I have been asked to leave the company for having spotted serious security breaches

[William Stacey [MVP]]

Certainly. In my experience, many technical people confuse

"technically correct" with "correct because the boss has made up his
mind". And an awful lot of technical types have trouble with the
concept of "not your decision to make".

Very true.

 

[Leythos]

Picture this, you are tasked with creating a wireless "kiosk" where
anyone on any device, can connect to get to a directory. The design is
deliberately wide open, the net is segragated from anything important,
it's supposed to allow anyone within range to be able to connect. Now
someone who works for you tells you this is bad, that it's open. You
say you know and explain that it is deliberate. This person doesn't
like that answer, posts to usenet groups (extreme crossposts), and goes
over your head to complain to your bosses. Everyone involved is going
to tell this person to go look for another job.

Many airports in the USA have free wireless in the terminals for use by
anyone near enough.

 

[johnydeath]

Many airports in the USA have free wireless in the terminals for use by
anyone near enough.

changing the point slightly because of this comment - my concern would
be that everyone in the terminals, Starbucks or whatever place it may be
are all going to be interconnected.

I would be more interested in doing a ping sweep and some enumeration on
the local wireless net rather than internet surfing - much more
enjoyable, now to buy a house within the footprint!

 

[Leythos]

changing the point slightly because of this comment - my concern would
be that everyone in the terminals, Starbucks or whatever place it may be
are all going to be interconnected.

I would be more interested in doing a ping sweep and some enumeration on
the local wireless net rather than internet surfing - much more
enjoyable, now to buy a house within the footprint!

that's why people with wireless should be running a personal firewall on
their systems - I use Kerio or Tiny depending on the laptop and never have
a problem in the terminals.

 

[Curious George's Twin]

A lot of issues have been raised here, the crux of it coming out recently
with the discussion mentioning that there are instances where open wifi is
acceptable, indeed, part of the design.

While I can certainly agree with this, in our particular case there are no
precautions taken behind the waps to ensure security other than what is out
of the box with the operating systems of the workstations and servers inside
the fence. In a proper campus environment (where the sophistication of
users on a certain segment is not up to snuff with things like proper
passwords, etc.) the issue is to balance out the needs of wireless access by
everyone with the needs to secure the information that is on the inside.
Whether this be done with radius technologies, etc., would be the
discussion.

In our case, however, there has been no such discussion and whenever the
issue of locking things down a little bit more has been brought up, the knee
jerk reaction is always that it will be too hard for users to adopt to
possibly having to transverse an additional level of security.

While I am the first one to realize that there has to be a balance, the
threshold discussion is that there is "a balance" - this is not the case
here at all and what is occurring here is, quite literally, the same as
laying out a cable and hub outside with a sign that says free web access for
all. Yes, doing so is not a bad thing whatsoever. . . however, in that
scenario you have some type of security mechanisms in place to temper what
gives the end users free access and, as I have said before, there is nothing
of the sort in place here. . . nothing.

The matter here has been compared a fribble bit to scenarios such as
starbucks, airport kiosks and bookstores - surely the directors of those
networks would not want their internals exposed to the world completely.
Actually, we talk about theoreticals here to illustrates points, but if you
pick up a few back issues of 2600, you realize that Starbucks, K-Mart and a
whole bunch of other places that offer free web access (whether they intend
to or not) really should consider taking greater measures in terms of
offering free web access to their visitors and patrons, and opening up their
internals to somebody with a laptop and a few basic skills.

Curious George

 

[donnie]

Actually, we talk about theoreticals here to illustrates points, but if you
pick up a few back issues of 2600, you realize that Starbucks, K-Mart and a
whole bunch of other places that offer free web access (whether they intend
to or not) really should consider taking greater measures in terms of
offering free web access to their visitors and patrons, and opening up their
internals to somebody with a laptop and a few basic skills.

Curious George

##############################
If you are that familiar w/ 2600, you already know that they say that
the people who point out security holes get blamed for them. Did your
job description have anything to do w/ security in the first place?
donnie.

 

[Curious George's Twin]

Donnie. . .

Too funny. . . WHAT "job description"????

Curious George

 

[Agent_C]

Maybe you should reconsider your chastizement of this lad.

I couldn't be less interested in pursuing this subject any further...

A_C

 

[johnydeath]

that's why people with wireless should be running a personal firewall on
their systems - I use Kerio or Tiny depending on the laptop and never have
a problem in the terminals.

gonna guarantee they all do ??

 

[Leythos]

gonna guarantee they all do ??

I don't that that comment makes sense - of course they don't all run
personal firewalls, that's how come we stay in business getting new
corporate clients

 

[Phillip Windell]

They did not fire him. They suggested that maybe it was time he looked
elsewhere. Whether that was said in the heat of the momemt (from the posts,
things were heated) or was a considered response, we do not know.

Ok, I see, I assumed he meant he was fired. But I stick to the same general
point just the same.

 

[Phillip Windell]

"William Stacey [MVP]" <[email protected]> writes:

Well, yes and no. Once he brought the issue to his boss's attention
and she made up her mind to ignore it, the responsibility for any
resulting problem was hers, not his.

In a perfect world maybe, or may if he's lucky in a court of law. But that
wouldn't stop her from dumping it on him anyway when something goes
wrong,...it would still be [as far as she is concerned] "his fault" because
people like that don't eccept responsibility for the actions and choices if
they can push it "downhill" to someone below them,...especially if there is
negative "history" between them as there would be in this case.

 

[Guest]

Advice:
1. Silence is golden
2. Find a problem? fix it before it is noticed..can't fix it leave it alone.
3. Know your supers...each needs to be apporached differently
4. CYALNR (Cover Your Ass,Leave No Record)