Managing Software
Last month, this question came up in a discussion forum I'm involved with:
Another challenge to which i want to get an answer to is, do developers
always need Admin rights to perform their testing? Is there not a way to
give them privilege access and yet have them get their work done. I am
afraid that if Admin rights are given, they would download software's at
the free will and introduce malicious code in the organization.
The short answer is "no".
The long answer leads to "no" in a roundabout manner.
Unless your developers are developing admin software they should not need admin rights to test it.
Warning – they are out to get you.
McAfee has released a new study on malware in cars:
http://www.mcafee.com/autoreport
Now you may think that this is scaremongering on the part of McAfee because their traditional market is drying up. Not so, this is actually a threat we have been aware of or nearly half a century:
Are *YOU* ready to give up yet?
Apparently (ISC)2 did this survey ... which means they asked the likes of us ....
Faced with an attack surface that seems to be growing at an overwhelming rate, many security professionals are beginning to wonder whether their jobs are too much for them, according to a study published last week.
Right. If you view this from a technical, bottom-up POV, then yes.
Conducted by Frost & Sullivan, the 2011 (ISC)2 Global Information Security Workforce Study (GISWS) says new threats stemming from mobile devices, the cloud, social networking, and insecure applications have led to "information security professionals being stretched thin, and like a series of small leaks in a dam, the current overworked workforce may be showing signs of strain."
Patching madness, all the hands-on ... Yes I can see that even the octopoid whiz-kids are going to feel like the proverbial one-armed paper-hanger.
Which tells me they are doing it wrong!
Two decades ago a significant part of my job was installing and configuring firewalls and putting in AV. But the only firewall I've touched in the last decade is the one under my desk at home, and that was when I was installing a new desk. Being a Linux user here I don't bother with AV.
"Hands on"? Well yes, I installed a new server on my LAN yesterday.
No, I think I'll scrub it, I don't like Ubuntu after all. I'm putting
in Asterix. That means re-doing my VLAN and the firewall rules.
So yes, I do "hands on". Sometimes.
At client sites I do proper security work. Configuring firewalls, installing Windows patches, that's no longer "security work". The IT department does that. Its evolved[1] into the job of the network admin and the Windows/host admin. They do the hands-on. We work with the policy and translate that into what has to be done.
Application vulnerabilities ranked as the No. 1 threat to organizations among 72 percent of respondents, while only 20 percent said they are involved in secure software development.
Which illustrates my point.
I can code; many of us came to security via paths that involved being coders, system and network admins. I was a good coder, but as a coder I had little "leverage" to "Get Things Done Right". If I was "involved" in secure software development I would not have as much leverage as I might have if I took a 'hands off' roles and worked with management to set up and environment for producing secure software by the use of training and orientation, policy, tools, testing and so forth. BTDT.
There simply are not enough of us - and never will be - to make security work "bottom up" the way the US government seems to be trying We can only succeed "top down", by convincing the board and management that it matters, by building a "culture of security".
One view of Enterprise Information Security Architecure (EISA) Framework.
This is not news. I'm not saying anything new or revolutionary, no matter how many "geeks" I may upset by saying that Policy and Culture and Management matter "more". But if you are one of those people who are overworked, think about this:
Wouldn't your job be easier if the upper echelons of your organizations, the managers, VPs and Directors, were committed to InfoSec, took it seriously, allocated budget and resources, and worked strategically instead of only waking up in response to some incident, and even then just "patching over" instead of doing things properly?
Information Security should be Business Driven, not Technology Driven.
[1] Or devolved, depending on how you look at it.
Related articles
- Information Security By the Numbers (michaelpeters.org)
- Malware in Medical Equipment Poses Serious Threat to Hospital Security (eweek.com)
- Re: CISO Challenges: The Build vs. Buy Problem (1:2) (h30499.www3.hp.com)
- Information Security Awareness Through Analogy (clerkendweller.com)
The U.S. has 18 percent of its machines controlled by botnets
http://blogs.zdnet.com/BTL/?p=17459&tag=nl.e589
A short while ago I read an article that tried to present both sides of the issue of whether companies should shut down their desktop machines at night.
The 'pro' was of course the saving of electricity - all good and "Green".
The 'con' was that this saving would be offset by the cost in time as employees waited for the machines to book and waited while they shut down - the latter to make sure that they didn't hang.
The article didn't discuss home users. I'm sure home users would appreciate the savings and be willing to devote the time 🙂 While many people work from home and many children use computers from home, I don't think there is a need for an 'always on' computer in the home.
(Unless you count the fridge or the microwave or the VCR clock ..)
Would turning those computers off affect that botnet? Perhaps. I've certainly met people who when they learn I'm involved with IT ask me why their computer runs slower than when they bought it. I ask if they run AV or other anti-malware software, purge adware ... I rarely hear from them again but when I do its to say that some tool like "Search-and-destroy" told them they had gazillions of malware. And they ask me where it comes from.
I don't know, I run Linux.
But that argument against turning off corporate machines is specious at many levels. Most of the staff at my clients seem to use laptops rather than desktop machines. They take them to meetings and presentations, sometimes they take them home. All this involves turning off and on. If they don't take them home at night those laptops have to be locked away, not left on the desk top. That's been policy everywhere I've worked this last decade.
The limiting case was one year I worked in a port-a-kabin.
The sub-zero overnight temperatures meant none of the workstations were operative. So we turned on the cabin heating all the electrics, all the machinery and went to get a coffee (aka "breakfast"). Half an hour later the cabin was warm enough for the electronics to operate. We were not allowed to leave the cabin powered up overnight.
Would shutting down the home machines each night reduce the level of spam? Perhaps. That's an incentive over and above the Green one of saving electricity. Perhaps some service provider service technician should recommend this over and above regular 'purges'.
The McAfee report doesn't make a clear distinction between commercial and residential hosts for the botnets, though it does mention some government agencies and banking institutions in Russia are
malware-laden. The large corporations that make up my clients have always had IT departments that support good front-end filtering and making sure that the workstations have up to date AV software. That being said, I see a lot of people who turn off their AV software. Myth or not, many still believe it affects performance.
Of course I run Linux and I don't have to worry about rogue ActiveX, and I don't run attachments I get in the mail and there are many sites I simply don't visit!
And I turn my home machines off at night.
Related articles by Zemanta
- How to Detect and Prevent Psyb0t, the Linux Router Worm (slumpedoverkeyboarddead.com)
- McAfee: Enabling Malware Distribution and Fraud (readwriteweb.com)
- Spam 'produces 17m tons of CO2' (news.bbc.co.uk)
- OS X 'pirate' trojan resurfaces (vnunet.com)
- Conficker virus begins to attack PCs (canada.com)
![Reblog this post [with Zemanta]](http://img.zemanta.com/reblog_e.png?x-id=0fa2053e-01cf-4ccc-b7dd-7b711ecaeffc)