Porn-loving US official spreads malware to government network
bbc.com
bbc.com
I find it more disgraceful that the Sys Admins of said Federal Agency aren't using GPOs to block unauthorized USB devices, than that fact than an employee was looking at porn.
The other half was from people who opened email attachments from pretty much anyone.
The "cryptolockers" not, and what also regularly happened in the IE heydays was that suddenly there's a dozen toolbars in IE and every click anywhere would trigger another popup window with ads.
Also, malware with only regular user permissions can only do so much. This isn't like the good old days where everyone was logged into an administrator account or local privilege escalations were bountiful. Nowadays, you're stuck in an unprivileged login session that can't normally install a rootkit without giving yourself away via a UAC prompt.
And most importantly, why is there no mention of termination of employment? How can someone spend all day at work browsing porn and jeopardize the network with malware/viruses and still be employed?
After doing some government consulting work, this does not surprise me in the slightest.
...but porn sites wouldn't work like that, would they?
Also,surprised at the amount of responses on HN today that presume details....
This is what I was thinking of when I said "dealing with false positives"; those services make mistakes, and haven't hit every site.
The other side Ive seen is "we're all adults, we don't need any filters here" coming from the higher ups. from my experiences, that usually means someone with significant say wants to look at that shit, or more rarely, feels that filters aren't a good use of ITs time.
just CYA on everything in those situations because it usually will end with fingers pointed at IT
Intercepting firewalls like bluecoat are notoriously overbroad (and arguably open up MITM attacks on https). Desktop/laptop malware scanners notoriously use up CPU at murphaicly inconvenient moments.
Educating users is great, but attacks are getting sophisticated and it only takes one mistake.
Absent great intrusion detection, which I assume is not trivial, one that mistake is made, you have big problems. What is a realistic approach?
- Using a good OS (e.g. Linux w/ SELinux)
- Not giving admin access
- Block non-authorized peripherals
- Lock down network
You don't have to educate users if they can't make mistakes.
This isn't true at all. Sure for many "traditional" AV solutions it might be. But there is a pretty strong growing trend to use "next-gen" endpoint/AV protection that is extremely lightweight, so much so that users won't see any impact at all.
https://www.sentinelone.com/ https://www.crowdstrike.com/ https://www.carbonblack.com/
Maybe Desktop-as-a-Service like with AWS Workspaces?
Or locked down, highly controlled devices like Chromebooks or a yet to be released Windowsbook?
...seriously? They want to make life harder for people that have legitimate USB mass storage needs because of this?
Do they have a DLP solution? DLP software can restrict what gets copied to and from a drive. Software restriction policies can be pushed to prevent execution from removable drives. Mind you,they said an "IT policy" meaning a rule that punishes anyone who uses a USB drive. This is the equivalent of your house getting broken into and your response is to have a rule thay punishes people for leaving the door unlocked instead of getting a home security system.
Also,why is this a bbc news story?
There are better ways to handle file sharing than removable storage if an employee needs it
I disagree with what you said in that I believe "most businesses" need granular security policies that should be applied for specific departments.
There maybe better ways of handling files but say you're a news corp and sources give you data over USB or a fashion company that has freelancers walk into your location's in person to hand in photoshoots and large cad files. The resteiction would have an impact both to users and to the business.
For example,I worked at a company where specific departments were not restricted from accessing any website due to the possible business impact of them not being able to reach a required site.
"We survived" is a very low standard. Security improvement should be measured against user impact and data being handled. The org. in the article does not have data confidentiality requirements that warrant such a severe user impact.
I know of first hand a corporation whose nationwide business would bw crippled by USB mass storage blanket ban. Context insensitivity is bad security.
Note that they said "IT policy that prevents", not "IT policy that prohibits". So I am not reading the implication that people who use USB drives would be punished, rather, the OS would be configured not to allow USB drives.
In general these restrictions sound good but they're really bad when applied as a blanket policy to everyone. I prefet a "default" (not blanket) ban with exception/whitelist process in place. And this ,only for data sensitive departments.
The response to lateral movement via USB mass storage should be measured to restrict that specific attack vector(execution from mass storage). It is not an excuse to recommend a policy that solves problems outside the scope of the incident. If there are data loss concerns,the policy should be made after proper risk analysis,available solutions and user+business impact.
IMO,How you do these things tends to be more important than whether they get done or not(process>practice).
"Government" is huge,the department in question does not handle confidential(classification) and above information.
Most people are not idiots when it comes to security since it is the job of system and security engineers to design a secure system for "most people" ,however a security policy that does not take into measure context specific business impact is foolish.
Even leaving malisious USBs in the targets parking lot is a viable attack.