Surely I am not the only one on here who has all of that information memorized.
9381 7190 4632 8755
Expiry 08/12
CVV 819
See? Impressive, huh?
Wait a sec... oh crap.
Secure password policies. My workplace introduced this policy not long ago and it's clearly a bit of security theater. Sure, done properly it will work. But the reality is that when you are requiring a high level of complexity... high number of characters, capitals or special characters, people will start to write them down when they previously wouldn't have. In these cases, we now have effectively LESS security, as that password is potentially more available to intruders. It is an even easier method of breaking into a system than it is using a dictionary or brute force attacks, especially when a typical scenario would only allow an attacker a short period of opportunity to try and crack a password. This isn't to say that all strong password requirements are a bad idea, requiring just a single capital letter or a single number in the password would probably work just fine, but the notion that deploying a complex set of password rules will increase security is flat out wrong.
The same goes for applications requiring seperate credentials from those used to initially log on to the system. When you start to introduce even MORE usernames and passwords into the mix, it is going to greatly increase people's tendency to write them down.
Using a single set of credentials for everything and requiring only a minimally complex password, locking out the account after a set number of attempts would be the best solution, but of course in a large corporation the voice of the front line staff is rarely heard.
Not only is he responsible for what has the potential to become the next big thing in home computing, he also apparently is the webmaster of the site. If you were to go to http://www.medison.se/ and read the company history, you will find an image with a red X, which points to file:///C:/Documents%20and%20Settings/Valdi%20Ivan cic/My%20Documents/Medison/new/abouteng_files/10re d.JPG. I commend a CEO of such an innovative company for designing the corporate website. There are a few other small discrepancies in the site, but this seemed to be the one I found the funniest.
You think that's so bad eh? Well recently my cell provider changed the "new message" speech to: "one...new message...received...today at...10...42...am...from...6...0...4...5...5...5.. 2...4...2...4...first...new message". Yeah.
YMMV, but the organization for whom I work (about 13,000 users) usually buys from what I would consider to be a medium sized vendor (larger than a mom & pop store but smaller than Dell, HP, etc). There are a few benefits that I've seen to going this route. One is that our machines are shipped with brand name parts inside (Asus mobo, ATI video card, etc). Two is that the support is far better. The company is still small enough that I typically get the same person on the phone each and every time I call for support. They don't run through any scripts or force me to troubleshoot before sending me parts. I will tell them what I want and the parts get shipped out the same day or next. I've gone as far as having them set me up an account in their work order system which I can access online and enter my ticket without evn having to call. It's VERY convenient. In some cases, they will send more parts than necessary (ie, a psu, mobo, ram and video card) for a problem that I may initially think is related to just one of those components, so that I don't have to call and have them ship parts a second time, resulting in more down time. What I'm getting at is that because the company we are dealing with isn't huge and faceless, I am able to build a trusted relationship with their support department, and I can get things fixed without being jerked around.
We haven't always gone that route however. We choose our vendor based on a bidding process each time we want to purchase machines. It isn't always the same vendor who wins. Over the years we've had several different vendors, ranging from medium sized like the one I am currently dealing with, to big name brands like Dell. The number of problems with our custom-built-with-name-brand-part machines compared to the Dells that we purchased is huge. Other than a problem we are dealing with right now*, I rarely ever have component failures in our custom machines. The Dells on the other hand were such a support problem that I don't think we will ever buy them again. Almost every single machine we bought eventually choked due to swollen caps on the motherboard. It was like pulling teeth trying to sort out the problem with Dell. There is such a variance in the level of knowledge of their techs that I was hornswaggled. In one instance, the first time I called, the support rep ran me through a number of troubleshooting steps that I had already tried and we eventually terminated the call when no progress was made. When I called back, the conversation went like this:
Me: My computer doesn't work
Dell: Check the caps on the motherboard, are they swollen?
Me: Hey lookie there, yes they are
Dell: I'll send a replacement right away
To summarize, our medium sized vendor has provided a much higher quality product and far better support than I have seen from Dell. I encourage you to give that route some deep consideration.
* One of our recent batches of PC's had a bad batch of power supplies. I believe it was another case of bad capacitors. The vendor went as far as to ship a fleet of replacement power supplies so that when one died, we could take one from the fleet and replace it immediately without having to wait for them to ship a replacement.
I don't see a curious four-year-old being employed in any of their tests. I'd like to see how one of these stands up to crayons and peanut butter sandwiches. Also known as the curious CEO test
Our department has a security video that we use before we allow new employees to access our system. It covers basic computer security, and provides information on different level of protected information. After that, we give them their username and password on a memo that also contains a bunch of useful information for new users, such as how to access e-mail, and what the various network drives are for. Also on this memo are more security reminders. After that, we send them on their way. Anything else they need to know from this point would be application specific, and my assumption is that if the company has hired them, then they have already demonstrated that they have the required skills for the position, so I won't bother teaching them what they should already know.
Is it an advantage? Sure, of course it is. Is it an UNFAIR advantage? I would say hardly. I spend good money on high end gaming hardware (video card, monitor, sound and internet connection), I pay (and dearly) for the little advantage I do get, but because the other players may not be able to afford the same level of hardware, I don't see how that makes things unfair. If I was to race a Ferrari with my Honda, does the Ferrari driver have an unfair advantage? Of course not, he paid for the advantage that he gets. I still play the same game as everyone else, I just take advantage of every benefit that I can out of the game.
And as far as F.E.A.R. goes, I played it in 1680x1050... while the game may not support it natively, you can force most any game to play at a nonstandard resolution. http://www.widescreengamingforum.com/ is my best friend when it comes to games that don't support the res that I want to use.
I work for an organization that has > 10,000 Exchange mailboxes. How many more than 10,000 I'm not sure, a quick search would limit me to 10,000 results, I suspect the actual total to be about 15k. We have our mailbox default set to 100mb before we start issuing warnings, and at 150mb we prohibit the user from sending. At no time do we prevent users from receiving. If somebody was to hit their limit, policy is to increase their mailbox size by 10%, up to a maximum of 300mb. 300mb is the policy-limited maximum size, however the decision was made recently to eliminate the usage of PST files nationally, by importing them into the user's mailbox, in an effort to improve how we manage e-mail. The PST migration has resulted in some mailboxes being in excess of 1gb, throwing the previously mentioned 300mb limit out the window. I don't know how the company that the OP works for is laid out, but my organization consists of several regions, each containg over a dozen sites, with staff often moving from one site to another. When they move sites, we transfer the user's personal share to the new site's local server, and this becomes a bit time consuming when moving large PSTs. E-mail is managed nationally, so it made sense to keep all the data in one place, limiting the amount of data that needs to be moved when somebody goes to a new site.
These large mailboxes typically aren't a result of abuse, the biggest ones normally belong to senior managers, who never delete e-mail and often have several years worth of archives.
Slashdot Mirror
Surely I am not the only one on here who has all of that information memorized. 9381 7190 4632 8755 Expiry 08/12 CVV 819 See? Impressive, huh? Wait a sec... oh crap.
Chapter 1:
I put on my robe and wizard hat...
Secure password policies. My workplace introduced this policy not long ago and it's clearly a bit of security theater. Sure, done properly it will work. But the reality is that when you are requiring a high level of complexity... high number of characters, capitals or special characters, people will start to write them down when they previously wouldn't have. In these cases, we now have effectively LESS security, as that password is potentially more available to intruders. It is an even easier method of breaking into a system than it is using a dictionary or brute force attacks, especially when a typical scenario would only allow an attacker a short period of opportunity to try and crack a password. This isn't to say that all strong password requirements are a bad idea, requiring just a single capital letter or a single number in the password would probably work just fine, but the notion that deploying a complex set of password rules will increase security is flat out wrong.
The same goes for applications requiring seperate credentials from those used to initially log on to the system. When you start to introduce even MORE usernames and passwords into the mix, it is going to greatly increase people's tendency to write them down.
Using a single set of credentials for everything and requiring only a minimally complex password, locking out the account after a set number of attempts would be the best solution, but of course in a large corporation the voice of the front line staff is rarely heard.
Not only is he responsible for what has the potential to become the next big thing in home computing, he also apparently is the webmaster of the site. If you were to go to http://www.medison.se/ and read the company history, you will find an image with a red X, which points to file:///C:/Documents%20and%20Settings/Valdi%20Ivan cic/My%20Documents/Medison/new/abouteng_files/10re d.JPG. I commend a CEO of such an innovative company for designing the corporate website. There are a few other small discrepancies in the site, but this seemed to be the one I found the funniest.
Of course they do, what other motivation could they possibly have to waste as much of my time as possible?
You think that's so bad eh? Well recently my cell provider changed the "new message" speech to: "one...new message...received...today at...10...42...am...from...6...0...4...5...5...5.. 2...4...2...4...first...new message". Yeah.
YMMV, but the organization for whom I work (about 13,000 users) usually buys from what I would consider to be a medium sized vendor (larger than a mom & pop store but smaller than Dell, HP, etc). There are a few benefits that I've seen to going this route. One is that our machines are shipped with brand name parts inside (Asus mobo, ATI video card, etc). Two is that the support is far better. The company is still small enough that I typically get the same person on the phone each and every time I call for support. They don't run through any scripts or force me to troubleshoot before sending me parts. I will tell them what I want and the parts get shipped out the same day or next. I've gone as far as having them set me up an account in their work order system which I can access online and enter my ticket without evn having to call. It's VERY convenient. In some cases, they will send more parts than necessary (ie, a psu, mobo, ram and video card) for a problem that I may initially think is related to just one of those components, so that I don't have to call and have them ship parts a second time, resulting in more down time. What I'm getting at is that because the company we are dealing with isn't huge and faceless, I am able to build a trusted relationship with their support department, and I can get things fixed without being jerked around. We haven't always gone that route however. We choose our vendor based on a bidding process each time we want to purchase machines. It isn't always the same vendor who wins. Over the years we've had several different vendors, ranging from medium sized like the one I am currently dealing with, to big name brands like Dell. The number of problems with our custom-built-with-name-brand-part machines compared to the Dells that we purchased is huge. Other than a problem we are dealing with right now*, I rarely ever have component failures in our custom machines. The Dells on the other hand were such a support problem that I don't think we will ever buy them again. Almost every single machine we bought eventually choked due to swollen caps on the motherboard. It was like pulling teeth trying to sort out the problem with Dell. There is such a variance in the level of knowledge of their techs that I was hornswaggled. In one instance, the first time I called, the support rep ran me through a number of troubleshooting steps that I had already tried and we eventually terminated the call when no progress was made. When I called back, the conversation went like this: Me: My computer doesn't work Dell: Check the caps on the motherboard, are they swollen? Me: Hey lookie there, yes they are Dell: I'll send a replacement right away To summarize, our medium sized vendor has provided a much higher quality product and far better support than I have seen from Dell. I encourage you to give that route some deep consideration. * One of our recent batches of PC's had a bad batch of power supplies. I believe it was another case of bad capacitors. The vendor went as far as to ship a fleet of replacement power supplies so that when one died, we could take one from the fleet and replace it immediately without having to wait for them to ship a replacement.
Our department has a security video that we use before we allow new employees to access our system. It covers basic computer security, and provides information on different level of protected information. After that, we give them their username and password on a memo that also contains a bunch of useful information for new users, such as how to access e-mail, and what the various network drives are for. Also on this memo are more security reminders. After that, we send them on their way. Anything else they need to know from this point would be application specific, and my assumption is that if the company has hired them, then they have already demonstrated that they have the required skills for the position, so I won't bother teaching them what they should already know.
Is it an advantage? Sure, of course it is. Is it an UNFAIR advantage? I would say hardly. I spend good money on high end gaming hardware (video card, monitor, sound and internet connection), I pay (and dearly) for the little advantage I do get, but because the other players may not be able to afford the same level of hardware, I don't see how that makes things unfair. If I was to race a Ferrari with my Honda, does the Ferrari driver have an unfair advantage? Of course not, he paid for the advantage that he gets. I still play the same game as everyone else, I just take advantage of every benefit that I can out of the game. And as far as F.E.A.R. goes, I played it in 1680x1050... while the game may not support it natively, you can force most any game to play at a nonstandard resolution. http://www.widescreengamingforum.com/ is my best friend when it comes to games that don't support the res that I want to use.
How about, "I am going to be eating fewer meals this week since I bought my shiny new 7900GTX"?
No, DX9
I work for an organization that has > 10,000 Exchange mailboxes. How many more than 10,000 I'm not sure, a quick search would limit me to 10,000 results, I suspect the actual total to be about 15k. We have our mailbox default set to 100mb before we start issuing warnings, and at 150mb we prohibit the user from sending. At no time do we prevent users from receiving. If somebody was to hit their limit, policy is to increase their mailbox size by 10%, up to a maximum of 300mb. 300mb is the policy-limited maximum size, however the decision was made recently to eliminate the usage of PST files nationally, by importing them into the user's mailbox, in an effort to improve how we manage e-mail. The PST migration has resulted in some mailboxes being in excess of 1gb, throwing the previously mentioned 300mb limit out the window. I don't know how the company that the OP works for is laid out, but my organization consists of several regions, each containg over a dozen sites, with staff often moving from one site to another. When they move sites, we transfer the user's personal share to the new site's local server, and this becomes a bit time consuming when moving large PSTs. E-mail is managed nationally, so it made sense to keep all the data in one place, limiting the amount of data that needs to be moved when somebody goes to a new site. These large mailboxes typically aren't a result of abuse, the biggest ones normally belong to senior managers, who never delete e-mail and often have several years worth of archives.