Has Corporate Info Security Gotten Out of Hand?

KoshClassic asks: "What is the right balance between security and productivity, in the corporate IT environment? Looking back at my company, 10 years ago, our machines were connected directly to the Internet, no proxy, no firewall, no antivirus software. Today, my company's proxy server blocks access to: 'bad' web sites (such as Google Groups; our 'antivirus' software prevents our machines (even machines that host production applications) from carrying out legitimate functions, such as the sending of email via SMTP; and individual employees are forced to apply security patches with little or no notice, under threat of their machines loosing network access, if they do not comply by the deadline. On one hand, you can never be too secure, however on the other hand, have we become so secure that we're stifling our own ability to get things done? What is the situation like at other companies?"

Comments

It's all possible...

[jabella]

Security like most things, is a balancing act. Being able to manage the 'pain vs. protection' factor is the key to all of it, and unfortunately no tools seem to have the sliding adjustment with those options on it.

Ideally security will allow everything that's vital while not stepping on any services that are required. With most companies, what is 'required' ends up being pared down as the security net gets closed down tighter.

Nostalgia is one thing -- how many of us worked on systems that had telnet / ftp open to the outside without a firewall? I know I did back in the day. When management is behind security initiatives, being able to work on the business isses ("No, we CAN'T disable FTP!") becomes less of a problem.

Regarding individual workstations -- putting the burden on end-users doesn't seem to be a common (thankfully) configuration in the companies I've seen. Most larger places are doing automated patch management and deployment now. I know quite a few places where every single system (desktop and production) is patched within a 15 day window. While it's not bleeding edge, this relatively fast schedule combined with the concept of 'defense in depth' goes a long way to preventing issues. I know places that haven't lost a machine to a virus in YEARS.

Security that's preventing legitimate work from being done needs to be adjusted. All of the problems you've mentioned are fixable.

Re:Technology

[CleverFox]

Being a corporate IT security at large corporation I can tell you why google groups are blocked. If I am looking at porn on alt.binaries.erotica and a female co-worker walks up behind me she could sue for sexual harassment and say the company did not take adequate measures to prevent this situation. Basically they fear a lawsuit.

Re:Management?

[canuck57]

The only real problem is overzealous proxy servers, ...

Not really, often it best to deny, evaluate and permit with business cause. Provided the response is usually positive where the business need is legitimate then their is not an issue. Any security system will need to be tuned to work correctly. And often users fall into the trap of buying products that abuse protocols to circumvent security without regard to company policy.

The enemy within is in my experience a 50/50 split with the enemy outside. These tools are needed to prosecute criminal and negligent employee behaviors. Some examples I have freequently seen:

• Insider trading of company secrets
• Posting of internal information on Yahoo and other board and mails services
• Had a manager watching video porn consuming the network bandwidth while he was bitching at I/T because the lines were slow and the clerks could not do order input.
• Much like the last point, the clerks will call while they are all listening to the radio and complain because the servers are slow... they don't understand nor give a damm that 100 people in an office listening to radio designed for 1 cable modem drives costs up -- they don't know how dumb they come off to I/T. And their managers didn't have the spine to say no.
• Had one more advanced user who bypassed the proxy with a VPN type software using SSL. He thought he would not be noticed so we watched his terminal. He was using file shares relayed from his home system and watching, you got it - porn.
• Caught one person posting personal comments about the CEO on a message board.
• Figured out which user posted the companies address book right onto a known spammers web board as it would be "more convenient".
• Had one one user who used their internal priveleges to load seti on 12 shared UNIX systems. The company thought their CPUs were slow and were preparing to buy more.
• Had one internal developer who back doored some applications for stuff I can't say, but cost the company a million to clean up.
• Had one case where every Windows server bar none was compromised and controlled from the outside. The real kicker is that the systems were compromised from the inside and then controlled from the outside to serve Warez. Got my first copy of W2000 before it was released!
• Had one user who would run a "spam" program while working on his PC. He was caught because the companies domain was blacklisted.
• and many more...

So remember this when you bitch about security. The behavior above was detected by security tools. And this type of behavior in corporate America costs companies lots and reduces the security of your job. Security is to enable you to do your job AND is there to prevent the 1/100 bad asses from getting inside to do your company harm. And the opposite is true, to prevent the 1/100 bad asses you have hired from compromising your company.

And if you don't think your threat exists from the inside, your either a very small trustworthy group or your just not looking.

Bureaucracy at its best.

[IAAP]

hy are people who don't comprehend - or can't communicate - this employed in an IT organization??

You sir, need to accept the bureaucratic nature of large organizations. There have been a few times that I've had to do some really asinine things in order to keep my job. I knew it was bullshit, my coworkers knew it was BS, and the poor SOB on the other end really knew it was BS. But, if either strayed from policy it was our asses. Why was this policy in place? Because the higher ups didn't want to take the time for all of the inevitable exceptions that occur.

The solution? Acceptance - Zen practice. Or, start your own organizaton - if possible. Entrepreneurship!

There's a reason why small companies are the ones that are creating most of the jobs. There's a reason why small companies are the innovators. There's a reason ... you get the idea.