MAJOR RANT: These fvckign @sshole system admins!!!!

[n0cmonkey]

A thumbdrive would have solved this whole thing... I'll send you a 16MB one, if you're that desperate. :heart:

 

[spidey07]

Originally posted by: acemcmac

Originally posted by: werk
Maybe you should quit whining here and figure out a way to "get your fvcking work done."

I did, I needed a file from my home server, got it via remote desktop and sent it off to the prof.

Been having problems with the FTP server I use as backup for the same purpose, so I was a little screwed there....

Originally posted by: spidey07

Originally posted by: acemcmac

Originally posted by: n0cmonkey

Originally posted by: acemcmac

It's against policy, that's enough of a reason.

No, it's not. I helped write this school's network administration policies before I got a better offer. They just think they know better what I want to do with the comptuer than I do and deleted "extraneous and confusing information." To this day, I am the only administrator on the network after hours and the one of the only people with the authority to reverse access suspensions on the residental network. I have never needed M$ administrator access and have never asked for it. This kind of stuff is just unbelieveable.

If you wrote the policies and did not ban remote desktop and similar software, you missed quite a bit. Bad policy bitch, bad.

If you have no servers that allow such a primative protocol to gain access to them, what in the hell are you vounerable to? Someone using their home computer to print to the computer on their desk? Someone uploading malicious files that your firewall should be intercepting? This traffic isn't even leaving the gateway.... it's packet shaped out... this is traveling across the lan strictly..... no reason at all for it to be blocked

oh please Mr. Network Security guru, explain to us how a firewall can stop malicous files or code?

Or for that matter malicous activity at all.

Is there any encryption on remote desktop at all? If Cisco has firmwares that, at swich level, can identify and remove common variants of worms etc, firewalls can be configured to provide the same basic security to primative remote sessions. Anything you are exposing yourself to by allowing remote desktop, you are already exposing yourself to by not doing a pat down search of every client looking for their thumbdrives or cdrom's....

Layer 2-4 devices cannot inspect layer 7 traffic. Please explain how a firewall is to block malicous code.

Id also like to know how a layer 2 device (as you explained) can identify and remove a worm - given that you belive even a layer4 device can do it (which it can't)

 

[acemcmac]

Originally posted by: spidey07

Originally posted by: acemcmac

Originally posted by: n0cmonkey

Originally posted by: acemcmac

Originally posted by: n0cmonkey

Originally posted by: acemcmac

It's against policy, that's enough of a reason.

No, it's not. I helped write this school's network administration policies before I got a better offer. They just think they know better what I want to do with the comptuer than I do and deleted "extraneous and confusing information." To this day, I am the only administrator on the network after hours and the one of the only people with the authority to reverse access suspensions on the residental network. I have never needed M$ administrator access and have never asked for it. This kind of stuff is just unbelieveable.

If you wrote the policies and did not ban remote desktop and similar software, you missed quite a bit. Bad policy bitch, bad.

If you have no servers that allow such a primative protocol to gain access to them, what in the hell are you vounerable to? Someone using their home computer to print to the computer on their desk? Someone uploading malicious files that your firewall should be intercepting? This traffic isn't even leaving the gateway.... it's packet shaped out... this is traveling across the lan strictly..... no reason at all for it to be blocked

What isn't necessary, is bad.

Wrong. Again, that is the coorperate paradigm. In a corperation, IT is responsible to management and ownership. When IT does not accomidate them, they are useless and need to go. In education, IT is responsible to the faculty and students. When IT does not accomidate them, they are useless and need to go.

Wrong. IT is just another department that answers to the food chain. That food chain reports to owners. Ownsers report to auditors. It has nothing to do with students/faculty/employees, etc. Nothing whatsoever.

College of DuPont, (first google hit) Office of Information Technology Mission Statement, 4th bullet

Develop and maintain highly effective, reliable, secure, and innovative information systems to support instructional, administrative and research functions.

You just got served

 

[spidey07]

Originally posted by: acemcmac

Originally posted by: spidey07

Originally posted by: acemcmac

Originally posted by: spidey07

Originally posted by: n0cmonkey

Originally posted by: acemcmac

It's against policy, that's enough of a reason.

No, it's not. I helped write this school's network administration policies before I got a better offer. They just think they know better what I want to do with the comptuer than I do and deleted "extraneous and confusing information." To this day, I am the only administrator on the network after hours and the one of the only people with the authority to reverse access suspensions on the residental network. I have never needed M$ administrator access and have never asked for it. This kind of stuff is just unbelieveable.

If you wrote the policies and did not ban remote desktop and similar software, you missed quite a bit. Bad policy bitch, bad.

yeah, I'm thinking he didn't take "network operations" 101.

I have yet to hear one good reason why it should be banned in an educational setting that you can't cover with other bases. You suck.

Its a remote control tool.

Good security policy as dictated in "network operations 101" is not allowed nor should it be. Ever been audited? It wasn't the evil sys admins call, it came from much higher up.

Oh NO, NOT AN EVIL REMOTE CONTROL TOOL :roll:. If you have a server that is voulnerable to an attack from a domestic remote control client, then you have bigger problems to worry about. I have had formal network security training, and security policies start at the servers. Client security should be considered invalaid just by leaving a human being alone with an ethernet jack.

And in your training you should have learned that basics....

Servers are easy to protect, the clients are not and is where most security actions should be focused.

Especially remote control tools....I mean c'mon dude. That is right up there with PCanywhere and a modem or allowing null passwords.

 

[acemcmac]

Originally posted by: spidey07

Originally posted by: acemcmac

Originally posted by: werk
Maybe you should quit whining here and figure out a way to "get your fvcking work done."

I did, I needed a file from my home server, got it via remote desktop and sent it off to the prof.

Been having problems with the FTP server I use as backup for the same purpose, so I was a little screwed there....

Originally posted by: spidey07

Originally posted by: acemcmac

Originally posted by: n0cmonkey

Originally posted by: acemcmac

It's against policy, that's enough of a reason.

No, it's not. I helped write this school's network administration policies before I got a better offer. They just think they know better what I want to do with the comptuer than I do and deleted "extraneous and confusing information." To this day, I am the only administrator on the network after hours and the one of the only people with the authority to reverse access suspensions on the residental network. I have never needed M$ administrator access and have never asked for it. This kind of stuff is just unbelieveable.

If you wrote the policies and did not ban remote desktop and similar software, you missed quite a bit. Bad policy bitch, bad.

If you have no servers that allow such a primative protocol to gain access to them, what in the hell are you vounerable to? Someone using their home computer to print to the computer on their desk? Someone uploading malicious files that your firewall should be intercepting? This traffic isn't even leaving the gateway.... it's packet shaped out... this is traveling across the lan strictly..... no reason at all for it to be blocked

oh please Mr. Network Security guru, explain to us how a firewall can stop malicous files or code?

Or for that matter malicous activity at all.

Is there any encryption on remote desktop at all? If Cisco has firmwares that, at swich level, can identify and remove common variants of worms etc, firewalls can be configured to provide the same basic security to primative remote sessions. Anything you are exposing yourself to by allowing remote desktop, you are already exposing yourself to by not doing a pat down search of every client looking for their thumbdrives or cdrom's....

Layer 2-4 devices cannot inspect layer 7 traffic. Please explain how a firewall is to block malicous code.

Id also like to know how a layer 2 device (as you explained) can identify and remove a worm - given that you belive even a layer4 device can do it (which it can't)

Owned again

 

[TheLonelyPhoenix]

Originally posted by: acemcmac

Originally posted by: spidey07

Originally posted by: acemcmac

Originally posted by: n0cmonkey

Originally posted by: acemcmac

Originally posted by: n0cmonkey

Originally posted by: acemcmac

It's against policy, that's enough of a reason.

No, it's not. I helped write this school's network administration policies before I got a better offer. They just think they know better what I want to do with the comptuer than I do and deleted "extraneous and confusing information." To this day, I am the only administrator on the network after hours and the one of the only people with the authority to reverse access suspensions on the residental network. I have never needed M$ administrator access and have never asked for it. This kind of stuff is just unbelieveable.

If you wrote the policies and did not ban remote desktop and similar software, you missed quite a bit. Bad policy bitch, bad.

If you have no servers that allow such a primative protocol to gain access to them, what in the hell are you vounerable to? Someone using their home computer to print to the computer on their desk? Someone uploading malicious files that your firewall should be intercepting? This traffic isn't even leaving the gateway.... it's packet shaped out... this is traveling across the lan strictly..... no reason at all for it to be blocked

What isn't necessary, is bad.

Wrong. Again, that is the coorperate paradigm. In a corperation, IT is responsible to management and ownership. When IT does not accomidate them, they are useless and need to go. In education, IT is responsible to the faculty and students. When IT does not accomidate them, they are useless and need to go.

Wrong. IT is just another department that answers to the food chain. That food chain reports to owners. Ownsers report to auditors. It has nothing to do with students/faculty/employees, etc. Nothing whatsoever.

College of DuPont, (first google hit) Office of Information Technology Mission Statement, 4th bullet

Develop and maintain highly effective, reliable, secure, and innovative information systems to support instructional, administrative and research functions.

You just got served

Are you telling me that mission statements actually mean something?

 

[spidey07]

Originally posted by: acemcmac

Originally posted by: spidey07

Originally posted by: acemcmac

Originally posted by: n0cmonkey

Originally posted by: acemcmac

Originally posted by: n0cmonkey

Originally posted by: acemcmac

It's against policy, that's enough of a reason.

No, it's not. I helped write this school's network administration policies before I got a better offer. They just think they know better what I want to do with the comptuer than I do and deleted "extraneous and confusing information." To this day, I am the only administrator on the network after hours and the one of the only people with the authority to reverse access suspensions on the residental network. I have never needed M$ administrator access and have never asked for it. This kind of stuff is just unbelieveable.

If you wrote the policies and did not ban remote desktop and similar software, you missed quite a bit. Bad policy bitch, bad.

If you have no servers that allow such a primative protocol to gain access to them, what in the hell are you vounerable to? Someone using their home computer to print to the computer on their desk? Someone uploading malicious files that your firewall should be intercepting? This traffic isn't even leaving the gateway.... it's packet shaped out... this is traveling across the lan strictly..... no reason at all for it to be blocked

What isn't necessary, is bad.

Wrong. Again, that is the coorperate paradigm. In a corperation, IT is responsible to management and ownership. When IT does not accomidate them, they are useless and need to go. In education, IT is responsible to the faculty and students. When IT does not accomidate them, they are useless and need to go.

Wrong. IT is just another department that answers to the food chain. That food chain reports to owners. Ownsers report to auditors. It has nothing to do with students/faculty/employees, etc. Nothing whatsoever.

College of DuPont, (first google hit) Office of Information Technology Mission Statement, 4th bullet

Develop and maintain highly effective, reliable, secure, and innovative information systems to support instructional, administrative and research functions.

You just got served

I come from the real world, not what you find on google. Lip service from a department is just that, lip service. If you came from the "real world" as well you would know how truthful mission statements are.

next?

 

[acemcmac]

Originally posted by: spidey07

Originally posted by: acemcmac

Originally posted by: spidey07

Originally posted by: acemcmac

Originally posted by: spidey07

Originally posted by: n0cmonkey

Originally posted by: acemcmac

It's against policy, that's enough of a reason.

No, it's not. I helped write this school's network administration policies before I got a better offer. They just think they know better what I want to do with the comptuer than I do and deleted "extraneous and confusing information." To this day, I am the only administrator on the network after hours and the one of the only people with the authority to reverse access suspensions on the residental network. I have never needed M$ administrator access and have never asked for it. This kind of stuff is just unbelieveable.

If you wrote the policies and did not ban remote desktop and similar software, you missed quite a bit. Bad policy bitch, bad.

yeah, I'm thinking he didn't take "network operations" 101.

I have yet to hear one good reason why it should be banned in an educational setting that you can't cover with other bases. You suck.

Its a remote control tool.

Good security policy as dictated in "network operations 101" is not allowed nor should it be. Ever been audited? It wasn't the evil sys admins call, it came from much higher up.

Oh NO, NOT AN EVIL REMOTE CONTROL TOOL :roll:. If you have a server that is voulnerable to an attack from a domestic remote control client, then you have bigger problems to worry about. I have had formal network security training, and security policies start at the servers. Client security should be considered invalaid just by leaving a human being alone with an ethernet jack.

And in your training you should have learned that basics....

Servers are easy to protect, the clients are not and is where most security actions should be focused.

Especially remote control tools....I mean c'mon dude. That is right up there with PCanywhere and a modem or allowing null passwords.

You still completley fail to adress a single threat that Remote Desktop poises an educational environment that banning Remote Desktop would adress. I reiterate, you do not have any idea what you're talking about.

 

[Transition]

Listening to acemcmac argue with spidey07 is hillarious. Spidey knows his sh|t - you lost this arguement.

acemcmac :thumbsdown: :thumbsdown: :thumbsdown: :thumbsdown: :thumbsdown: :thumbsdown:
spidey07 :thumbsup: :thumbsup: :thumbsup: :thumbsup: :thumbsup: :thumbsup:

 

[JustAnAverageGuy]

Well, at least your admins had enough sense to turn it off.

Us? We have root access to the C:\, Registry, and device manager.

The chaos one could wreck on those computers is amazing.

 

[loup garou]

acemcmac, just give up now before you make yourself look any worse. You're playing with fire.

 

[TheLonelyPhoenix]

Originally posted by: werk
acemcmac, just give up now before you make yourself look any worse. You're playing with fire.

Shhhh... this could become Pwnage of the Year 2005.

 

[monzi]

Or, instead of biznitching, you could install tightvnc, and point IE to http://IP:5800


www.tightvnc.com

-Monzi

 

[acemcmac]

Originally posted by: spidey07

Originally posted by: acemcmac

Originally posted by: spidey07

Originally posted by: acemcmac

Originally posted by: n0cmonkey

Originally posted by: acemcmac

Originally posted by: n0cmonkey

Originally posted by: acemcmac

It's against policy, that's enough of a reason.

No, it's not. I helped write this school's network administration policies before I got a better offer. They just think they know better what I want to do with the comptuer than I do and deleted "extraneous and confusing information." To this day, I am the only administrator on the network after hours and the one of the only people with the authority to reverse access suspensions on the residental network. I have never needed M$ administrator access and have never asked for it. This kind of stuff is just unbelieveable.

If you wrote the policies and did not ban remote desktop and similar software, you missed quite a bit. Bad policy bitch, bad.

If you have no servers that allow such a primative protocol to gain access to them, what in the hell are you vounerable to? Someone using their home computer to print to the computer on their desk? Someone uploading malicious files that your firewall should be intercepting? This traffic isn't even leaving the gateway.... it's packet shaped out... this is traveling across the lan strictly..... no reason at all for it to be blocked

What isn't necessary, is bad.

Wrong. Again, that is the coorperate paradigm. In a corperation, IT is responsible to management and ownership. When IT does not accomidate them, they are useless and need to go. In education, IT is responsible to the faculty and students. When IT does not accomidate them, they are useless and need to go.

Wrong. IT is just another department that answers to the food chain. That food chain reports to owners. Ownsers report to auditors. It has nothing to do with students/faculty/employees, etc. Nothing whatsoever.

College of DuPont, (first google hit) Office of Information Technology Mission Statement, 4th bullet

Develop and maintain highly effective, reliable, secure, and innovative information systems to support instructional, administrative and research functions.

You just got served

I come from the real world, not what you find on google. Lip service from a department is just that, lip service. If you came from the "real world" as well you would know how truthful mission statements are.

next?

sure, next thing you're going to tell me is that educational environments mandate that kids in dorms run the latest ghost images and are locked into the domain for security.... This is not how education works. That is how corperations work. Admit that you have no idea what you are talking about. State Universities are just as beholden to their sworn mission statements as the President is to look out for the best interests of the country- It's all government

 

[n0cmonkey]

Originally posted by: acemcmac

You still completley fail to adress a single threat that Remote Desktop poises an educational environment that banning Remote Desktop would adress. I reiterate, you do not have any idea what you're talking about.

One single moron allowing it without knowing what it is or what it does is reason enough. Just what you need, a professor allowing the students to control his PC.

 

[spidey07]

Originally posted by: acemcmac

Originally posted by: spidey07

Originally posted by: acemcmac

Originally posted by: werk
Maybe you should quit whining here and figure out a way to "get your fvcking work done."

I did, I needed a file from my home server, got it via remote desktop and sent it off to the prof.

Been having problems with the FTP server I use as backup for the same purpose, so I was a little screwed there....

Originally posted by: spidey07

Originally posted by: acemcmac

Originally posted by: n0cmonkey

Originally posted by: acemcmac

It's against policy, that's enough of a reason.

No, it's not. I helped write this school's network administration policies before I got a better offer. They just think they know better what I want to do with the comptuer than I do and deleted "extraneous and confusing information." To this day, I am the only administrator on the network after hours and the one of the only people with the authority to reverse access suspensions on the residental network. I have never needed M$ administrator access and have never asked for it. This kind of stuff is just unbelieveable.

If you wrote the policies and did not ban remote desktop and similar software, you missed quite a bit. Bad policy bitch, bad.

If you have no servers that allow such a primative protocol to gain access to them, what in the hell are you vounerable to? Someone using their home computer to print to the computer on their desk? Someone uploading malicious files that your firewall should be intercepting? This traffic isn't even leaving the gateway.... it's packet shaped out... this is traveling across the lan strictly..... no reason at all for it to be blocked

oh please Mr. Network Security guru, explain to us how a firewall can stop malicous files or code?

Or for that matter malicous activity at all.

Is there any encryption on remote desktop at all? If Cisco has firmwares that, at swich level, can identify and remove common variants of worms etc, firewalls can be configured to provide the same basic security to primative remote sessions. Anything you are exposing yourself to by allowing remote desktop, you are already exposing yourself to by not doing a pat down search of every client looking for their thumbdrives or cdrom's....

Layer 2-4 devices cannot inspect layer 7 traffic. Please explain how a firewall is to block malicous code.

Id also like to know how a layer 2 device (as you explained) can identify and remove a worm - given that you belive even a layer4 device can do it (which it can't)

Owned again

I am intimately familiar with netflow and the third party tools to analyze the information provided.

Please explain how netflow can remove a worm as you posted and I quote again...
"If Cisco has firmwares that, at swich level, can identify and remove common variants of worms etc, firewalls can be configured to provide the same basic security to primative remote sessions"

And for your information software running on Cisco Systems router and switches is called IOS or CatOS, not firmware. We reserve firmware for the kiddy linksys stuff.

Look kid, I've been doing this stuff quite a long time now and your gripes have all been heard before. If you wanna "own" then provide your own insight, not something you found on google.

 

[n0cmonkey]

Originally posted by: acemcmac
sure, next thing you're going to tell me is that educational environments mandate that kids in dorms run the latest ghost images and are locked into the domain for security.... This is not how education works. That is how corperations work. Admit that you have no idea what you are talking about. State Universities are just as beholden to their sworn mission statements as the President is to look out for the best interests of the country- It's all government

Some universities do use domains for their students.

 

[n0cmonkey]

Originally posted by: spidey07
I am intimately familiar with netflow and the third party tools to analyze the information provided.

Please explain how netflow can remove a worm as you posted and I quote again...
"If Cisco has firmwares that, at swich level, can identify and remove common variants of worms etc, firewalls can be configured to provide the same basic security to primative remote sessions"

And for your information software running on Cisco Systems router and switches is called IOS or CatOS, not firmware. We reserve firmware for the kiddy linksys stuff.

Look kid, I've been doing this stuff quite a long time now and your gripes have all been heard before. If you wanna "own" then provide your own insight, not something you found on google.

:laugh::laugh::beer::laugh::laugh:

 

[loup garou]

Originally posted by: acemcmac

Originally posted by: spidey07

Originally posted by: acemcmac

Originally posted by: werk
Maybe you should quit whining here and figure out a way to "get your fvcking work done."

I did, I needed a file from my home server, got it via remote desktop and sent it off to the prof.

Been having problems with the FTP server I use as backup for the same purpose, so I was a little screwed there....

Originally posted by: spidey07

Originally posted by: acemcmac

Originally posted by: n0cmonkey

Originally posted by: acemcmac

It's against policy, that's enough of a reason.

No, it's not. I helped write this school's network administration policies before I got a better offer. They just think they know better what I want to do with the comptuer than I do and deleted "extraneous and confusing information." To this day, I am the only administrator on the network after hours and the one of the only people with the authority to reverse access suspensions on the residental network. I have never needed M$ administrator access and have never asked for it. This kind of stuff is just unbelieveable.

If you wrote the policies and did not ban remote desktop and similar software, you missed quite a bit. Bad policy bitch, bad.

If you have no servers that allow such a primative protocol to gain access to them, what in the hell are you vounerable to? Someone using their home computer to print to the computer on their desk? Someone uploading malicious files that your firewall should be intercepting? This traffic isn't even leaving the gateway.... it's packet shaped out... this is traveling across the lan strictly..... no reason at all for it to be blocked

oh please Mr. Network Security guru, explain to us how a firewall can stop malicous files or code?

Or for that matter malicous activity at all.

Is there any encryption on remote desktop at all? If Cisco has firmwares that, at swich level, can identify and remove common variants of worms etc, firewalls can be configured to provide the same basic security to primative remote sessions. Anything you are exposing yourself to by allowing remote desktop, you are already exposing yourself to by not doing a pat down search of every client looking for their thumbdrives or cdrom's....

Layer 2-4 devices cannot inspect layer 7 traffic. Please explain how a firewall is to block malicous code.

Id also like to know how a layer 2 device (as you explained) can identify and remove a worm - given that you belive even a layer4 device can do it (which it can't)

Owned again

How the hell was he owned? The guy (not the router) in the article used the output from a traffic monitoring tool to identify a worm. The guy, not the router, fixed the problem (which, according to you, shouldn't have even entered the network anyways!).

 

[spidey07]

Originally posted by: acemcmac

Originally posted by: spidey07

Originally posted by: acemcmac

Originally posted by: spidey07

Originally posted by: acemcmac

Originally posted by: n0cmonkey

Originally posted by: acemcmac

Originally posted by: n0cmonkey

Originally posted by: acemcmac

It's against policy, that's enough of a reason.

No, it's not. I helped write this school's network administration policies before I got a better offer. They just think they know better what I want to do with the comptuer than I do and deleted "extraneous and confusing information." To this day, I am the only administrator on the network after hours and the one of the only people with the authority to reverse access suspensions on the residental network. I have never needed M$ administrator access and have never asked for it. This kind of stuff is just unbelieveable.

If you wrote the policies and did not ban remote desktop and similar software, you missed quite a bit. Bad policy bitch, bad.

If you have no servers that allow such a primative protocol to gain access to them, what in the hell are you vounerable to? Someone using their home computer to print to the computer on their desk? Someone uploading malicious files that your firewall should be intercepting? This traffic isn't even leaving the gateway.... it's packet shaped out... this is traveling across the lan strictly..... no reason at all for it to be blocked

What isn't necessary, is bad.

Wrong. Again, that is the coorperate paradigm. In a corperation, IT is responsible to management and ownership. When IT does not accomidate them, they are useless and need to go. In education, IT is responsible to the faculty and students. When IT does not accomidate them, they are useless and need to go.

Wrong. IT is just another department that answers to the food chain. That food chain reports to owners. Ownsers report to auditors. It has nothing to do with students/faculty/employees, etc. Nothing whatsoever.

College of DuPont, (first google hit) Office of Information Technology Mission Statement, 4th bullet

Develop and maintain highly effective, reliable, secure, and innovative information systems to support instructional, administrative and research functions.

You just got served

I come from the real world, not what you find on google. Lip service from a department is just that, lip service. If you came from the "real world" as well you would know how truthful mission statements are.

next?

sure, next thing you're going to tell me is that educational environments mandate that kids in dorms run the latest ghost images and are locked into the domain for security.... This is not how education works. That is how corperations work. Admit that you have no idea what you are talking about. State Universities are just as beholden to their sworn mission statements as the President is to look out for the best interests of the country- It's all government

Again, I'll reiterate my experience having designed and built network strategies for Purdue University, University of North Carolina and some work at the pentagon (with associated clearence)

A security policy is developed with input from the network security department, ops, support and officer level. Once it is agreed upon technology is used to enforce that policy.

One of the most basic components of security policy is remote control. It has been decided that the network you are attached to will not allow remote control software.

But hey if you want to get around that policy then by all means do, its not hard.

So how does a layer4 firewall in combination with layer 2-3 routers and switches stop malicious code, let alone remove it?

Wouldn't you need some kind of layer7 device? say a scrubber? I'm still confused how a layer4 device can analyze layer7 traffic/behavior.

I mean sure you can do the basic IDS stuff with a layer3 device to detect and possibly take action of malicous activity (scanning, know exploits, known worm signatures, IPS hits), but no way in hell would any of that stop malicous activity flowing over a remote control session.

none.

Now that I've schooled you on network security I'll expound a bit. Its called defense in depth - the switches do what they can, the routers do what they can, the firewalls do what they can, the IDS/IPS do what they can.....and that's all they can do.

The security policy takes care of the rest by dictating the "policy" of what the end nodes can or cannot do. That policy is then translated into software - group policy, requiring an agent on each and every host to ensure compliance, etc. In the end it has to do with running code and the only way to prevent code running on a host is by having something on the host.

 

[acemcmac]

Originally posted by: n0cmonkey

Originally posted by: acemcmac

You still completley fail to adress a single threat that Remote Desktop poises an educational environment that banning Remote Desktop would adress. I reiterate, you do not have any idea what you're talking about.

One single moron allowing it without knowing what it is or what it does is reason enough. Just what you need, a professor allowing the students to control his PC.

You ghosted that pc. You dened the prof admin access, you left its adress externally adressable, if it gets rconned, that's your fault.

and as far as the Cisco stuff goes, I forget if it was from Network Computing, or from the Cisco rep I met with this summer prior to our selection of vendor for the new on-campus construction, but I know that the new magic product was going to be switches that could run their own traffic intradiction. Sorry if I grabbed the wrong link.

Wanna call me a kiddie? Fine, but don't even pretend that your corperate logic even applies to an academic insitution. In this state, it is policy, that even if a client on the state system network is grossly abusing the bandwith, we may NOT turn him or her off completley. We must thorottle them down to no less than 56k speed because we are not allowed to deny or obstruct the freedom of that client to access the information. Does it make sense? No. Does it defy corperate logic? Yes. Does having RCON allowed Defy corperate logic? Yes. Is denying RCON necessary for an academic institution? No, absolutley not- and that was my whole point.

Ironically, now that I've been pondering it.... the removing of the shortcut to remote desktop was probably more the decision of the inteirn who made the ghost image for the library and less that of a site wide policy because no other labs are like that.

 

[acemcmac]

Originally posted by: spidey07

Originally posted by: acemcmac

Originally posted by: spidey07

Originally posted by: acemcmac

Originally posted by: spidey07

Originally posted by: acemcmac

Originally posted by: n0cmonkey

Originally posted by: acemcmac

Originally posted by: n0cmonkey

Originally posted by: acemcmac

It's against policy, that's enough of a reason.

No, it's not. I helped write this school's network administration policies before I got a better offer. They just think they know better what I want to do with the comptuer than I do and deleted "extraneous and confusing information." To this day, I am the only administrator on the network after hours and the one of the only people with the authority to reverse access suspensions on the residental network. I have never needed M$ administrator access and have never asked for it. This kind of stuff is just unbelieveable.

If you wrote the policies and did not ban remote desktop and similar software, you missed quite a bit. Bad policy bitch, bad.

If you have no servers that allow such a primative protocol to gain access to them, what in the hell are you vounerable to? Someone using their home computer to print to the computer on their desk? Someone uploading malicious files that your firewall should be intercepting? This traffic isn't even leaving the gateway.... it's packet shaped out... this is traveling across the lan strictly..... no reason at all for it to be blocked

What isn't necessary, is bad.

Wrong. Again, that is the coorperate paradigm. In a corperation, IT is responsible to management and ownership. When IT does not accomidate them, they are useless and need to go. In education, IT is responsible to the faculty and students. When IT does not accomidate them, they are useless and need to go.

Wrong. IT is just another department that answers to the food chain. That food chain reports to owners. Ownsers report to auditors. It has nothing to do with students/faculty/employees, etc. Nothing whatsoever.

College of DuPont, (first google hit) Office of Information Technology Mission Statement, 4th bullet

Develop and maintain highly effective, reliable, secure, and innovative information systems to support instructional, administrative and research functions.

You just got served

I come from the real world, not what you find on google. Lip service from a department is just that, lip service. If you came from the "real world" as well you would know how truthful mission statements are.

next?

sure, next thing you're going to tell me is that educational environments mandate that kids in dorms run the latest ghost images and are locked into the domain for security.... This is not how education works. That is how corperations work. Admit that you have no idea what you are talking about. State Universities are just as beholden to their sworn mission statements as the President is to look out for the best interests of the country- It's all government

Again, I'll reiterate my experience having designed and built network strategies for Purdue University, University of North Carolina and some work at the pentagon (with associated clearence)

A security policy is developed with input from the network security department, ops, support and officer level. Once it is agreed upon technology is used to enforce that policy.

One of the most basic components of security policy is remote control. It has been decided that the network you are attached to will not allow remote control software.

But hey if you want to get around that policy then by all means do, its not hard.

So how does a layer4 firewall in combination with layer 2-3 routers and switches stop malicious code, let alone remove it?

I will try to find a better source for you when I get back home, it's the least I owe you. Thank you for your input, but I gotta scram now... meeting las chicas at the gym.

You seriously have to explain to me WHY "banning" remote control is productive at all though... I still don't understand that....

 

[spidey07]

If you had a known backdoor trojan running on port 5555 would you willingly allow that port free reign on a network?

Remote desktop is the same.

But in fun, just tunnel everything through 443 and you'll be just fine. That's what we're really afraid of because there is nothing we can do to stop it. Layer7 devices can detect applications no matter what port they are running on (think "run any program over port 80"), if its encrypted there isn't jack we can do.

Which is why I really hate the idea of SSL VPNs.

-edit- Cisco is promising a lot these days, the goal being to build layer2-4 intelligence into their switches to detect and act on bad stuff. Their self-defending network initiative. Right now their IOS routers have the basics of identifying bad stuff. Switches do not, although it is promised in phase 2 of NAC. Which according to my inside sources is in a few months, but we've been hearing that for a few months now.

NAC:
http://www.cisco.com/applicati...t_0900aecd800fdd58.pdf
http://www.cisco.com/applicati...t_0900aecd800fdd58.pdf
http://www.cisco.com/applicati...t_0900aecd80217e26.pdf

 

[Spencer278]

How the hell does removing remote access client improve security. That is like cutting off everyone hands at the college so they can't open your unlocked door. Might I suggest fixing the rooted boxes. All someone would have to do to get around your 'security" is bring a laptop.

 

[Childs]

dude. Its not your computer, it'd be best if you just got over it. Admins are paid to manage every network resource. If you don't like it, use a computer with a different policy. All they did was remove the shortcut. If that jacked you up that bad, then maybe you shouldn't be using RD in the first place.