Date: Thu, 8 Nov 2001 11:51:05 -0500 From: "Andrew C. Hornback" <achornback@worldnet.att.net> To: "Anthony Atkielski" <anthony@atkielski.com>, "FreeBSD Questions" <freebsd-questions@FreeBSD.ORG> Subject: RE: Lockdown of FreeBSD machine directly on Net Message-ID: <012201c16875$8e7b6b80$6600000a@columbia> In-Reply-To: <003901c1682e$26a0a0d0$0a00000a@atkielski.com>
next in thread | previous in thread | raw e-mail | index | archive | help
> -----Original Message----- > From: Anthony Atkielski [mailto:anthony@atkielski.com] > Sent: Thursday, November 08, 2001 3:20 AM > To: Andrew C. Hornback; FreeBSD Questions > Subject: Re: Lockdown of FreeBSD machine directly on Net > > Andrew writes: > > > > b) Calling the sysadmin and pretending to be his > > > boss and convince him to open a hole. > > > > Most organizations require something like that in > > writing, or at least as part of a face to face > > conversation. That negates this loophole. > > I've never encountered an organization that has a policy like that, but my > personal policy is along those lines. If any manager wants me to > compromise > system security, he needs to put it in writing. This not only > protects the > organization from hanky-panky, but it protects me and the > organization from > lawsuits (albeit not prosecution, in most cases). Having held such positions as Senior System Administrator, Director of Server and Network Operations and (hands on) Chief Operating Officer of an ISP... I'm very surprised that you've never encoutered this. Such a policy is standard operating procedure for me, period, no matter where I am employed. If a supervisor is asking me to do something that I deem as being risky (and yes, I am quite paranoid about system security), I ask for something in writing or at least an explanation as to why they need something like that done. Often time, I've been able to explain to the supervisor how to do things differently to accomplish the same task, or through their explanation find out that they don't know what they're asking and suggest an agreeable alternative. Maybe it's a stereotype that a lot of people don't see, but some of us Americans take pride in the jobs that we do and make an effort to do them properly. > > If a secretary does this, they need to be fired, > > period. > > In some organizations (many, in fact), she might be fired for > _not_ doing it, as > few people understand the risk to security that doing something like this > represents, and they would interpret her refusal as a lack of > team spirit or > cooperation or some such. I'll refrain from making a comment as it would appear to be extremely inflammatory. > > Wouldn't work under a "Trusted" system, you'd > > have to bribe, torture or blackmail three people. > > Not outside the realm of possibility, but it is true that > collusion between two > or more people is _far_ less common (and much less stable) than > dishonesty in a > single individual. It's a numbers issue. If an operation requires three doctors, and you only have two, you're probably not going to have the outcome that you seek. --- Andy To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?012201c16875$8e7b6b80$6600000a>