Please help me "sell" the idea of a more secure network

[JM]

My company does mostly telecom interconnect work, and some data. Typically,
we bring in a networking person from a partner company to do the actual
technical stuff. However, it's often our job to educate the customer on why
certain things are needed. And I need some help on a current situation.

The client has Windows 2003 Server Standard Edition, with about 15-18 XP Pro
computers. They have AD setup, with their core company software running on
the server. Most of the clients are joined to the domain, but several
employee laptops simply operate in a workgroup sharing internet and POP3
email, with their email being hosted by a local network services/website
design company.

Some users log on using a unique username, but ALL users use the same
password. In fact, this "master" password can be found almost anywhere and
on anything that requires a password, including their individual email
accounts, websites, and who knows what else. Other domain users login in
with generic logins like "CompanyNameUser," again using the universal
password.

To make matters worse - at least in my non-expert view - is the wireless
router they leave on 24/7, completely open, for anyone and everyone to use.
They have literally hundreds of customers coming and going daily, and the
wireless internet access is a courtesy they offer.

Finally, they have no comprehensive, system-wide security solutions,
whatsoever. Their anti-virus "protection," for example, consists of various
products, releases, life cycles, etc, all on the individual clients. Some
have Norton, others McAfee, AVG Free (yeah, I know), with some being
in-date, out-of-date, and some with nothing at all. There are various free
malware killers, pop-up blockers, and the like, installed by whomever,
whenever, because they have no group policies or other domain security
policies in place enforcing who can and cannot install software.

I know this is a huge issue, and I'm not asking for anyone to spend a lot of
time on it, but I need some concise ideas for these people. The problem is
that up to this point nothing devestating has happened, so they are totally
blissful in their ignorance. If I sell too hard, given their current good
luck, they will think I'm doing Chicken Little or trying to make a buck.

The fact is, I'm really concerned about my clients, and I know their current
situation is going to get them in trouble. I'm just not sure how to
approach it.

thank you,

jm

 

[Mark Repuski]

You are right this is not a good situation. As the customer seems
disinterested as nothing bad has happened you might need to perform two
services.

First try to ensure that you have mitigated there configuration with good
backups. Regardless of how good or bad a design they have you could rebuild
should there be an issue. This rebuild would then help you suggest changes
but lets hope this never happens

Once you have backups it might be best to document the current
configuration. Then create a better approach on how you would prefer the
environment and then priorities each change. Suggesting the most important
changes first should bring the network up a notch or two.

You might also suggest changes that do not cost any money. A small example.
- join all systems to the domain.
- create a password policy, enable history,
at some point the user will have to point the user will have to pick there
own password
- setup the appropriate OU, Global, local and account membership and apply
- disable the or limit the abilities of the group account.
It can't be used if it is not available


Then you might ask the your customer if you could perform a test have the
most junior employee attempt to open or access this sensitive data.

Do the same thing using a wireless notebook from you company. Then save the
file on you system and walk out the door. When you come back ask him/her if
this just happen and it was not a trust person what problems would/could
happen from this data theft.

Then go outside and sit in you car or some other discrete location and
connect to the wifi network.

One final though, show him a PO or invoice for a customer who had an AV
issue. This gives you information on what impact this might have on the
books and can be used as a bench mark for the cost of changes.


This should be done under the watchful eyes of the boss.

 

[Hank Arnold]

Some good advice. However, nothing will change unless the customer's
executives management signs up.

To be honest, I don't think the OP will have much to worry about for
long. Chances that this company will survive are slim..............

Regards,
Hank Arnold

 

[JM]

Some good advice. However, nothing will change unless the customer's
executives management signs up.

To be honest, I don't think the OP will have much to worry about for long.
Chances that this company will survive are slim..............

Why do you think this?

jm

 

[Hank Arnold]

Let me see............

1) One password for all users and services....
2) Generic logins
3) Wireless Router with all ports open
4) Inconsistent (or non-existent) AV/spyware/malware strategy
5) Anyone can install any software

It's hard to think of a way to expose a network to hacking or disaster
that these <expletive deleted> folks haven't done. It's like they *want*
to get compromised or lose all their data....


Regards,
Hank Arnold

 

[Guest]

If you lower your ethics a bit, have a friend come in unannounced to the
company for a demonstration (that wont do much because you have backups).
Either that or request to do it live for a supervisor so he can see what
could be done if people wanted to.

 

[Kurt]

You'll have a hard time selling it to management because setting up that way
was their idea. It makes things simple for them because they have no
in-house support (their "IT Guy" is a manager, handy employee or somebody's
kid, right?). Write up a security assessment, present it in both printed and
electronic form (email a Word doc and send a copy certified mail) with links
to a few articles written for the public, not techie stuff (to back up your
position). Make broad threat assessments ("Your password policy leaves you
very vulnerable") and offer your phone number to discuss the problems in
detail (you can do the selling then if they bite). Make sure you get a
receipt for the email and store it along wih the original in your client
records, and the certification of delivery for the snail-mail in the filing
cabinet. You might get a short-term job cleaning up the mess, or maybe even
a long-term support contract. At the very least, when the lawsuit threats
come ("These guys never said a word to us about..."), you're covered.

....kurt