Slashdot Mirror
Reducing The Negative Impact of Laptops
Mark Brunelli wrote to mention a SearchEnterpriseLinux column about reducing the negative impact laptops can have on a network's security. From the article: "Portable computers often become an extension of the person using them. It is no surprise that laptop users are inclined to be rather autonomously minded. Many users don't realize that the power they have to install software and change settings is risk prone. Fortunately, larger corporations that install Microsoft Windows XP Professional usually don't grant the laptop user full administrative rights. The same cannot be said of smaller businesses, many of which simply purchase laptops from the local store -- laptops pre-installed with Windows XP Home Edition. "
to install XP Pro on any buisness machine? seems silly to let the user install his/her softwares on the COMPANY laptop
Muzik.4.Machines
Until recently I was involved in administrating a linux server on a network of windows workstations. The server primarly operated as a gateway to the internet.
Every now and then some horrible worm would get lose on the network and fill the internet connection with crap. I would get the blame for it of course (internet not working).
Outbreaks were correlated with a particular individual coming back to the office with his laptop after working elsewhere. I think it must be something about the way he uses that system; what sites he goes to, probably; which causes it to be so riddled with viruses.
I am not managing that system any more. Good riddance. The versatility of laptops is letting them down in this instance. If the owner is a bit of an idiot no amount of management will keep them out of trouble.
http://michaelsmith.id.au
I have to agree... Everyone always brings up 'switch to Linux instead!' when you mention Windows security problems. That's great in theory, and I'm sure your network admin might actually do that. Then again, he's probably not the one bringing the virus onto your network in the first place.
The real world situation is that people are idiots. They can't even use the big pretty blue buttons in Windows XP, much less Linux. If they don't know that the big Novell login screen with the buttons saying 'Press Ctrl + Alt + Del to begin.' is telling them they should press those keys to get started, what chance is there they'll know what to do with one of the somewhat useless messages Gnome generates when an application crashes? (And yes, that most certainly was a 100% true story... I shit you not!)
Besides, I know our company builds their applications from scratch. While we are moving more to a web-based application model, we still have 95% of our programs written in Delphi, and even support a legacy DOS-based system. There's no way we'd get all that ported to Linux any time in the next 2 years, even if we dropped everything until it was done.
The point is, stop suggesting the supposedly "ideal" scenario that no one will ever be able to obtain. We're stuck with Windows (at least for the time being anyway), so we may as well focus on THAT problem and try to do the best we can with the tools we have. Let's worry about keeping Billy the marketing Intern from bringing Klez onto our network first, and THEN worry about changing the world later...
As a small business IT support guy, I see this all the time. Lawyer X or Dentist Y grabs the latest laptop deal from Dell, brings it to work, and finds out he can't connect to the 'server', which either leads to some kind of limited workaround or an overpriced 'upgrade' to Pro, both costing them money (my time or a sticker, registry fix + more of my time). I'm always telling clients to ASK ME FIRST before buying something but as anyone in the same business will know, that can be rare.
Please stop APK.. you're only hurting yourself.
From the top of the article: In any network setting, laptop and notebook PCs can pose special security risks, particularly those running Microsoft Windows XP Home Edition...
Like I mentioned once before, the default setting for users on windows always administrator which automatically lowers your armour. After that, using internet explorer, you visit a greek jokes website that installs an ActiveX control on your system. The activex then downloads its friendly spyware and adware, and they in turn continue feeding on your bandwidth and cpu power by repeating the process. While they are doing this, these programs discover they are able to modify the registry and are also able to change settings so they run as soon as windows boots up!! How exciting. You are fucked, my friend!
From usenet: The primary shortcoming in Linux is that it retains the concept of a "superuser". If someone can manage to get themselves logged on as "root", then they have the keys to the kingdom. Now imagine what a malicious demon will feel when it finds itself running under Administrator inside a Windows machine!!!
I'm involved in a 'new technology' pilot for the IT department in my company, a Fortune 100 presence, and they're looking to force this down our throats. I'm a consulting network engineer, and I have a distinct need to be able to install a very large suite of custom applications, as well as make changes to network settings, etc. as part of my daily work. I can understand the potential security risks, but if it makes me unable to do my job producing revenue for the company, it's an unacceptable change.
I will fight this, because users need rights too.
You are both missing the point here a bit. The discussion should be focused on business machines. IMHO employees workstations should be configured to allow them to do their job. (thats a period at the end there) Anything else in Windows invites time wasted by the employee screwing with things they ought not be screwing with, and time wasted by admins cleaing up after them.
Ever seen a help system for a Linux distro?
Well, there's that little red-and-white lifesaver icon. That'll bring up the help system in Gnome or KDE. Then there's the speech bubble with the ? in it, that'll give you context-sensitive help. Or you could just start the KDE help center app and search in that. Or maybe you could open a terminal and type "apropos " and Linux would tell you which commands are relevant. Then you could type "man " or "info " and get some compact reading material. If you're still stuck, you could look into whichever distro you're using's forums. People there are almost always ready to assist. Or you could pay for commercial support - plenty of people willing to take money for tech support. Then there's http://www.linuxhelp.net/, which seems quite, umm, helpful. Typing "linux help" into a search engine will give you just under two hundred million hits to look into too - maybe one of those might be useful, do you think? Of course, for the traditionalists, there's always usenet. If you log onto any of the several hundred groups devoted to the various flavours of Linux, there just might be something to look at perhaps? Or maybe there's a local Linux User Group you could phone and talk to a real geek.
Apart from that, you're right. Linux does really leave you high and dry.
"I've got more toys than Teruhisa Kitahara."
Most computer users are not qualified administrators, in fact many of them are borderline computer illiterate. This isn't to say these people are dumb, they're just not very computer savvy. Such users tend to be able to use software they've been trained on or are familiar with but aren't likely to know exactly how it works. They click an icon, type in some values, and things happen. They don't need to know or care that the app is just a VB SOAP client talking to a web service via SSL hosted on the company's server farm. The guy down the hall in accounting needs to know how to do stuff in Excel, not how to write Excel.
That being said, these people aren't necessarily qualified to administer their own equipment. Some might have a bit of technical prowess but a majority of normal users are just that. So why are they put in charge of managing their own equipment and why are they able to take company information and property with them to get stolen or dropped down a flight of stairs? If they've got light communication needs how about Blackberries or Treos or some other connected devices. Quite a bit can be done through secured web interfaces or through web services with lightweight front ends. A little bit of well designed caching and users would be hard pressed to notice the company's database didn't exist on their little handheld device.
This approach isn't going to solve everyone's problems but it works for some in two major ways. The first is any single field employee can't take the sum of a company's data with them somewhere to have it hijacked by either action or omission. They're also not terribly likely to plug into an office machine and infect the whole network with some new Windows worm. A lost PDA might mean the company is out a few hundred dollars worth of equipment and maybe some confidential documents. A PDA that runs only application/web service front end software is really only out the value of the lost hardware.
If you've got responsible users you can probably trust them with full fledged laptops. For those that are almost more trouble than they're worth, give them cool gadgets they can work on but do limited amounts of damage with. This is of course in addition to better network security in and out of the office. If you've giving even advanced users a laptop to take home let them only take with them the data they absolutely need to get their job done. You don't want a laptop with 98,000 personal records on it stolen or something.
I'm a loner Dottie, a Rebel.
I'm a sysadmin. All Mac OS X and Windows notebooks I deploy are preconfigured, tested, verified, and locked down. Even Classic.
If any special apps or hardware is needed, it has to be dropped off during the "preconfigured" part of the process.
The truth here is you are being furnished with a portable workstation, not a personal surfboard.
Nine times out of ten, when some one pages/calls their IT department at 2am because their laptop broke, it's because they were doing something they weren't supposed to do, like install personal software and hardware.
I'm sorry, but if you call me at 2am because installing Flight Simulator broke your machine, and now you can't do your PowerPoint presentation (the work task at hand) I'm going to laugh at you, hang up, and report you to my boss.
Up, Up, Down, Down, Left, Right, Left, Right, B, A, START
It's a fundamental rule of systems engineering that workstations are part of the user, not part of the system. This is especially true of laptops.
Any sysadmin that thinks limiting user privileges on the workstation is solving a security problem is fooling herself. System security needs to be set up on the assumption that all workstations are hostile.
I'm a Programmer. That's one level above Software Engineer and one level below Engineer.