Worm never seen before

[Leythos]

I figured there must some exceptions. I would find it extremely difficult to
imagine my being able to transfer technical design data I have sold to
customers outside my company without having CDRW privileges as an option.
Email encryption is cumbersome for very large files and usually violates our
IT policy for the attachment size.

That's why you setup FTP access and encode the file with a password. You
give the clients a directory based on their name, user/password, and
they can pull the file(s) using FTP. Simple, easy, works like bread and
Applebutter.

 

[optikl]

That's why you setup FTP access and encode the file with a password. You
give the clients a directory based on their name, user/password, and
they can pull the file(s) using FTP. Simple, easy, works like bread and
Applebutter.

 

[optikl]

That's why you setup FTP access and encode the file with a password. You
give the clients a directory based on their name, user/password, and
they can pull the file(s) using FTP. Simple, easy, works like bread and
Applebutter.

That's very interesting. I need to talk with my IT folks about this. Thanks.

 

[Greg Hennessy]

I figured there must some exceptions. I would find it extremely difficult to
imagine my being able to transfer technical design data I have sold to
customers outside my company without having CDRW privileges as an option.

That's what extranet and EDI connections are for.

Email encryption is cumbersome for very large files and usually violates our
IT policy for the attachment size.

Email encryption is not cumbersome if some T&E is spent implementing TLS
properly and configuring it to be the only option between you and your
customers.

 

[Greg Hennessy]

That's very interesting. I need to talk with my IT folks about this. Thanks.

If they are paranoid about that, set up ftp access such only their cidr
block gets access to the server.



greg

 

[Leythos]

That's very interesting. I need to talk with my IT folks about this. Thanks.

When we share files with clients we use authentication based FTP servers
- we setup a virtual drive or a folder, secure it, then provide the user
the ftp site name, user name and password, and this lets then push/pull
files to/from us at their leisure. This method has been used for
decades. Don't forget, you can also Zip the files and password them so
that you have an added layer of eyes-only security.

In addition, most of the large fortune 1000 companies already share like
this.

 

[Leythos]

That's what extranet and EDI connections are for.


Email encryption is not cumbersome if some T&E is spent implementing TLS
properly and configuring it to be the only option between you and your
customers.

It's not the encryption, it's the load on the email servers and size
limits on users mail boxes that is the real problem. We limit most users
to an online storage limit of 20MB for all mail, some groups get 100MB
and some others get 1GB, but most can live with 20MB just fine. It's
fairly easy to swamp a 20MB box with business documents, and very time
consuming to get most IT departments to change the default account
settings once they are in place

 

[optikl]

Thanks.

If they are paranoid about that, set up ftp access such only their cidr
block gets access to the server.

Thanks, Greg. And they probably will be a bit paranoid about this. Our
systems and procedures have to satisfy DoD requirements.

 

[Leythos]

Thanks, Greg. And they probably will be a bit paranoid about this. Our
systems and procedures have to satisfy DoD requirements.

Then you can do like he said and set the firewall such that not only do
they need a user/password, but they are in a FTP rule that only allows
IP-Range access to it.

You could also consider a web interface to the site - one that still
does authentication, but also provides SSL based access.

 

[optikl]

Then you can do like he said and set the firewall such that not only do
they need a user/password, but they are in a FTP rule that only allows
IP-Range access to it.

You could also consider a web interface to the site - one that still
does authentication, but also provides SSL based access.

I appreciate your suggestion. It would simplify delivery, since I would only
have to deliver to a share and my customers could pull the deliverables as
needed. They could also upload specifications, which would eliminate me from
having to distribute these to my engineers. Thanks.

 

[Bruce Chambers]

As has been pointed out elsewhere, there is no corporate with anything
resembling a sane IT procurement and IT security policy would countenance
CDRW on the desktop.

Please provide an IT industry White Paper or some other professional
literature to support this seemingly absurd assertion.


--

Bruce Chambers

Help us help you:



You can have peace. Or you can have freedom. Don't ever count on having
both at once. - RAH

 

[Steve Riley [MSFT]]

Folks, I don't think throwing accusations back and forth about which organizations
do what is adding any value here.

I've spent time with customers of all sizes. And, regardless of size, about
50% of them do buy PCs with removable storage and 50% don't.

There are organizations that conduct an analysis of the risks vs. the benefits
and decide that the benefits of removable storage, for their business needs,
outweigh any potential risks they face. There are other organizations that
conduct the same analysis and decide that, for them, the risks outweigh any
business benefits. People are not stupid; they are capable of analyzing their
own risk environments and making good decisions in light of their required
functionality. (As in any binary division of human attitudes and actions,
there's really always a third group: the people who just don't care. In this
instance, though, my experience indicates that's a small number.)

Let those who choose to purchase removable storage be comfortable with their
decisions and remember to manage the risk, whatever it might be, appropriately.
And let those who choose not to purchase removable storage also be comfortable
with their decisions and help their users understand and abide by the restrictions.

Steve Riley
(e-mail address removed)

 

[Dave Budd]

I figured there must some exceptions. I would find it extremely difficult to
imagine my being able to transfer technical design data I have sold to
customers outside my company without having CDRW privileges as an option.
Email encryption is cumbersome for very large files and usually violates our
IT policy for the attachment size.

CDs to customers need company logos, legal stuff, etc, and must be
definitively SAFE, so you personally shouldn't be writing them - you
should be giving your files to a dedicated CD production unit who do all
the necessary stuff, including exhaustive antivirus checking.

 

[Greg Hennessy]

Please provide an IT industry White Paper or some other professional
literature to support this seemingly absurd assertion.

If you are going to quote one out of context, I suggest reading what I
wrote elsewhere in the thread.


greg

 

[Greg Hennessy]

Thanks, Greg. And they probably will be a bit paranoid about this. Our
systems and procedures have to satisfy DoD requirements.

If that's the case, it'll be a site to site vpn to carry the extranet
traffic.



greg