31. January 2012 by admin.

My company, Networking Delaware, spends much of its time and energy trying, with various degrees of success, to protect our clients from attacks by everyone from established hackers to script kiddies. It is very disheartening to work to harden a network only to have it compromised by an uninformed employee clicking some tempting link in a phishing email.

To this end we were very happy to learn the following:

 Google, Yahoo, Microsoft, PayPal, Facebook, LinkedIn, Comcast and AOL along with seven other companies are backing a new initiative intended to dramatically reduce “phishing” emails.  This type of email attack is the most prevalent method hackers use today to breach security. It is as much of a Trojan Horse as contemporary Trojan malware is, and just as effective. For the hacker, it is safer and costs them less in time and energy than hacking directly at hardened systems with safeguards in place.

To achieve this protection, the firms have created DMARC.org, a working group of 15 companies that plans to promote a standard set of technologies that they say will lead to more secure email.

PayPal, for instance has been using these authentication technologies with Yahoo’s email service since 2007 and with Google’s gmail since 2008, and is now blocking about 200,000 fake emails per day

It is said it won’t cost a lot for companies to start using the standards, but it will require them to identify every server that sends email and ensure that the technologies are in use. The same holds true for third-party firms such as marketing agencies that send email on behalf of a company

The DMARC working group officially launches Today, January 31^st

While I see problems ahead for implementation, this is a good step in the right direction.

Posted in MicroSoft, Phishing, Social Engineering, Windows, email, Acceptable Use, e-mail, Malware | Print | No Comments »

2. July 2008 by admin.

I just read a story where is was stated that one in three technology professionals admitted to snooping on their fellow colleagues. Here is the story.

I know I am opening myself up for criticism from the geek community, but I find that absolutely reprehensible. The epitaph “Holier then thou” comes to mind, but I really mean it… using your administrative privileges to snoop on others is not only immoral but usually illegal.

All that is required is a little self-discipline with a smidgen of empathy thrown in, and those urges can be shoved aside.  Believe me… I’ve been tempted, but realizing the potential for abuse I have set my mind on operating at a higher plane.   Integrity costs you nothing…dishonesty can cost you everything.

This is not to say that users should not be monitored.  If the company has a valid Acceptable Use Policy in effect, then it may become your job to monitor their actions.

It simply has to be done fairly and across the board…everyone or no one, and with no personal interest.

I have found Spectorsoft (Spector CNE) to be a great monitoring system.  It meets the criteria for automated monitoring of all employees’ actions. Here at my Wilmington Delaware network support company, Admin Associates, we have been using and recommending it for several years.  You can see exactly what a specific user is doing in near-realtime and you have a history of past actions as well. The monitoring is done on a user by user basis and is not machine specific.

You don’t need to read an employee’s mail to see they are receiving more non-business mail then legitimate correspondence. Usually the subject line can give it way.  If you MUST read the mail to ascertain it relevance, a brief scan will almost always clue you in to what the message is all about.

If company policy says IM’s are too much of a security risk, then you don’t need to read the individual IM’s to know the user is violating the rules.

You can see who is browsing to eBay more then to the company Intranet…it’s not necessary to see what they were bidding on, or if they won!

When it becomes your unpleasant duty to drop a dime on the offending user, you can usually pass along the decision to carry out further “snooping” activities to a higher pay grade.  They often have err…less stringent standards then we admins do.

Good Luck and Good Networking

From way down in the trenches … I’m Tom

Custom Search

Posted in honesty, integrity, Acceptable Use, Monitoring, Networking, Administration, Computers | Print | 1 Comment »