Recently in Policy Category

Twice today I read "enterprises do this" statements that made me laugh.

Over at SANS the handler wrote "Corporates typically block outbound FTP" while describing Yahoo phishing that had FTP downloaded malware.

Later I was reading the latest AV-Comparatives report. In the discussion of numerous Sophos false positives, the author says Sophos is used in corporate environments where "new software is rarely installed."

I've been looking for reliable statistics about what percentage of companies currently allow a significant percentage of employees to have local administrator rights. When I see statements like the above I wonder if our policies which were once one of the more restrictive are now comparitively lax. Or is it that the authors are merely stating what they wish were true.

Its always nice when your own auditors follow company policy. We have an external auditor in for the next 6 week in order to obtain FISMA certification. At the kickoff meeting, we told the auditors that they were not allowed to put their computers on our internal network, but they were more than welcome to use our guest wireless. This information was also on the account request form that they signed.

I had a feeling that they weren't going to follow our policy. We don't currently have a technical mechanism in place to enforce such a policy. I opened our DHCP management console and sure enough 5 computers had a DHCP lease with a computername and domain giving away that their owner was this auditing firm.

So I was able to bust them on that, and prove to them that we do review the logs and record anomalies in servicedesk.

I was going through the outbound viruses last night. Most were false positives on espn or cnn web pages that were pasted into an email message (the scanner didn't like the javascript). But one was called Exploit/BigEmail. that sounded kind of interesting. First I did a search to look for AV vendors with a virus named that. It sounded to me like the vendor was stopping large messages to avoid denial of service attacks.

My professor posted the following guidelines for creating/evaluating an employee use policy.

Email and Internet Usage Policy

Implementation of sound, well-written policies helps manage risk by defining acceptable and unacceptable forms of behavior and educating employees as to the organization’s expectations concerning their behavior. Organizations can and should expect their employees to act ethically and the organization, as well as its employees, should expect to be accountable to society for their actions. On the positive side, good policies

encourage ethical behavior, and discourages criminal behavior,

encourage polite and civil communication,

encourage individual integrity and honesty,

encourage respect for others and their property,

protect the organization’s information infrastructure from danger, and

the risk of lawsuits.

Good policies also

discourage copyright infringement, software piracy, and plagiarism,

discourage slander, libel, defamation, and mendacity, and

discourage profanity, obscenity, pornography, and waste.

(See Kinnaman, D., Critiquing acceptable use policies. http://www.io.com/~kinnaman/aupessay.html)

The Electronic Frontier Foundation charges that this weeks appeals court decision in U.S. vs Councilman gives your ISP the right to monitor your email.

The court brief is http://www.ca1.uscourts.gov/pdf.opinions/03-1383-01A.pdf

The defendant used procmail and sendmail to monitor email from Amazon to the booksellers and other email clients that used his mailserver. He used a form of store and forward to do this. I believe the courts have held that wiretapping is grabbing the message off the line with a sniffer. It is a different charge when the mail is in storage. The courts dismissed the charges against the defendant stating that at the time the message was copied it wasn't in transit.

I agree that he is not guilty of wiretapping. I'll have to go reread the Stored Communications Act to see if his claim of being a service provider is correct. I am currently in a cyberlaw class and we read the lower court ruling on US v Councilman a couple weeks ago. So I was pretty excited to see this case.