people appear to be contradictory in current work environments, wanting the control but not the responsibility, is because currently most system administrators do not want to give them either, and aren't willing to create systems that give users that control and responsibility.

Re:Tighten the screws slowly

[erth64net]

In a perfect world maybe - but in the real world, when you tell a user to keep both pieces of a broken computer they throw the pieces back at you, and then run screaming to their boss. Disclaimers/waivers be damned - you're fix their broken system, because damn-it you're IT and that's what you (or someone in the already resource-strained IT department) are paid to do.

Politics suck...

Re:Tighten the screws slowly

[squiggleslash]

No. Look, in the REAL WORLD system administrators are not doing what I'm suggesting. On the rare occasion they get close, they really do not have the problems you and the AC are talking about.

Most of the system administrators at my employer trust most of the programmers and provide them with administrator rights on the specific understanding that the policies I described above are in place. It works. When our (programmers) PCs are screwed up (which doesn't happen often), WE fix them, or at worst we ask our admins to do a reinstall. The admins are not blamed.

Most system administrators I've come across outside of my employer want to have their cake and eat it. They impose draconian restrictions on what people can do, that usually break things, lie about problems caused by those restrictions, and then complain when they open some hole somewhere to allow someone to do their job, that person's PC breaks, and the person goes to their boss because - after asking for nothing but a fix - the admins aren't willing to do that.

Admins work for users, not vice versa. They need to recognize that in the real world, there are different types of user, they have different needs, and security policies are as much about protecting users from each other as from themselves and the outside world. Right now sysadmins do not recognize that, they want crude, simple, networks, with no security in the networks, and all the security on standardized, Windows-running, PCs, regardless of the consequences. It's the same mentality that forces corporations to "standardize" on one platform - it's not just the PHBs who push for that you know.

Re:Tighten the screws slowly

[erth64net]

Ahh, I see. You're talking about the typical developer vs sysadmin debate. On one hand an overzealos developer cannot make a good business case for a "need". Likely also developing services/tools without even consulting the sysadmins in regards to how it impacts the systems - because the devloper "knows what's he's doing". On the other hand the sysadmin is likely far too busy to babysit/handhold them through the process.

I've seen this issue solved quite quickly - make a good case to what you need, and make sure your sysadmin understands what you're doing. Also make sure you regularly communicate with the sysadmin in regards to how something you're doing impacts the systems. I'm not going to punch a hole in the firewall just becuase someone, anyone, wants me to. Make a good case for it - I'll listen and likely tell you how you can utilize an already existing option without futher lowering the systems security/stability/reliabilty.

You said it yourself - you go running to the sysadmin when you really f*** up your system - I'd bet good money you run to them far than an average user. Fine, you develop something - that's gonna happen - but remember you're increasing the sysadmins workload because you wanted that extra access...

Our developers involve the sysadmins regularly (hey, it's called teamwork) - they have all the access they need on their systems (yes, most of them have full admin rights). In-fact frequent requests to them for "anything else you need" frequently come back with "nope, doing great!".

Crude and simple networks huh? Explain... It sounds like you've never tried to develop security policies, nor provide any sort of support for endusers or in sysadmin enviroments. As your comments demonstrate a complete lack of understanding in regards to how difficult it was to get to the current state.

As for the security claim - I cant say I've ever seen that. I run around in the Novell and Unix circles and I've yet to run into anyone trying to make a good argument to use Win32 for anything. In-fact it's quite the opposite - Win32 is frequently the last choice when it comes to back-end systems - for a very good reason...

Re:Tighten the screws slowly

[erth64net]

"...The problem is that many of the people who are asking for more administrative control over their own machines do, actually, know what they're doing..."

False. In both the academia and business worlds many of the folks who insist on this access are sales, customer service, support (business, admin assistants, etc), and administrative (again, business-related) staff who's "...home computer has never crashed...and never had any problems with full access...". In my experience, most of them where never able to present a valid case for access, and were rejected outright. For those who did, a few examples of their results:
1) The CIO managed to virus-infect every word document on the corp fileserver - as he insisted on full admin rights at the time. His full rights were then of-course revoked afterwards.
2) Unauthorized/pirated software was installed, and in one case was running services for a few users. After it was discovered, we found that the users were trying to re-implement (quite poorly) something already fully implemented - though they had never taken the available classes/training because they "knew enough"...
3) In three separate cases, employees were caught running separate competing businesses using their employer's systems.

For those very few remaining folks who show enough competency and can make a good case for the request. They are granted additional access. They understand that when what they have breaks, they get to keep both pieces - any repairs are going to be at the bottom for the priority list, and yes they do scream loudly when reminded of that fact. Though we maintain: Since they "know enough" and IT is already understaffed and overloaded, they're assisted but expected largely to resolve issues on their own. When it comes to only having enough resources to help the secretary resolve an issue vs the power-user trying to do something, the secretary wins hands down.

Welcome to the real world...

"...who finds their "security systems" get in the way, wants administrative privileges too..."

Security is by definition designed to get in the way - your job as a sysadmin is to minimize the impact that these barriers pose to legitimate uses of the system, and to manage the limited resources which an organization can afford.

Heck I'm the only Senior SysAdmin where I work and I haven't used the root password for any system in over 6 months. There's plenty of tools out there that I can quite effectively do my job without being "god".

"...My advice to the average central administrator is to find solutions to problems instead of lying about them or turning into a control freak. People generally want control over their own machines, so it's important to give them that control..."

Do you live in a dream world? In order to manage something you must be able to exert control over it. Now going overboard is possible - I've seen it done, but again a sysadmin's job is to find the balance between control and functionality, not to release the reigns. Lying? No, if the application does not work without full administrative/root privileges then it's flawed. That flaw/bug prevents you from securing the systems. The solution, as noted in my earlier example, is to remove the restriction that exploits the flaw/bug so people can function again, fix/secure the issue, and then move on.

"...Decentralize the network..."

In MOST orgs (ie: under 500 employees - not counting students in edu environments) - are you KIDDING?!? IT teams are usually small enough that there's no "team" to separate - it's one IT dept, one IT office, period. There's no resources to distribute - except for maybe your "tech" contact at a remote site - who's real job is very likely unrelated to IT.

The email example is great - that takes us back to item number 2 in my list of things which have occurred because a user was given too much access. Again, the functionality was already in the existing system - the user just didn't kno

Re:Tighten the screws slowly

[squiggleslash]

False. In both the academia and business worlds many of the folks who insist on this access are sales, customer service, support (business, admin assistants, etc), and administrative (again, business-related) staff who's "...home computer has never crashed...and never had any problems with full access...". In my experience, most of them where never able to present a valid case for access, and were rejected outright.

Bullshit. Frankly, if you were a system administrator working for me, I'd fire you outright right now as, on the basis of what you've said, you're clearly too arrogant and incompetent to do a capable job.

The fact that many of the people who insist on access know less than they think they do does not mean everyone who insists on this access doesn't know what they're doing. Further, my point at the time was about the fact that, ignoring the validity of their requests, many of the people who ask for access actually do know what they're doing. This was in the context of someone arguing that system administrators should flat out lie to them about the consequences of those administrator's security policies.

We live in a world in which a sizable proportion of the population have PCs, and administer them themselves, and know more than a little bit about computing. They may not be the best people suited to administer them, but that doesn't mean you blow people off claiming "bugs" in products that actually function correctly except that some dumb virus scanner or port blocker prevents that. Many people I wouldn't trust to operate an air conditioner know enough to know when they're being lied to.

For those very few remaining folks who show enough competency and can make a good case for the request. They are granted additional access. They understand that when what they have breaks, they get to keep both pieces - any repairs are going to be at the bottom for the priority list, and yes they do scream loudly when reminded of that fact. Though we maintain: Since they "know enough" and IT is already understaffed and overloaded, they're assisted but expected largely to resolve issues on their own. When it comes to only having enough resources to help the secretary resolve an issue vs the power-user trying to do something, the secretary wins hands down.

Welcome to the real world...

And further, you even acknowledge your comment "False" was, actually, false, even using the out-of-context context you were replying to. Indeed, there are many people capable of maintaining their own systems, who have a need to, and who will not protest too loudly if their systems break.

Your final sentence is tremendously ironic. There's the real world, comprised of many different people doing different jobs with different levels of skill requiring different technologies to get their jobs done. And then there's the classic system administrator world who believes that virtually everyone can be squeezed into a single category of system. For them, the Windows PC exists for its own sake, it is a device capable of anything, even when running a limited list of "approved" software. That, my friend, is not the real world. That's the world employees of most major organizations have to deal with on a day to day level, and it's a world of inefficiencies, outages, and, yes, security problems. It's a world of security problems because it inevitably doesn't work - people go around the system, with or without the permission of their admins, and the system isn't designed to cope with people going around it.

Nor is the real world to hamper people in what they do and then complain afterwards that those people are taking up too much of your time and they should fix the issues because, hey, it was their fault.

So you get email viruses, and spyware, and all the other junk, because sysadmins tried to get the people they should have been working for to fit into a tight little box, and the boxes broke. And again, when the

Re:Tighten the screws slowly

[Glonoinha]

Actually what he said was 'if we screw it up, we fix it. If we can't fix it we call the admin and ask him to bring the Gold Disk.' When getting an admin involved means getting your system formatted, you tend to keep your computer running nice and TIGHT.

We get admin rights on our boxes at work, but we have to agree to the same sort of deal in the process.
Tech support for the group that goes that route consists of one option :
Format C: [X]Yes [ ]No

(and we are happy (and productive) as hell with that arrangement.)

If that isn't reducing the workload of an admin, I don't know what would.

Re:Tighten the screws slowly

[erth64net]

Bullshit. Frankly, if you were a system administrator working for me, I'd fire you outright right now as, on the basis of what you've said, you're clearly too arrogant and incompetent to do a capable job.

Ouch, terminating an employee for following company policy - now that's harsh. The fact is, for the two employers I've worked for in the last ten years this has been the standard department attitude and policy. Most users clearly don't and shouldn't need to administer their systems - not only do they usually not understand/remember how, nor have the time, IT'S NOT THEIR JOB! In both orgs the attitude and policy I noted was in place even before my time there. There has been energy to change the attitude from time to time - though in every pilot/test program we've run, where more and more control/administration was passed to the end-users (including the ones deemed more fluent than others), we've found consistent sweeping issues:
1) Hardware was damaged due to improper system settings.
2) The rate of system failures increased shaply as users tried to apply unecessary tweaks to their systems, and install unauthorized and uneeded software (ie: when asked to justify, they couldnt).
3) Virus updates failed - the users never notified IT, and systems were infected.
4) Patching routines failed - the users never notified IT, nor attempted to correct the issue theirselves.
5) Users tried to re-implement already existing aspects of the systems - when the underlying issue was that they didn't know about an existing implementation due either to their failure to take the recommend training courses, or to read the information distributed by the department. When the users did pay attention, and were educated, they were happy with what they had, and many times provided constructive feedback on additional features/functionality.

Further, I never advocated lying to everyone. To those employees here who are actively rude, who demand things work without being rational, like the article's original situation, that's sometimes necessary. You misinterpreted my original message (that could have very well have been my fault - that's what I get for composing a brief reply - expecting the blanks to fill themselves in). I've seen many Win32 desktops work very well in "locked down" states - yes it takes time to identify and work around bugs in the software - most folks are happy with that explanation and really don't care to hear how program X's XYZ HKLM/Software/bla/blabla needs to have Read/Write access granted to "all users". You tell them that, you accomplish two things: One, their eyes glaze over, and two, you make them feel like an idiot because they don't understand a word you're saying. It's like when my significant other speaks in one her foreign languages - she sounds great, but I feel like fool with a silly look on my face because I don't understand a word of what she says. If a reasonable user asks for more detail, we give it to them - otherwise it's a bug, end of story.

We live in a world in which a sizable proportion of the population have PCs, and administer them themselves, and know more than a little bit about computing.

Have you paid any attention to the Microsoft Worm/Virus issues plaguing the internet these last few years? The simple fact is, these systems and the procedures to maintain them are becoming increasingly complex, most folks just don't have the time to spare to learn about the newest virus scanning technique, newest firewall issues, or latest software patch available. Why should we expect them to anyway - their system should "just work" without them having to babysit it every-other day. In my book, if two programs don't co-exist together (ie: a spreadsheet and antivirus app), unless one program was sold/designed to break the other (like an antivirus going after a virus), it's a bug - period.

Indeed, there are many people capable of maintaining their own system

The Key to Higher Ed

[Houkster]

Tell them that to improve the academic experience they should only work in the computer labs that the students use; which is where you have deep freeze, right?

Ok, aside from that what I have seen done that works well is to setup Service Level Agreements with the faculty outlining supported and unsupported applications. Essentially that washes your hands of hanving to fix unsupported software and having the excuse to remove it or even install a clean image on the machines. Also, track all service requests in some sort of database so when your department gives an annual report it can show that it spend xx% of its man hours fixing easily prevented things.

Finally, treat all faculty and staff as hostile and plan accordingly.

Re:Dear Slashdot,

[Short Circuit]

whine whine whine.

"Ask Slashdot" is a moderated method for people to ask questions of a larger community, getting moderated responses.

in this case, his is a social question, one that there's no single answer to. Any solution is going to have to come from people who've encountered it before, and who can describe their situation.

If you don't like it, disable the Ask Slashdot topic in your user preferences.

Put them outside your firewall(s)

[Anonymous Coward]

Insecure machines should be treated like any other machine on the public internet - and should be on the other side of a firewall from your core systems.

If your professor wants their secretary's system to be able to see every share on their computer, then set them up as an island to themselves, and put a firewall between their little sub-net and your main network.

And charge them for it. Hit them in the grant $$$, and they will eventually get a clue (or, they will cough up).

Go to the top

[Anonymous Coward]

Explain the situation to the department chair and get him/her on your side. Then the complaints from the other professors just becomes griping.

Some sage advice. . .

[Anonymous Coward]

First let me start of by stating that I have worked in the same exact environment.

I know this will ruffle a lot of feathers, it even upset me when I discovered it but: YOU ARE INSIGNIFICANT. Let me say that again, You Are Insignificant, despite its white collar veneer, your job is no more important that the foreigners' that polishes the floors. If he wanted to implement a policy of "everyone must remove their shoes before entering the building" he would be laughed out the door.

For your sanity, you need to concentrate on two things.

Relax and let them have their way, but ALWAYS let your management know the potential consequences of their policies, not in a "Chicken-little" way, but in a sober well, reasoned fashion. Don't forget to backup religiously, data loss will be your fault.

The profs don't necessarily hate you personally, its just that your "rules" are an impediment to their productivity. Your job is not to manage the systems, it is to enhance their productivity. If your systems are as 'invisible' as the fax machine your have done well.

Working in academia has many many fringe benefits, don't loose sight of those just because you want to be the BOFH.

--ac

Re:Some sage advice. . .

[Anonymous Coward]

moronic, puerile, and just plain dumb advice.

clearly from someone who really is an INSIGNIFICANT worker bee whereever they work.

here's the deal. you're working with booksmart people. they're not stupid, just entrenched in their routines. however, they work for somebody else. you need to braodcast your case to your management and have them define a policy that should then be proposed to the powers that be.

propogate policies from the top down. as they say (well i do anyway...), going uphill is toughest when the incline is steepest.

Re:Some sage advice. . .

[arethuza]

No, I think the original post sounds like he has actually worked in academia. I have, as a contract researcher rather than a sys admin, but universities are pretty weird places to work. Hence the advice, which sounds a bit crazy to those of us in the Real World, actually makes sense in the context of academia.

use these...

[imsmith]

it's not a short-term solution, and it won't work in research facilities quite as easily, but as you replace desktop PC's, replace them with thin-clients. There are many kinds, they use many OS's, they are cheap, easy, and practically bulletproof, and they save you money (once again, in the long run) on licensed application fees.

I like these ( http://www.sun.com/sunray/sunray170/index.xml ), but any system will do.

Finally, they return actual control over the desktop to central IT, while preserving the illusion of control in the consumer of information's experience.

Just Say Yes...

[4of12]

how do you limit a user's access without making it look like you're limiting their access?

Start users without dangerous guns they know nothing about.

Then, if they ask for access, say you'll be happy to provide them with access if they sign this responsibility form you need to keep on file to cover yourself. Load the form up with I have read and understood my responsibilities, etc.

You can mumble something about how you need to do this to keep out of trouble after another user asking for access that wasn't nearly so responsible as Professor Bigname ended up with a machine serving child porn and a nightmare investigation....

Re:Dear Slashdot,

[WhatAmIDoingHere]

I like ask slashdot, asshole, I just don't like how it is becoming a way to say "Please do my job for me because I'm a complete moron and cannot do it myself" read some of the previous ask /.'s and check for yourself. "How do I set up *blah* at my work?" "How do I get *blah* working at my company?"

If you cannot do your job, leave it and let your place of employment get someone who can do the job.

Uphill Battle Ammunition

[bolix]

Don't blame the users, part of your complaint is poor user education(!). You know its bad but your users don't. Build and document exactly why you want the user to be secure and why it is a good thing for EVERYONE.

The following suggested discussion points are in no particular priority:

1. Have the user sign a document assuming responsibility for any legal liability
2. Have the user sign a document absolving you/IT/Corporation of any responsibility
3. Have the user sign off that you're not going to give their non-standard box priority. Custom solutions require expertise and your best fit, economy of scale is to standardize on "bricks" AND not to shit them when Chief Asshat calls
4. Have the user technically justify their reasons for the request
5. Have the user sign off that they know and recognise what they are doing is against company policy
6. Research, document and educate people to the costs behind their actions - emphasive individual desktop customization/attention is prohibitively expensive. See other bullets for ammunition.
7. Scale the lockdown. Try Power User. Try stripping rights. Give them a gun with no bullets
8. Emphasize your expensive security efforts are concentrated at the network level and based on users not shooting themselves (or the company) in the foot
9. Emphasize that users are their own worst enemy, you're trying to protect them from themselves - the dumbed down modern spyware/viruses use user rights
10. "Encourage" users with administrative rights to attend a responsibility/learning class/session.
11. Use what you have put together to educate YOUR management. The pervasive executive buddy system is fiscally irresponsible and leads to spineless management
12. Go surf the NSA website. Lots more info there.

Re:Uphill Battle Ammunition

[giucmo]

I agree. It's all about educating the end-user about how their computer use affects all of the computers in the network. It's the people, not the technology. They need some type of Security Awareness training, mandated by you, if possible. Once they learn the problem can be solved by their own actions, your job becomes easier. http://securityawareness.blogspot.com Greg Hoffman, CMO, Interpact

Re:Uphill Battle Ammunition

[Anonymous Coward]

Have the user sign a document assuming responsibility for any legal liability

Good luck. What was that phrase again, "never sign anything without having a lawyer read it"?

Have the user sign a document absolving you/IT/Corporation of any responsibility

I assume this is going for a "funny" mod. IT department shouldn't be responsible for IT?

Have the user sign off that you're not going to give their non-standard box priority.

There is such a thing as a "standard box"? C'mon, no two people are even going to agree on the best text-editor (and do you want to be the one increasing everyones' costs by 20% for non-optimal tools?)

Have the user technically justify their reasons for the request

Ah I see. A beaurocracy. Can't have too many of those.

"Have the user sign off that they know and recognise what they are doing is against company policy"

Such a piece of paper will never be signed, by anybody. Think about it. And when projects fail, the people involved will be telling everyone who listens that "they're still waiting for IT to install the necessary software"

Re:Uphill Battle Ammunition

[bolix]

This is fun. Take comments out of context and attach immature snide remarks. Hold on, this is Slashdot!

"never sign anything without having a lawyer read it"?

Exactly, thats the whole point, the users irresponsibility has legal implications. Indemnify yourself or educate the user to their predicament.

IT department shouldn't be responsible for IT?

An IT department is responsible for the components of the infrastructure over which it can exert control. Thats the whole point. Trim the fat. Its called an SLA. Everything else that doesn't qualify for support gets pushed to the bottom of the pile if it gets addressed at all.

There is such a thing as a "standard box"? C'mon, no two people are even going to agree on the best text-editor (and do you want to be the one increasing everyones' costs by 20% for non-optimal tools?)

Pure comedy. You want to support every hardware and software and are going to mention costs? Sound financial practice encourages efficient economies of scale. Laissez faire technocracy applies wonderfully in theory however in practice it disregards the functionally clueless. Empowering the clueless is leads to dramatic diminishing returns.

Ah I see. A beaurocracy. Can't have too many of those.

And you're alternative is? Ah, i know, lets wait for better written software. That'll be along soon. In the interim, bureaucracy works.

Such a piece of paper will never be signed, by anybody. Think about it.

Thats the fucking point. Since you're in the mood, heres a couple more related aphorisms "Speak softly and carry a big stick" and "The nail that sticks out gets hammered".

And when projects fail, the people involved will be telling everyone who listens that "they're still waiting for IT to install the necessary software"

Hold on, anyone who blames their tools or forgoes to work to facilitate those tools will blame anyone within finger-pointing distance. Sloppy work habits will kill a project irrespective of whatever wareztool asshat devleper can't live without. No i know - lets let them do whatever they want. I'm sure we'll all benefit from more badly written software or insecure desktop. I want more spam!

Re:Dear Slashdot,

[Short Circuit]

It's easy to find a way to do something. It's not easy to find the best way to do something. Which is why people will often ask, "What's the best way to ___?"

As an example, look at one of my questions posted to USENET. Look at the solution I came up with, then look at the solution I was presented with.

Time committment underestimated

[justanyone]

I've taught a discussion section of Physics, "Intro to Astronomy" at University of Kansas. I wasn't paid, I took the teaching as a class, Physics 571 Astronomical Instruction. It was a fantastic class to work on, Dr. Steven Shawl was a kickass 'boss' as well as teacher.

Writing a good test takes about 10 times longer than taking it. You have to:

• Come up with plausible misconceptions as alternates;
• make the questions cover stuff reasonable students should understand given the exposure to it;
• Make the questions somewhat entertaining to read if possible to induce people to not dread the tests;
• Create sets of questions that cover basics, medium, and advanced subjects so you make sure the C students can pass but not everyone gets A's
• the breadth of the questions has to cover the breadth of the classroom topics reasonably well

Grading tests (even multiple choice, but especially essay questions) involved reading all the tests, deciding what the scope of the answers was so you don't fail or Ace the entire class or bias the grading of the first papers you grade, etc.

Things change in Physics all the time, and a teacher who doesn't adjust the curriculum to their students will disincline their students to ever study the subject again - which I believe is one of the three goals of education:

• Give them a theoretical framework of basic concepts they'll use the rest of their lives;
• Give them enough knowledge to (a)back up the above framework, (b)Prepare for further academic study, and (c) inspire them to regard the subject as interesting and worth future study for the rest of their lives.

Of course, this is usually impossible, but a good teacher would probably echo these concepts in formal 'Educational Methodology' language.

-- Kevin
"Soon to be laid off from BankOne due to JPMChase Merger (don't want to move to NYC); looking for a Perl / C programming in Chicago Northern Suburbs - know of anything? Hints? Email me, kevin@justanyone.com with 'job' in subject line (due to spam filter)"

Re:Time committment underestimated

[bluGill]

Note that I was very careful to specify tenured professors. For those who do not have tenure there are more teaching duties, and they have less experience teaching, both of which lead to far more work. Once you have been teaching for a while, you have a good handle on what works, a good drawer full of tests that you used last time (Good professors will modify this old tests), and experience on grading tests fairly.

Of course as a tenured professor you are expected to spend most of your time in research, but you have a lot a self direction in where you research. Being a professor isn't easy, but it should be a case of the very smartest people spending a little time teach and a lot of time researching what they love enough to research even if they had to work a different job. Many of the research expenses are paid out of a budget other than the pay check, so the money goes farther.

Give up.

[Neck_of_the_Woods]

Just give up, and fix it when it breaks. Go Back to playing World of Warcraft in the corner cube where no one can see your screen.

Hate to break you away from the 23rd level warrior.

--honestly--> Your boss's problem, not yours.

Learn to say "no" to Linux?

[bcrowell]

Explain to them that security is inconvenient and that they have to be adults and accept it. It's your job to secure the network and it's their job to teach the students...
So you want them to act like adults, but you treat them like children? Adults have adult responsibilities. Cars don't have safety features that keep them from going more than 35 mph. Instead, we have driver's ed classes, driver's licenses, penalties for speeding, penalties for drunk driving, etc.

The best solution to security problems is to educate users. Most people are not slashdotters. They don't do this stuff for fun -- for them, computers are just a tool to get the job done. Considering what a black art it is to keep a Windows box secure, it's not surprising that they don't know how to do it competently, especially if nobody has made an effort to educate them.

I teach at a college. Talking to my colleagues in the hall (who are all scientists, but not computer scientists), I hear stuff like this:

• I got my AOL account hacked, but I don't understand how, because my password was my dog's name, and nobody knows my dog's name.
• I don't worry about security on the machine on my desk, because it doesn't have any information on it that I need to keep private.

To the slashdot crowd, these comments may seem stupid, but the people who said them are smart people; they're just not computer security experts.

I actually submitted almost exactly the same Ask Slashdot recently, but from the prof's point of view. The network admins at my school want to block people from connecting their own machines (laptops brought from home, etc.) to the campus network. In other words, if you want to hook up a computer to the network, it has to be a Windows box provided by the administration, that is locked down so only they can administer it.

Wake up, folks -- that means no Linux!

Is this what we really want?

You also have to realize that security is not an absolute. You have to pick the level of security that is optimal for you. At my school, the only school-provided computers that you can use without an account are in the library. This is required by agreements we have with other schools -- people are supposed to be able to go to a different school to use the library, and have full access. This is entirely appropriate. Well recently, we had an incident where someone sent a death threat via e-mail from a machine in the library, so the network admins want to require an account to use those machines as well, violating our agreements with other schools. I'm sorry, but the incident isn't an indication that security was too lax; it's an indication that the internet is fundamentally an anonymous medium.

It's also worth pointing out that network admins are not perfect either. In the room where I teach physics lab courses, we have 6 Windows machines provided by the school, plus a FreeBSD machine I brought from home. The Windows machines, which are maintained by the network admins, have been infected by worms twice within the last year. My BSD box, strangely enough, was unaffected :-)

Re:Learn to say "no" to Linux?

[fmaxwell]

So you want them to act like adults, but you treat them like children?

No, treating them like adults is informing them that screaming and whining like children isn't going to get them root/administrator access and that they have to behave like adults and work with the IT department.

Adults have adult responsibilities. Cars don't have safety features that keep them from going more than 35 mph. Instead, we have driver's ed classes, driver's licenses, penalties for speeding, penalties for drunk driving, etc.

Cars have a handful of controls which perform obvious functions. Computer interfaces morph constantly and there are uncountable buttons, check boxes, drop-down menus, and applications that can change the way that a computer works. And there aren't people all over the world trying to sabotage their cars.

The best solution to security problems is to educate users. Most people are not slashdotters. They don't do this stuff for fun -- for them, computers are just a tool to get the job done.

And that is precisely why they won't pay any attention. It's like trying to teach the average person about the inner workings of their microwave oven. They won't pay any attention and most will just walk away.

You also have to realize that security is not an absolute. You have to pick the level of security that is optimal for you.

I was the architect on a system which got a C2 evaluation and headed up the team producing it. I just came back from IBM today where I was talking with some of the top computer security people in the world. You aren't exactly inundating me with new information here.

Re:Learn to say "no" to Linux?

[Glonoinha]

In other words, if you want to hook up a computer to the network, it has to be a Windows box provided by the administration, that is locked down so only they can administer it.

Lock down your DHCP server to only give IP addresses to registered MAC addresses. Granted you need to do a little work up front, but a lot less work long term.

Disclaimer - I know how to do this off the top of my head for the wireless router I have a home, not entirely sure this is possible with home-grade commercial wired routers w/ integrated DHCP servers. Then again, wifi connections have gotten fast and cheap, and locking wifi down by MAC address is a no brainer even on the cheapo home hardware.

good ideas above, a few more things

[davidwr]

Lots of good ideas above this post.

Here's another suggestion:
Ask them precisely what privilages they need. In MS-Windows, there are many, many, privilages that you can add and take away individually.

Do they need to set the time? fine.
Do the need to manage printers? fine.
Do they need to ghost-image their drives? fine.
Do they need to make file-by-file backups of everything? fine.
Do they need to install oddball software without bugging you? fine.
Do they need to install system-monitoring software for experiments? fine.
Except for the maybe the last one, none of these requires full administrative privilages on a Windows box.

If the privilage they want is "dangerous" in any way, make them demonstrate competency before you give it to them on a long-term basis, say, 1 semester or the duration of whatever project they need the privilages for. Give them a class in administration if you have to.

If they only need it for a short time, give it to them for a week and offer to back up their machine first. If they turn down your offer, they are on their own if they lose data when you re-image the box.

For *nix boxes, sudo with detailed remote-logging of sudo-usage helps. I'm not sure, but I think Windows-box security logs can similarly be sent to a remote machine.

Technically-minded professors, such as those in computer engineering, can generally be trusted with additional privilages, but they too should be required to prove competency.

You will have professors that need to set up a "private network" that they can run and administer. This is fine and dandy, just put a good firewall between you and them, preferably one that watches for viruses-in-transit or other suspicious behavior. If they need access to parts of the university network from inside their private lab, give them only what they need and nothing more. If they don't need campus-level access but do need Internet access, give them that.

In any case, abuse is a "one strike and you're out" proposition:
If you share passwords that aren't meant to be shared, run programs that are not supposed to be run, or otherwise engage in deliberate activity that harms the network, I'll boot your machine and/or change the password until I have a nice chat with you, your boss, and your boss's boss. You'll sign an acknowledgement that what you did is prohibited, and my boss will get a copy of it.
If you are merely careless, I'll just yank the privilages and if necessary disconnect your machine.

Re:good ideas above, a few more things

[Anonymous Coward]

Could you enlighten everyone as to a source regarding how to provide these fine-grained access controls under Windows? I am very interested in the topic but it's almost like the people who talk about it here don't want to elaborate. Not sure if it's a job security thing or if it's actually more complicated than it sounds.

Teaching isn't even all of the time committment...

[CaptMonkeyDLuffy]

Teaching is only half of a professor's job anyway... Research, papers, projects, whatever is appropriate given the field of study the professor is involved in, that is a full year job for a majority of professors.

And this isn't just an issue at big 'research factory' universities. It's that way at pretty much all colleges, and in pretty much all fields. The idea that professor's only work during the school year is pretty much a 'common myth.' Shoot, it might even be arguable that in general a professor's primary job is the reasearch work, not the teaching(that is certainly the case at some schools, though not necessarily all).

Demonstrations work well

[greywar]

When our new IT person started here the first thing she did was change all our passwords and educate us about not giving them to everyone.

She demonstrated this by #1 running a password geussing program, and showing how easily it geussed our passwords.

Then #2-she asked me for help. Using social engineering I managed to get the login and password of someone at our other division. This person has access to all the payroll records.

Imagine the chaos if everyone was sent a copy fo what everyone else was making.....

They must understand...

[SI285]

The letters PhD does not give them the right to put other networked systems or the confidential data they are entrusted with at risk.

Remember what happened at UC-Berkeley? Over 600,000 residents with their personal information compromised because a researcher did not follow procedure and patch their software (I think it was Oracle and a patch was available).

Many times academic/research systems paid for by grant money are not known to central IT until the system is compromised, a situation that could have been completely avoided if the researcher had asked for their systems to be checked by IT personnel. Unfortunately a PhD does not like to be told what they can and can't do...until their system is compromised and blocked from network access.

While many professors are very well educated with respect to the application software they use to get their work done, they seem to have very little if any knowledge of basic system security. Having said that I will now say not all PhDs are like that and it is a pleasure to work with them because they understand.

It's too bad that in most cases a PhD + computer = compromised system

Better Yet

[BoomerSooner]

Just realize because these academic types will always need you, your job is secure into the forseeable future. Everyone should be so lucky.

Are you using Active Directory?

[sydbarrett74]

Use group policies. There's a wealth of settings you can change to give users very fine-grained control over their machines. That way you allow them to do exactly what they need and no more. Principle of least privilege, dude.

You aren't god.

[Kris_J]

I'm a sysadmin. I am not the most senior person in the company. While I can suggest levels of security to better safegaurd data, if someone more senior than me wants to be an Administrator on their local PC, they're more than welcome. In fact, all my users are automatically setup as Administrator on their local PCs, or else the database app we use doesn't work.

Where I work, everyone is responsible for the security of the company, and everyone is trusted within their own area of expertise. Occasionally someone screws something up, but that's what backups (and a whole heap of data integrity reports) are for.

Re:You aren't god.

[Anonymous Coward]

Wow. Your company must not make anyone mad. Your company must also have the best HR people on the planet. Sounds like you've found a great place to work, because your company is the exception, not the rule.

You're scaring me

[Roadkills-R-Us]

You lost me when you said they "go weeks without rebooting" as if this was a *bad* thing...

Icon Changing

[ClemensK]

Well if they are kind of stupid you could change the icon of firefox to IE and say it was an IE upgrade from microsoft. But they might see Firefox at the top but oh well. Why must they use IE anyways, you can import everything from IE to Firefox...

Educate them...

[vwjeff]

I work in a similar situation as a K-12 sys admin. When someone has a problem with spyware, virus, computer not plugged in (I get this call at least once a week) I try to educate the user. I sit down with them for five minutes and offer basic computer usage advice. This usually includes: When you get an email with an attachment do not open it. First either call the sender or email them back and ask if they sent the attachment. I try to convert them to Firefox for web browsing but they still must use IE for taking attendance (damn ActiveX apps) Not my decision BTW. I always tell them that fewer programs on a computer means fewer potential problems. Many of our users insist on having Webshots installed (a wallpaper program that when said aloud makes me flinch) and Weatherbug (because it is too difficult to go to weather.yahoo.com to view the weather.) I show the user how to change their desktop picture and create a shortcut to Yahoo weather on their desktop. I have found this to be the best way to reduce the number of calls I get. Sure there are a few users who refuse to take my advise and I respect that. All that means is that I take their computer back to the shop and work on it "when I have the time."

Rebuild

[Liam Clancy]

If you can't get around staff wanting / needing local administrative access then spend your time developing a neat SOE. If a support call comes in and it is determined that the issue is local to that workstaion then simply rebuild. Regards, Liam.

But s/he'll still have to mop it up

[Nomihn0]

Sure, s/he won't be legally responsible if the document is written properly, but s/he'll still be the person hired to clean the network afterwards (for no additional pay, I assume).

Re:But s/he'll still have to mop it up

[lachlan76]

If data is stored on the servers, you can always just re-image.

no, no, there IS a difference

[RMH101]

my partner manages IT for a law firm. here you have senior lawyers who are partners - they literally do OWN the firm. what you don't typically have is IT representation at that level - the partner says they want to, say, dial in from home or access their mail from cybercafes, and you then have to nicely point out that it's not really all that simple and you've got to nail security first.

in a corporation, you typically have an IS organisation that has clout at the highest levels - in parallel to your other management structures.

basically, it sucks ass, but it IS different...

SIS without ie and activeX?

[Anonymous Coward]

our schools are now on SiPS: http://www.pearsondigital.com/sips/.

mozilla, firefox, safari offically supported for all parts.

It has a good attendance system and reports and the rest is nice too.

Senior management support

[gwiner]

All the technology in the world will not fix your issues, if you keep getting beat back by politics and demanding customers. The REAL key to stopping these problems is ensuring you have the support of senior management. If you bosses will back you when yelling department heads ask for higher access, you'll quickly see things change.

Write good, sound IT policies, explain the pros and cons to senior management/CIO, spell out the risk to your org, and your sure to get support. They have to be willing to make the tough calls though, or your doomed at the start.

At the company I work at, it is a condition of employment to comply with IT security policy.

Support from IT management

[prefect42]

If you're getting unreasonable demands then someone needs to back up your reasonable position. You can't do things like let the security lapse to prove a point. If you need a certain level of access control, then maintain it.

If you receive undue complaints from Professors, it's not your duty to bow to them, but make sure they're known by your (IT) seniors. If you *are* the IT senior, then you've got to deal with the problem by explaining your position. Agree to as many meetings as they want, but don't back down unless you decide they've got a point.

But do accept that they might have a point. You can degrade a system's usablity by making it secure. I know some people would say that there's no such thing as over secure, but...

Re:Dear Slashdot,

[goatan]

So whats wrong with asking? that's how you learn. It's idiots like you that ensure reduced learning and understanding.

Re:Dear Slashdot,

[goatan]

Your arrogance is outstanding. If you think you know everything about your job your (it doesn't what job you do) wrong. Also there are many ways to get the same result some work better than others in different environment. The people who ask these questions know a lot more than you, for a start they know that they don't know everything where as you seem to think you do.

If you cannot do your job, leave it and let your place of employment get someone who can do the job.

Your lucky you don't work for me as I would relive you of that decision and fire you, why would I fire you? Because the biggest mistake you can make is to not know something and not ask and as you think you know everything you would never ask or even discuss with someone if a new problem came up, you can not do your job.

Lock it down.

[Raven42rac]

It's your network, they are the user. Do you have and documentation relating to network access policies? Normal users need very little access to things. The rest is just to make themselves feel important. Once you have everything wide open, it is very difficult to reign it in. Good luck.

Security from the top down

[macdaddy]

If your employer can't pull their heads out of their asses long enough to comprehend how much security lapses costs them each year then you need to find a better place to work. It's as simple as that. I don't care what the job market is like. Staying in a position like that is tantamount to continuing to working for someone that asks you to do a job knowing you'll have to break the law to do it (not saying that lax security is against the law (perhaps it should be) but I am saying that the effects are of an equivalent degree IMHO).

That said security initiatives must be supported from the top down. Your university president must understand the financial hit lax security is to the university. He must support a security initiative and push it down to the provost and deans' council. It must be made absolutely clear through all deans down to the people that work beneath them that there is a university security policy in effect and it will be followed. Violation of which will result in repremand, possible loss of network privileges, and can ultimately result in termination. This is the only way to get the message across. I worked the helpdesk as a fairly large unversity for 3 years and have seen it all (or pretty damned close). Whenever an employee becomes beligerent you pass the person up the food chain to your supervisor or another full-timer. We full-timers aren't there to take any guff off other bitchy employees (whereas students are much less likely to defend themselves against a verbally abusive professor; students are also much more likely to be walked upon by professors than full-timers). "We don't make the official campus security policy. The university president and his advisors do. We're here to enforce it. Now do you want to pick your password within the established security parameters or would you like me to generate a random one for you?" I can't recall how many times I had to do that or saw it done myself. If you couldn't get through their thick skulls you called your IT department's director who in turn called the provost who in turn called the dean over that professor department who in turn called that department head who told the professor what for and why not. Let the chain of command fight the battles for you when the combatant is equal to or above you. It might as well be useful for something.

That university established basic security procedures for changing passwords. It was a mandatory password change every 6 months for faculty/staff and every 12 months for students. If the passwords weren't changed by the well-advertised cut-off day then the accounts were locked. The first couple of times the cut-off date was passed we had lines out the door, across the library and down the stairs. That didn't last for very long though. Sure people bitched and moaned about the inconvienance for a while but they soon grew accustomed to it. Likewise sharing passwords violated both our security policy and our campus network AUP. Violating that got the user a royal reaming by a sysadm or full-timer.

I worked for a second university later where I was the netadm. Napster was a big problem for us at that point and time. A handful of users consumed all available inbound bandwidth. Staff weren't excluded. After bringing this to the attention of our dept director a few times I ultimately got the go ahead to shut off the port of any staffer previously warned about using P2P applications on their office machines. One guy in particular had a very thick skull and I shut him off numerous times. Each time I'd let the director know; he would in turn call that person's super and let them know what the problem was and what was needed to correct it. I'd get a call a while later asking me to enable the switch port because the problem was fixed. Simple as that. The chain of command fixed the problem. All I was effectively was a tool, the way it should be.

What all of this boils down to is that it is possible to get security on your campus. I've seen it done. First and forem