0

Our organization is looking on changing the naming conventions on our Admin PCs to make it easier for tech staff to remote into user machines.

A current favorite idea is to pair user names with the machines they are assigned to. Since we are a smaller operation (~30 Workstations), we figured it would be the best option.

Questions about security of the new naming conventions have arisen, and I was looking for feedback on the risks with going with this convention. Also the risks associated with using any part of a user's name such as (Companyname)JD for John Doe

  • 2
    Exposing a username as a computer name isn't the best way to manage PCs in my opinion. Can't the users that are being managed by the tech staff give them the computer name or IP address? – Jeroen Jul 9 at 13:57
  • 1
    from a security standpoint, doing that is horrid. Employees with either an exploit or just plain access, would be able to poke around and know who it is much easier – MichaelEvanchik Jul 9 at 15:42
  • This approach implies that every machine is dedicated to a single user without multiple accounts. It also ties users to hardware, requiring hardware updates with staff changes. You can certainly do this, but it's a very unusual and arguably impractical way to do things. – user10216038 Jul 10 at 17:28
4

X Y Problem Challenge: A better long term solution is to create a mapping of PCs to user and physical location. This is actually a CIS Top 20 Recommendation and gives you a lot of opportunities to build off of as you mature your process. Asset matrices are crucial to a lot of security processes.

That being out of the way - for your specific question:

The real question is 'how sensitive do we consider our usernames?". If they're shared publicly elsewhere, it might be worth the efficiency trade off to use the proposed naming scheme. At the end of the day, we're trying to facilitate business without exposing the organization to undue risk. If you don't consider usernames sensitive, then it doesn't really cost you very much to expose them in device names, and you might gain a lot in response time when you need to remote to a system.

For what it's worth, usernames are typically not treated as sensitive, and you can probably expect a hacker with any type of foothold into your environment to have a pretty good idea of what usernames are out there. Heck, if you ever send emails outside of the company and have any type of employee listing, you're probably leaking dozens of usernames already.

This is a good example of a risk vs reward trade off in security. It's not an obviously bad idea, and there are perks to implementing it, but there are also trade offs to consider. Your best bet is to sit down and write out a little risk analysis and decide if this scheme is worth the downsides.

0

If there is a direct mapping from machine names to user names, you are publishing valuable information to a hacker that has potentially gained access to your network. This especially true if usernames are being actively safeguarded elsewhere, for example, by not using them in company email addresses.

Obfuscating the name somehow would decrease this risk, for example using the last name in usernames but first name in machine names.

0

Without of the general, the login need the correct username and the related password. It means the hacker need to guess the correct of two parts: the two-dimensional problem. If hacker can easily guess the valid username and the problem would be a one-dimensional.

In your case, hacker can guess the username is JD, john, johndoe and other if computer is JD and he/her can break the system more easily.

0

I would not recommend this from two perspectives:

  1. GPDR The username makes someone personally identifiable in many logs, everytime not only IP but also a name is logged when a DNS-query is made by the application. This violates the data minimization principle of GPDR, in a case where a server log is exposed to a third party you have way more affected records than when only the IP and some arbitrary computer account is logged. This can eventually lead to a fine because you did not minimize the risks for your employees according to article 25 of GPDR

  2. Management Every change of a computer account due to technical failure or just moving personell would create additional hassle for the IT Department, since then the computer account has to be changed to the new user, replicated over all DNS Servers in the domain. You cannot just replace a failed or infected device with a new one without rejoin it to the domain and removing the old one. After just 6 months this structure will be an outdated mess of names.

My solution to this problem would be using a program like BGInfo to display IP Address and computer name on the users screen, that way he can give you every necessary information. It can be distributed via GPO and works like a charm.

Additional info: For scaling issues on Windows 10, look here: Fix BGinfo scaling

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.