The DMZ

« first day (41 days earlier) ← previous day next day → last day (5137 days later) »

Graham Lee

10:44

@AviD @RoryAlsop plenty of mod flags asking for questions to be CW, should we just go ahead and edit them?

2 hours later…

Iszi

13:13

Mornin' all.

@GrahamLee Sorry. Couple of those are my fault.

packs

13:48

@Iszi Way. To. Go.

Rory Alsop

14:22

@Graham - I reckon so. I'll CW the two that seem appropriate.

right - that just leaves us with two

@Iszi - cheers for pointing them out :-)

packs

14:38

I need to get some good questions posted. The overabundance, lately, of cryptography has been boring.

Rory Alsop

15:13

@packs It was good to get a few more questions in over a short space of time, but yeah - I agree we need to keep adding more in there

on various topics

packs

In my spare time I'm working up something about policy development

While I am considered the "secure programming guy" I neither deal with programming or cryptography hardly at all.

Rory Alsop

:-)

packs

You can also imagine my reaction when, browsing through meta, seeing @AviD talking about keeping the site WebApps security. :)

Rory Alsop

@packs LOL - I admit, even with my company, web app security is a big chunk of what we do, but I am much happier approaching the whole thing as one subject. I mean an attacker will go for a way in - if the websites are locked down he may go for an SMTP server, or a 3rd party connection, or walk through the front door etc

I say keeping it as the slightly wider field also will bring in a wider pool of people

and generate more discussion

packs

15:32

We have the luxury of being an Information Security department for the university, which has allowed us to specialize quite a bit. So while we have been putting more pressure on the Applications people, we probably spend more time overall on servers, networking gear, etc.

Of course, the majority of my days lately have been spent with IDS, the police, and physical security.

I actually like working with our Key Shop. I think I've had more fascinating discussions with them on building security than I have anything else for a while. :)

packs

15:44

Speaking of IDS....just got my list for 5 more nodes to build and sprinkle around.

I always feel a twinge of accomplishment when I get a handful of these things deployed.

Iszi

16:11

@packs How's this, for non-crypto?

Q: What security risks do unauthorized MiFi devices on company proprerty pose?

I'm having some difficulty determining how, or if, MiFi devices on property should be regulated. Personally, I see them as having little difference from any other rogue AP in the environment - the only real difference being that they're generally not directly connected to the corporate network. ...

packs

MiFi?

Iszi

@packs Stuff like this: verizonwireless.com/mifi-mobile-hotspot.shtml

Essentially, connects to a cell network and shares the data connection over WiFi.

A couple things I can think of off-hand would be DoS (poor configurations lead to interference with approved APs), bridging to the Internet (systems with Ethernet and WiFi NICs connecting to production network and MiFi simultaneously), and facilitating data leakage by insiders.

packs

I've definitely seen those, and used them before, but hadn't seen that acronym.

Iszi

But I find it really difficult to convince management that these threats are actually worth being concerned over. There are some instances when MiFi devices have legitimate use, but those should be rare enough that it can be regulated. (i.e.: Require case-by-case approval, and device registration.)

packs

I used the shit out of those mobile hotspots at Origins last year :)

Iszi

16:18

@packs What do you usually see them called? Could change the question.

packs

No terms that I would call pervasive. I only really started hearing about them when the Android became the new hotness. I think the most "official" term I've heard for it is 'mobile hotspot'

Usually just "turn on your wireless thing"

Iszi

@packs Will append to query. Thanks.

packs

Iszi

@packs Any qualms with the new "insider-threats" tag?

packs

Did you just create it?

Iszi

16:24

@packs Aye

packs

I like the sound of it, I feel like it could be useful. There is the possibility that it could be genericized a little, though I'm not entirely sure what that would be right now.

Iszi

Wow... noticing the comments on RFID-based home security in The Comms Room. Totally something I'd want in my house, even if it's just to satisfy the geek factor!

packs

I like how ChrisS thinks.

The power is going to fail at some point, and you still need a reasonable ingress/egress point.

Iszi

@packs Yeah, that's sort of the trick. I'd prefer a fail-secure, with an internal mechanical override.

packs

Agreed.

The formerly Harco, now Blackboard, system is pretty nice in that regard.

For doors with panic bars, the electronic system actually works a plunger that will work the bar.

Things like that, so it works out that the system will, in some way, simulate a real operation.

So that they can fail secure and still allow old school operation if needed.

Iszi

16:36

@packs Heh... You just made me think of my mom. She hated when I went "old school" on her minivan that had the buttons for electronically opening the sliding doors.

packs

You mean using the keys instead of the fob?

Iszi

@packs No, I mean using the mechanical handle (to get out) instead of the button next to the door.

packs

boo

Use whichever is closer and easier.

One of my friends has a minivan with the auto-close doors. The things are so fricken slow.

Iszi

@packs Both are equivalent in proximity. Handle allows me to swing the door faster than the electronics will.

@packs Exactly.

packs

You still use the exterior handle to get it started, but then about half-way through it takes over for you.

Iszi

16:38

@packs Mom's van didn't do that.

If you started mechanical, you did all the work yourself unless someone (usually my mom) hit the button meanwhile.

packs

It reminds me of the trunk lids on old TownCars

Iszi

@packs I think I worked in a building that had that function once. I say it's great for your home, but businesses should be having people badge both ways. Enforcing badge-outs also helps make sure people have their badge with them when they are out of the building, so they can get back in.

Another company I worked for had the badge-out function in place, but didn't strictly enforce it. So, a lot of us got used to just bypassing it. Problem was, the badges we used for physical access also had the smart chips with our encryption keys.

packs

@Iszi I agree, in principle, with the badge out. Sometimes it is unnecessary, though.

For instance, all dorms require swipe to get in at all times.

Iszi

So, what would often happen is I'd have my badge stuck in the PC for encrypting/decrypting e-mail and leave it there when I walk out for lunch. Come back, and I'd have to go through the security office to get in the building.

packs

However, you just open the door to leave.

We're using it strictly as an easier to manipulate key system.

@Iszi Ah, yeah, that sucks.

Iszi

16:43

@packs I think you can nearly equate dorms to home.

packs

A lot of office buildings as well.

Iszi

@packs Yes. Especially when the security office is on the opposite end of a long building.

packs

If a philosophy professor needs to get into their office over the weekend, do we really care that they entered or left?

Sometimes, yes, but 99.x% of the time, no.

Iszi

@packs Entered, absolutely. Left, debatable I suppose.

packs

It pretty much only matters in the event of an investigation. And in the example I gave, that would come down to, pretty much, workplace harassment or theft. Neither of which are frequent enough to make it important enough to prioritize :)

Now, accessing the DataCenter or Human Resources records storage? That's a different issue.

Hear that? Sounds like lunch time :)

7 hours later…