Tag Info

Hot answers tagged

10

Serverfault has a great canonical answer on "what should we do now to clean up this mess", so I'll take a stab at "what should we do to prevent this happening ever again". Your organisation needs to establish an "employee leaving" process and stick to it. Your organisation will need to work out if they should treat all terminations the same, or differently ...


7

A significant threat is around an attacker setting up a hot spot that purports to be a valid company wireless access point. If the SSID is right, and the organisation doesn't use mutual authentication, users may connect to the malicious hotspot, which means all traffic will travel through kit controlled by the attacker. See this question and this one for ...


5

The main concern would be using one of these devices to bridge networks; for example, connecting a company-owned device to the wired network and to the MiFi-created AP (which is basically unfiltered Internet) at the same time. There's also the same set of concerns that you'd have with connecting company equipment to public networks (e.g. a coffee shop or ...


5

A very new Reuters release notes that: Former U.S. National Security Agency contractor Edward Snowden used login credentials and passwords provided unwittingly by colleagues at a spy base in Hawaii to access some of the classified material he leaked to the media, sources said. A handful of agency employees who gave their login details to ...


4

If the attacker has the keys and has wiretap warrants with the 10 ISPs (or less, considering cable monopolies), they can listen to all traffic and pretty much strip away all the privacy since Tor isn't decentralised in the manner of I2P. Tor isn't really that secure, merely somewhat secure if no one really wants you anyway. The Tek Syndicate has a YouTube ...


3

If you want to prevent an insider from stealing your data, I'd guess you have only one strong defense: don't give them access to the data. In other words, use access control to limit their access to the data. If the insider has access to all the data, prevention is really hard. One alternative is to detect signs of such misuse: e.g., where someone has ...


3

In response to only (2) above: if a private cloud is actually allocating computing resources on demand to users with certain passwords/keys (like AWS) -- it is then over and beyond plain virtualization in the enterprise and risks additional to simple virtualization need to be mitigated. If private cloud resources are allocated/deallocated and managed by ...


3

I can't offer a Windows based solution for your problem, but I can suggest one for Linux which might be adaptable if it will suite your needs. Use the Samba Audit Module to monitor and log file access. You will then be able to see what users are accessing what files. You can then either monitor this manually or write a script to detect an unusual amount of ...


3

The following is what I would do, given your situation. Restore the e-mails from a previous back up. If they deleted them then assume they had something to hide. Contact a professional who can audit your systems and ensure there are no back doors or network holes that remain unpatched from the termination (webmail / vpn credentials / blackberry's, RDC ...


3

"Static" ARP entries is the more commonly used term than "Permanent"; you should know this if you're Googling and the like. Static ARP entries do provide protection against ARP poisoning / spoofing. However, someone in a position to perform ARP spoofing can also perform MAC spoofing to achieve close to the same effect, and overcome the obstacle that a ...


2

ARP tables are in the RAM of a device, and therefor they are never permanent. However, you can add them at runtime, and have a script that adds them again when the device is rebooted. On linux, the "arp" tool can be used to add static entries (arp -s). You can incorporate the arp command in a /etc/network/if-pre-up.d/arp script on debian-based systems for ...


2

I'm going to assume that you've already created folder level permissions. But, you don't mention whether or not you're running a Windows Active Directory Domain. If you are then you'll have a couple of great features up your sleeve, that won't cost you anything. 1) Active Directory Rights Management Server (RMS). This gives you granular control over ...


2

The directory authorities votes on what the Tor network consensus that lists all relays should look like so that a majority of the authorities need to behave badly in order to publish a malicious consensus for clients. See https://metrics.torproject.org/consensus-health.html for how the voting goes. All the private keys is not needed to win the vote and ...


1

The short answer is yes, technically speaking. They will have another admin account on the computer that they can access. By policy, though, access to this account is (hopefully) tightly controlled and will only be accessed if necessary. Also, there is no such thing as your computer legally speaking if it is a work issued asset. They can look at anything at ...


1

It's be helpful to weed through all the speculation and pick out just the verifiable facts. Unfortunately, all there is is speculation, the facts are not and probably will never be available to the public. Snowden was an NSA contractor with an extraordinary level of access, which means that essentially everything surrounding this case is classified. So ...


1

There are a range of products to do this, for example the McAfee DLP suite - a lot will depend on the scale required. I have only seen this work well in small to medium sized organisations, as the volume of data becomes incredibly difficult to manage in a larger organisation. Even organisations that try to adhere to restricted/secret requirements get this ...


1

There isn’t a GP object which could manage the permanent ARP cache. For windows XP, we can use a logon script which could add the ARP entry. However, in windows 7 and 2008, only administrator permission could add the ARP entry so that there isn’t any way to fulfill the requirement. The command to add a permanent ARP entry is ARP -s inet_addr eth_addr ...



Only top voted, non community-wiki answers of a minimum length are eligible