Published on December 1, 2005 By just john In Work Reports
I am a net admin for a small company. We have roughly 100 employees at 4 sites. We really do our best to provide as much protection for our business without spending any more money than necessary. We outsource our mail filtering so that we do not need to hire an additional person to manage it and so on.

In our main office our physical security is great. We have card access doors and you can't get on the floor without passing 3 or 4 cameras even if you bypass the receptionist and come in the back door (not really the back door but the side).

You can have all of the software and hardware protection you want but someone walking in, sitting down and plugging in can be your worst nightmare. I would love to hang Cisco switches in the rack. I have had the discussion with the Cisco rep more times than I care to but the cold hard facts are that we just can't spend that kind of money on technology.

We spend our money on people. Yes, I know that is a strange concept to some of you. We are paid well based on our area and job responsibilities. That pay comes with a price. We (the IT dept) ask that everyone be diligent about who they let plug in where.

Our main office usually doesn't have any issues with physical security. Namely, because you just can't walk right in. Our small offices (2-3 people) don't really have physical security problems because they are so small. However, our largest satellite office isn't all that well protected. We share the floor with a long time friend of our company. I think we have been sharing office space for over 10 years now. We also sublet some of our floor space to another company because even though we may be able to office 15 people there are usually only 2 or 3 there.

This is where the problem comes in. A person in charge of controlling the flow of people in and out of that office is sometimes AWOL. Sometimes they just let people come right in, sit down and plug in. In most of our offices we have a public and private network. (It always pays to have a redundant connection to the net) In this office we are doing some reworking of circuits so we had placed a cancel order for one circuit to be done right around the time its replacement was to be installed. Well, now there are delays with the new circuit and no old one.

Apparently someone really needed a connection to the net so they were allowed to sit down and plug in. (Sober is running rampant in our industry now.) All in all I spent a couple of hours trying to figure out why our mail server stopped responding (which was nothing ... it was fine, just hosed up by something - I wonder what?), scanning my local network for issues and turing my remote offices off completely. (Yes those folks are getting paid for doing nothing.) I had to pull the VPN plug because I can't take the risk that it is a remotely infected PC. (even though I know it's not - I know the person that was allowed to plug in and I also know that he has had this virus by the admission of the person who let him plug in)

In an hour or so when I can be sure that our data network is safe I will plug them back in. Who knows? I might get lucky and get to disable an account today. Some people will just never get it no matter how many times you tell them. “No one plugs into our private network that does not have a company owned PC or laptop.” No means NO!

Comments
on Dec 01, 2005
Oh, I feel your pain!!
on Dec 01, 2005
I call the PEBCAK, ID - Ten - Tees something different.  I call them Job Security! We had a virus pollute our network a year ago.  One of the very fast spreading ones (came in a zip) that our Norton had not guarded against yet.  And regardless of how many times we have told people not to open attachments unless they know what they are, 2 did anyway.
on Dec 01, 2005
Reply By: xtine


Well ... with any luck ... the culprit will feel my pain too
on Dec 01, 2005
There are ways to restrict who can and can't get network access without hanging expensive cisco equipment on the rack.

One way is to only activate ports where there's an in-use computer. If a port is needed, plug it in at the patch panel. This is the easiest way to do a bit of physical network security

Another way, if you're a Windows shop, is to link your Exchange servers and other network services to AD credentials. This will let you to some degree partition off what's available to who depending on if they're a valid logged-in entity.

For smaller offices, you can also put up a cheap-o PC with a gigabit NIC in it, and set it up as a NAT box. Define MAC addresses that get IPs through that. That way, NOTHING gets beyond the local network closet if it hasn't been OK'd by IT.

Just some thoughts on how to keep those random people away from your network without tossing in too much cash.
on Dec 01, 2005
And regardless of how many times we have told people not to open attachments unless they know what they are, 2 did anyway.


We started using Postin Link a couple of years ago. I haven't had a single virus bypass their network in two years. We have only had to deal with internal problems.
on Dec 01, 2005
One way is to only activate ports where there's an in-use computer


Yeah ... This was my intention when we went down a couple of weeks ago and rewired that office. I just never got around to it.
on Dec 01, 2005

We started using Postin Link a couple of years ago. I haven't had a single virus bypass their network in two years. We have only had to deal with internal problems.

We have a security group in love with sendmail and themselves.  Of course they never make mistakes!

on Dec 01, 2005
Where I work, we're looking to outsource perimeter email too. We looked at Postini, but it actually does LESS than what we do in-house right now, and they cost a fortune. We're examining better services (in terms of features and price) from IBM (who resell MessageLabs) and Symantec's Managed Service.

Problem with Postini is that it won't protect you from the 0-day outbreaks if they get to you. They have to wait for the AV vendors to update with a signature for the new virus. For a small company, that's not an issue since the chances of getting hit in that first 10-12hrs is slim, but for anything much larger, Postini just isn't where it needs to be right now compared to the competition.
on Dec 01, 2005
Problem with Postini is that it won't protect you from the 0-day outbreaks if they get to you


Yeah, for us this is great. A few bucks per user each month is much more manageable. I also work in oil and gas exploration and production. A big chief tablet and a pencil is the way our field personell would work if we let them. Of course the average age of one of our well site supervisors is over 55.