Catch up on stories from the past week (and beyond) at the Slashdot story archive

 


Forgot your password?
Close
typodupeerror
×
Security Books Media Book Reviews

Securing IM and P2P Applications 123

Posted by samzenpus from the share-safely dept.
Ben Rothke writes "Noted security veteran Bruce Schneier has observed that for those organizations that have incorrectly deployed cryptography, it is akin to putting a big flagpole in front of your facility and hoping that it will stop any attackers from breaking in. Of course, any attacker with intelligence will simply go around the flagpole rather than running into it." Read the rest of Ben's review.
Securing IM and P2P Applications for the Enterprise
author Paul Piccard
pages 454
publisher Syngress
rating 9
reviewer Ben Rothke
ISBN 1597490172
summary How to get a handle on the increasing number of IM, P2P, and IRC applications that are found on the corporate networks


Similarly, many organizations have deployed myriad security hardware and software products in their infrastructure. But when it comes to instant messaging and peer to peer applications, these applications often execute below the radar of many security products. This is due to the fact that the security infrastructure in many organizations was not architected to deal with such applications. These applications often have so much functionality that it obviates much of the security afforded by the security hardware and software products.

Using file transfer as an example, many organizations have policies and controls in place to stop the use of protocols such as ftp and tftp. This is fine, but that will only work for the ftp protocol. File transfer can still be carried out by most instant messaging clients, and that can pose serious security risks.

With that, Securing IM and P2P Applications for the Enterprise provides an excellent overview on how to handle, manage and secure IM, P2P, and IRC applications. This book is written for security and system administrators that need specific details on how to control and secure IM, P2P and IRC applications in their organization.

The need to get a handle on IM and P2P is crucial given that IM has turned into a global communications medium with most organizations today reported that they allow it for business usage. Many marketing and technical support calls are now handled via IM and this translates in to well over 250 million IM users worldwide. P2P is great for downloading music and movies, but that that poses serious security and legal liability risks when done on most corporate networks.

But with all the benefits that IM provides, it introduces many security and privacy risks. IM viruses, identity theft issues, phishing, spyware and SPIM (SPAM over IM) are just a few of the many risks. These risks can turn into intellectual property losses and legal liability issues especially when they are combined with targeted attacks on corporate IM users. Companies that don't have an effective way in which to deal with IM and P2P are in serious danger as most IM and P2P threats fly under the radar of many traditional security solutions.

The book has a fairly straightforward approach. Chapter 1 provides an introduction to IM and the most common security issues that IM brings into an organization. The bulk of the remainder of the book details various different IM applications in Part 1 (AIM, Yahoo, MSN, ICQ, Google, Skype), P2P applications in Part 2 (Gnutella, eDonkey/eMule, BitTorrent, FastTrack) and IRC networks and applications in Part 3.

Each chapter details the specific architecture of each application, its protocols, security issues, and solutions in which to secure the application. System administrators can use many of the checklists to quickly perform the initial steps necessary to secure their organization from unauthorized IM, P2P, and IRC applications.

Each chapter also provides significant details about the internals on how each application operates. In addition, various 3rd-party tools that can be used to secure and limit the various applications are listed.

Many companies are finding that a significant amount of their bandwidth is being used by P2P applications and Part 2 describes how to secure networks from the use of P2P applications. This is not always an easy thing to carry out given that many P2P applications, such as Gnutella are designed to easily bypass many of the security control mechanisms placed against it. Administrators will find that in this case, simply blocking Gnutella ports will not block all Gnutella traffic and the application still will be able to run. What is required in this case is the use of a firewall that supports deep packet inspection. Chapter 9 helpfully lists the commands to use when using iptables to block Gnutella traffic.

Chapter 12 provides an interesting look at FastTrack, which is the P2P protocol and network used by clients such as Grokster, Morpheus and other file sharing programs. The chapter also uses Ethereal to detail the internals of FastTrack.

Part 3 deals with IRC and is the sparsest part of the book. This is due to the fact the P2P and IM are much more heavily used on enterprise networks, which this book is geared to.

The only negatives about the book are its price, and some of its formatting. At $49.95, it is on the higher-end of computer security books, with the majority of such titles being in the $25.909 - $39.99 range. The formatting uses a font size that is somewhat larger than other book. This seemingly serves to achieve a high page count.

In addition, the book often references tables of secondary information that spans a few pages (for examples see pages 72-80, 115-120 and more). Such information would be better served in a multiple-column table in a smaller font. Printing the information in such a manner can cut down on the page total, and save a few trees at the same time.

Besides those two minor issues, Securing IM and P2P Applications for the Enterprise is a most helpful guide. Security and system administrators can use the book to get a handle on the increasing number of IM, P2P, and IRC applications that are found on the corporate networks they support.

Ben Rothke, CISSP is a New York City based senior security consultant with ThruPoint, Inc. and the author of Computer Security 20 Things Every Employee Should Know (McGraw-Hill 2006) and can be reached at ben@rothke.com"

You can purchase Securing IM and P2P Applications for the Enterprise from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.
This discussion has been archived. No new comments can be posted.

Securing IM and P2P Applications More

Securing IM and P2P Applications

Comments Filter:

  • Hey! (Score:5, Funny)

    by Phae ( 920315 ) on Wednesday December 28, 2005 @01:43PM (#14353135)
    Of course, any attacker with intelligence will simply go around the flagpole rather than running into it.

    Hey! Are you calling me stupid?

    • Re:Hey! (Score:5, Funny)

      by ackthpt ( 218170 ) * on Wednesday December 28, 2005 @01:49PM (#14353178) Homepage Journal
      Of course, any attacker with intelligence will simply go around the flagpole rather than running into it.

      Hey! Are you calling me stupid?

      I've been wondering about all those dents in the flagpole, about 5.5 feet above the ground...

      that ringing, an angel just got it's wings!
      No, wait, it's that guy running into the flagpole again...

    • Not if you're playing Super Mario Bros.
  • Microsoft's doing their bit by including UPnP in new version of Messenger and encouraging people to use it.
    • UPnP proved to be the pinnacle of security in implementation...didn't it?

  • Slashdot Admin, you forgot it's a BOOK REVIEW! (Score:4, Insightful)

    by Anonymous Coward on Wednesday December 28, 2005 @01:46PM (#14353151)
    Please add "Book Review: " to the beginning of the title. This is the second time I've noticed this.

  • The same way parents keep a handle on their kids (Score:5, Insightful)

    by voice_of_all_reason ( 926702 ) on Wednesday December 28, 2005 @01:46PM (#14353154)
    Get ready for it...

    Pay attention!

    Even if you're a Fortune 500 company with a 70-story building, you'd be surprised what a walkaround by the CTO can accomplish. Stick your head in a few cubes, say "what the shit is going on here?" and let the rumour mill work for you.

    It will take less time/money then hiring a "solutions" firm to police your internets. And it's the same way midlevel managers make sure their employees haven't been screwing around since like, forever.

    • Re:The same way parents keep a handle on their kid (Score:5, Interesting)

      by SatanicPuppy ( 611928 ) <Satanicpuppy&gmail,com> on Wednesday December 28, 2005 @01:55PM (#14353214) Journal
      Bah, screw that. Just block the ports on the firewall. If certain users need those services, then do a NAT directly to their workstation, and put that workstation on a subnet that can be isolated from the rest of your systems. Firewall based security isn't a total solution, but if you have a tight firewall then your security problems are so much more managable.

      I had a client who objected to this one the grounds that their employees used it "only" to talk to each other, so it was more "efficient" to keep the service. So I set them up a jabber server in the building, and blocked all outgoing traffic. The boss was fine with it, and while the employees were pissed as hell, they couldn't say anything about it because they'd all sworn that they weren't using it to chat with people outside the building.
      • You are correct on that. I have a tight firewall here w/ proxy service and I can't get a single IM client, BT client, pretty much anything besides a web browser to connect outside the intranet, even when I got the proxy settings from my admin. We have an in-house IM client but AIM, Yahoo, etc, are all blocked. Pretty effective IMHO. No need for "what the shit" policing. Who has time to do that, anyways? If you got time to lean, you got time to clean!
      • one problem some IM's redirect to port 80 if their default port is unavailable. I know gaim does. and I tricked my gf parent's into thinking she wasn't talking to me once, because I was logged on to msn with 2 different account's so it couldn't be me... lol. stepping around the flagpole. of course a layer 7 firewall could block all IM client's trying to go through any port.

        • stepping around the flagpole. of course a layer 7 firewall could block all IM client's trying to go through any port.

          Until the IM clients start speaking perfectly legitimate HTTP over port 80 (a la XMLRPC or SOAP or HTun or the like). All the firewall can do is look at traffic and make sure it conforms to a specific protocol, but that doesn't mean the traffic is desireable.

          No firewall will ever be able to look at traffic and say with certainty "this is legitimate business-related stuff" or "this is somebody

          • No firewall will ever be able to look at traffic and say with certainty "this is legitimate business-related stuff" or "this is somebody BSing with their friends" or "this is someone trying to get a trojan horse in here" or "this is someone trying to post trade secrets"...

            No, but router ACLs and a packet inspection service can certainly filter out the largest chunks of data, using application "fingerprints" to determine what particular traffic streams are likely generated by. It will never be 100% perfec

            • That won't stop people who care. Ever hear of steganography [wikipedia.org]? Basically, protocol inspection won't work because the user can make the protocol look exactly like (say) viewing slashdot.

              Observe:

              GET /article.pl?sid="Hey wanna buy my trade secret?" HTTP/1.1

              HTTP/1.1 200 OK
              Sure, I'd love to.

              You could just disable all HTTP access, but then the Internet wouldn't be very useful.

              The correct way to block IMs is to tell people that it's against company policy and that they'll be fired if they are caught using it.

              • Basically, protocol inspection won't work because the user can make the protocol look exactly like (say) viewing slashdot.

                Actually, no you can't. Packet inspection technology does not live in a vacuum. An automated system looking for (and allowing) web traffic to Slashdot will notice if you are sending the same traffic to different IPs. An automated system can also pick up on keywords. But this is not about preventing generic communication. This is about stopping particular applications, especially one

      • My wife's company required that all developers (i.e., anyone who has access to source control), uninstall all IM programs from their computer (a requirement for some security certification). The devs just use the web-based IM clients MSN and AIM provide to do their IMing (both internally and externally). Yeah, the IM client sucks eggs compared to the desktop client, but it's better than nothing, and it's something I'm surprised the employees you talk about didn't start using...
        • Shhhhh, damnit... :-) Actually, whenever I work at a client's, I SSH into one of my own boxes and do everything and anything over an encrypted link. I even listen to my own music over SSH from my own streaming server. I don't leave any traces of my doings, comings and goings on client systems.

    • Even if you're a Fortune 500 company with a 70-story building, you'd be surprised what a walkaround by the CTO can accomplish. Stick your head in a few cubes, say "what the shit is going on here?" and let the rumour mill work for you.

      I'd say sack someone or put them on notice at the least and make sure the word gets around.

      We're supposed to be on a secure network, but you should see the crap people keep emailing each other, with outside links to gawds knows what sites.

      I know Dow Chemical had a Zero Tol

      • That's a little harsh, eh? I mean, yeah, you have to know what the policy is before you push off into the deep waters of the internet, but zero tolerance always equals zero sense.

        I use firefox at home with adblocker. Lots of sites surprise me at work when I see what the ads are actually hawking. If I find one of them has teh boobies, then I can't go there anymore. No harm done.

    • Re:The same way parents keep a handle on their kid (Score:4, Insightful)

      by tpgp ( 48001 ) on Wednesday December 28, 2005 @01:58PM (#14353233) Homepage
      you'd be surprised what a walkaround by the CTO can accomplish.

      You're right that this will stop a lot of problems - maybe even up to a third (and I generally agree that this is something a CTO should consider doing)

      However, it does nothing for:

      1) Malicious users (OK they're pretty hard to stop no matter what)
      and
      2) Stupid users who are using IM for legitimate company purposes, and get a message from their workamte / business partner saying "lol no this is not a virus." [slashdot.org]

      I certainly think companies should think about these applications in their security planning.
    • You need to read some books on management. Doing this will never, ever work. You'll just get people to periodically give a look to see if the CTO is walking around, which is even more of a distraction from work.
      • Not to substitute axioms for well-thought out ideas, but you can't catch all the fish in a pond anyway. Just because a solution isn't perfect doesn't mean it's not more valid than the current model.

        And if you have people slacking off in order to not get caught slacking off, then that's a whole other type of problem. Might be better to flush out the deadweights by doing it, actually.

  • Maybe the author should take his own advice? (Score:1, Insightful)

    by Anonymous Coward
    Blocking ftp isn't enough, but blocking DCC, AIM, and Kazaa is?
    • I agree. Too often admins see the problem of "insecure or unwanted traffic on port XX" and solve it by blocking port XX. My question is why wasn't that port already blocked? As a system administrator I block All ports except the ones we need. Even then those ports are monitored for the correct kind of data.

      No this won't stop all the baddies, but why would you leave ports open at all?

      • Even then those ports are monitored for the correct kind of data.
         
        So, just encapsulate [nocrew.org]. Stir in some encryption goodness, and nobody is the wiser...
         
        (Yes, it is this concept that keeps me awake at night...)
        • Exactly right. Businesses have to face facts that you cannot really acheive total security by looking at the network alone. They must also look at the user environment. In addition to locked down networks, they would need completely locked down workstations. The machines would not only have to be physically secured (and without cd-roms, floppies, even USB ports), but the OS as well. The OS shell would have to be removed and the software environment completely forced on the user. The tradeoff is defini
      • I agree. Too often admins see the problem of "insecure or unwanted traffic on port XX" and solve it by blocking port XX. My question is why wasn't that port already blocked? As a system administrator I block All ports except the ones we need. Even then those ports are monitored for the correct kind of data.

        Even that doesn't help as many P2P programs use port 80. If they don't already, they'll likely start embedding HTML tags in their protocol to avoid detection.

        Cisco has a nice IOS feature called NBAR

      • Chiefly because we never get to start from scratch. We know that if we do anything radical, we'll break something. Maybe there is one person somewhere in the building who uses IM for a genuine business purpose, or something. It doesn't matter exactly what. If you make a big change, something that is percieved to be important will break. Everybody in the building will be upset at you because you were incompetant and broke it. Everybody else in the building does "real work," and IT is just supposed to s

  • PEBKAC (Score:3, Insightful)

    by SatanicPuppy ( 611928 ) <Satanicpuppy&gmail,com> on Wednesday December 28, 2005 @01:47PM (#14353161) Journal
    I don't see how it is possible to secure an open protocol that allows file transfers. There is always going to be some idiot who'll click on the bad link, and download the trojan that can compromise the security of the entire network.

    Even if you put in multiple cutouts when dealing with untrusted users, inevitably you'll have a trusted user who will unthinkingly violate protocol and open the whole setup to exploitation.
    • Here's how you fix that: NMCI Required Network-Wide Password Reset [govexec.com]
      • If you catch it in time, and if the thing you downloaded isn't capable of logging and trasmitting a password. But what if you don't, or it is?

        Right now worms and viruses are easy to spot, because the first thing they do is spam themselves out all over the place. Gives you tons of warning. But what happens when you get one that spreads slowly, under the radar? Then you've got a long term vunerability on the network.

    • Re:PEBKAC (Score:4, Funny)

      by killmenow ( 184444 ) on Wednesday December 28, 2005 @02:20PM (#14353347)
      ...inevitably you'll have a trusted user...
      Sorry, you lost me right there.

    • Admin's problem (Score:4, Informative)

      by CarpetShark ( 865376 ) on Wednesday December 28, 2005 @02:31PM (#14353405)

      Certainly, social engineering attacks come down to user education.

      BUT, there is NO excuse for not having the technical side locked down. It's all too common for people to claim that you can't protect against someone clicking on a link. The fact is, you CAN. Quite simply, install a secure browser (dump IE, in other words), put it through a filtering proxy like dansguardian, and then close http ports on the firewall, except for the proxy server itself. Disable webmail at the web proxy, and disable downloads anyway at the same proxy. If you need windows update or something like that to work, you can explicitly allow certain sites. But DON'T allow any more than strictly necessary. Don't allow SSL, except to trusted sites where no uploads or downloads or conversations take place.

      Likewise, install a secure email client, and have mail filtered through a company mail server, disable HTML mail and encrypted mail.

      These are basic security precautions. But already, you've secured your organisation far beyond most of the windows shops out there that get virus and spyware issues every day.

      It doesn't take a genius, it just takes you to choose what technology you allow on your systems, and to use it wisely.

      • Sure, if you can get away with all those things.

        Internet Explorer is still necessary for viewing some websites. I can't put in my damn expense reports without IE because the wankers who wrote the site wrote it using Microsofts Java, which only runs with microsofts crappy browser. All the management here uses Outlook, and corporate is migrating everyone to Exchange. They'd go nuts if we tried to take away their shiny HTML mail.

        We get tons of ads (ads that we get paid to publish) in email, generally pictures,

        • Even in IE, you can set which sites are allowed to do things, and which aren't. With both IE and Outlook, you can set proxies and filter mail so that you only allow stuff from trusted senders etc.

          But yes, if you have people above you who control IT policy, there's not much you can do, except make sure they take responsibility for bad decisions rather than you, and that you keep looking out for a better job. Admittedly, that can be hard to find too :(

      • I work in the software monitoring business. As a result, my work (and that of my coworkers) requires me to regularly (i.e., about 15 times a day for 15 different customers) access some outside website. Considering that we have about 500 customers, with more coming in daily, filtering any websites is an impossibility. If we did, we'd be out of business in about 24 hours. So no, the solution you describe is not basic security. It is complete paranoia that can do far more harm than good, and only applicable t
    • Therefore you buy yourself a piece of software that can virusscan these files instead of blocking them ! Oh protocol xyz can be used to transfer files (name 1 protocol that cannot be used for this purpose ? even ping can be used to transfer files).

      "There will always be one idiot who" -> perhaps, but why punish 1000 non-idiots instead of firing the idiot ?

      If IT security becomes synonim with bullying (which it is in many companies), I can assure you nobody, absolutely nobody will care about security, and t
    • Problem Exists Between...umm..hmmm...the k'chair? Like g'nome's are g'nice?

      Clearly I need to look up the new meaning of the abbreviation (PEBCAC - Chair and Computer).
  • Although somewhat on point with what it sounds like the point of the book is, something that is still important to point out is that user education is one of the best ways to "secure" "IM, P2P, and IRC applications". Just because you can secure the most use applications doesn't stop your employee from installing abnormal, so to speak, and then misusing it as a means of getting around restrictions. Educate your employees and users and ensure they know why there are restrictions and the need for security with
  • I work as a security consultant for Hospitals and Banks. In some of the audits I have done, I have found that are controls, or even considerations for IM. Even P2P, I was at one bank that the VP of the place ordered the third party vendor to open ports on his firewall for P2P stuff. I am no legal expert, but I told the 3rd part to get it in writing from the VP (if he still wants it open after our scathing report) that the VP orders the 3rd party to open those ports. That way, the Bank and the VP are the l

  • larger fonts, better book? (Score:5, Funny)

    by digitaldc ( 879047 ) * on Wednesday December 28, 2005 @01:49PM (#14353177)
    The formatting uses a font size that is somewhat larger than other book. This seemingly serves to achieve a high page count.

    Is this a security book or a term paper?
    • >The formatting uses a font size that is somewhat larger than other book. This seemingly serves to achieve a high page count.

      >Is this a security book or a term paper?

      With the larger print and the higher amount of pages, this book has ensured that less script kiddies will read it. With the smaller population that know about its obscure secrets, more companies can use it's advice with success.
      • Dang, now you just gave it all away ;)
      • With the larger print and the higher amount of pages, this book has ensured that less script kiddies will read it. With the smaller population that know about its obscure secrets, more companies can use it's advice with success.

        Problem: you want regular IT people to read this. If it is too thick, they'll put it off, or be intimidated. In some places I've seen, the techies were basically just the people most skilled with the computers, and with a little bit of special training. Unless you are hiring de

  • Real risks or pretend ones? (Score:4, Insightful)

    by Ed Avis ( 5917 ) <ed@membled.com> on Wednesday December 28, 2005 @01:51PM (#14353194) Homepage
    File transfer can still be carried out by most instant messaging clients, and that can pose serious security risks.
    I'm not convinced of this. It's not as if the instant messaging client magically runs with higher privilege and gives someone access to files they couldn't otherwise view. If they transfer a file to a friend, it must be a file they already had permission to read. If they receive a file by instant messenger, the risk is no greater than if they'd simply downloaded it in their web browser or loaded it from a CD.

    I'm deliberately taking a one-sided position here, but it seems there is a lot more heat than light generated over file-sharing 'dangers'. I am reminded of Catbert's banning of camera phones as a security risk - notwithstanding the fact that the only documents people could take photographs of would be those they're allowed to read and photocopy anyway - and without even banning ordinary cameras.
    • If a company's checking incoming email attachments for viruses and trojans, then it only makes sense to do as much for IM.
      • If a company's checking incoming email attachments for viruses and trojans, then it only makes sense to do as much for IM.

        Yes, if you are doing dumb things, it's only right to be consistently stupid. You would not want to ban cellphones with cameras while allowing ordinary cameras would you? Pass it by the Homeland Security Office if you have to think about it long. If IM is what you consider your new IP threat, you proably need to reconsider what's important to your company and why.

        Such shenanigans on

        • Here comes the cluehammer!

          Such shenanigans only make sense when you believe in intellectual property
          The GPL completely relies on intellectual property laws! If it weren't for IP laws, there would be no GPL.

          Saying we shouldn't call it "intellectual property" is a semantic argument that has nothing to do with your main point (if indeed you have one)

          and treat the creators of such property like criminals.
          Er, what? Why would companies treat themselves as criminals? I lost you here.

          If your entire business relies

  • Well, It Might Help Some, But... (Score:4, Insightful)

    by Bullfish ( 858648 ) on Wednesday December 28, 2005 @01:52PM (#14353197)
    This may help some companies get an idea of what all activities going on in their network, but I doubt anyone will ever stop the activity going on as described. For companies, the biggest deterrent will remain getting fired if someone is using work computers to do P2P or IM. If the company policy is clear, and people are aware of it, the company really only has that (and a series of graduated warnings) to use as a club. Blocking ports, trying to shape protocols, trying lockouts etc are, IMHO, a waste of time. A workaround will always come. Better to have a clear policy and enforce it than buying fancy-ass software or spending 50 bucks for a book on what any good IT manager knows already.

    Out in the world of ISP's (which is different than in companies), the same situation exists. Try to block P2P, or bittorrent, and someone will find a way around the security. They could kick people off their service driving them to another ISP, but that's about it. This book doesn't really sound like it applies to that situation really.
    • I could not have stated it better than you. You are at work, you are being paid to work, not P2P or IM. Do it and you are fired. Where I was, we have this policy as well as not allowing users to install their own software. No P2P software or IM software is originally on the machine, if it shows up, the machine gets formatted as so does your employment.
      • Yeah, I work for one of such companies. They lock the screensaver to 5 minutes, have a background process running that keeps a list of all the files on the system, have a virusscanner that scans every file, even text files (each time they're modified or newly created, which slows compile processes down by a factor of 10-100), deletes any attachments to email that ends in certain extensions (not by content) and so on.

        So I just disabled all that shit, and ended up with a machine which did some actions 100 t

    • Remote to a machine at home, do everything I want from there.
      • Until they find out what remote software (i.e. GoToMyPC, MyWebExPC, LogMeIn, etc.) you are using and block it :)
      • You use their network to get out and frankly you'd better have a different kind of network to find a new job once you get spotted. And you will get spotted. Anybody who believes they have privacy on any employer's network is living in a fantasy world.

        Here is what I really don't get. People are willing to risk multi-thousand dollar-a-year jobs for a few hundred bucks worth of what?

        What is so important so important to get off the net that you can't do it at home and leave it there. If it's because you have di
  • ....is Eric Rescorla's SSL and TLS: Building Secure Systems [amazon.com]. It's got excellent descriptions of how SSL works, including a chapter on various attacks (million message, small-subgroup, etc). He's got some nice stuff in chapter six about SSL server performance, too - talks about hardware acceleration and whatnot.

    Oh, and, plug [pmdapplied.com]!
  • Each chapter also provides significant details about the internals on how each application operates. In addition, various 3rd-party tools that can be used to secure and limit the various applications are listed.

    Awesome. Sounds like there is plenty of detail on applications and 3rd party tools. Can I also assume a considerable chapter on user education? We all know that there is always a way "around the flagpole"... its usually end users.

  • Man, that's splitting cents! (Score:4, Funny)

    by everphilski ( 877346 ) on Wednesday December 28, 2005 @02:01PM (#14353248) Journal
    with the majority of such titles being in the $25.909 - $39.99 range

    When $25.90 just isn't enough, but $25.91 is just too much...

    -everphilski-

  • What a weird metaphor (Score:5, Funny)

    by Twid ( 67847 ) on Wednesday December 28, 2005 @02:07PM (#14353282) Homepage
    I guess the flagpole metaphor would make sense if a flagpole was a security device.

    I think what he is trying to say is that there is no use putting a gate on your driveway unless you put walls around it as well. Otherwise people will simply drive around the gate.

    Certainly works better than the flagpole story anyway, unless there's a secret security use for flagpoles than I am missing. :)
  • Someone else posted the obvious solution of blocking all the ports at the firewall. That's simple enough, but stupid people can still download software via the web and mess things up.

    The simplest solution is to lock down the user's rights. Just prevent them from installing any software and don't put P2P or IM clients on their systems. Problem solved. If you really need them to be able to use IM, run it via MSN IM through your Exchange server (I'm sure there's OSS alternatives to do the same thing). Tha
    • but stupid people can still download software via the web and mess things up
      Smarter people can just tunnel out via HTTP, and do whatever they want.
      The simplest solution is to lock down the user's rights. Problem solved.
      No, actually you just created a huge support problem, not to mention that some people's jobs actually involves installing new software. And it can be worked around and disabled easily enough as well.

      • No, actually you just created a huge support problem, not to mention that some people's jobs actually involves installing new software. And it can be worked around and disabled easily enough as well.

        Not nearly the support problem you have when users install spyware and infect their systems with viruses. It's easy to push out new software to the desktop, and people who actually install software can be given the rights to do so. If done properly, it's VERY difficult to bypass.

  • I already know how to secure IM and P2P apps, so this book, imho, sounds like a complete WASTE [sourceforge.net] of time.

    nudge nudge wink wink...say no more...
  • Yeah, businesses really need this so their employees can securly trade dvd torrents and chat with their spouses.

    • Mod parent up- this is the real thing. Synchronous communications have a tendency to be anti-productive. Asynchronous communications have a tendency to be productive up to a point, and easily ignorable if an emergency happens that needs to be responded to. Based on this idea, I'd also suggest removing phones from cubicles, as well as not allowing IM and P2P applications be installed in the first place.

  • False assumption (Score:2, Interesting)

    by majest!k ( 836921 )
    Why would you assume these IM/P2P applications are even installed in the first place?

    In most corporate environments, software policies are already in place to restrict users from installaing any software on their own. In addition, generally any requests for installation of IM/P2P apps are quickly denied citing company policy (the reasons for which should be painfully obvious).

    There's really no need for IM at work, but if you really really want it, use a corporate IM solution (such as Exchange IM or Apple iC

    • Re:False assumption (Score:4, Informative)

      by slim ( 1652 ) <john@har[ ]p.net ['tnu' in gap]> on Wednesday December 28, 2005 @03:21PM (#14353698) Homepage
      There's really no need for IM at work,

      I work in a corporate environment with geographically diverse colleagues, and IM is an extremely useful medium for doing Real Work. You might like to argue that we could just as easily use the phone, but IM has advantages over the phone for certain applications. Especially, it's nice to be able to supplement phone conversations with IM -- we'll cut and paste email addresses, code fragments, log fragments, even screenshots rather than try to read them out or describe them.

      On telephone conference calls, IM is a useful out of band medium for comparing notes with colleagues; "Should I mention x?", "Don't forget y". ... but if you really really want it, use a corporate IM solution (such as Exchange IM or Apple iChat) to keep things local. Problem solved.

      I agree with this. OTOH, it's in my employer's interest to allow me access to MSN messenger. Some of my technical peers work for different companies. If I have external IM, I can go to them for technical assistance (and they can come to me: it's a two way street).
      • Some of my technical peers work for different companies. If I have external IM, I can go to them for technical assistance (and they can come to me: it's a two way street).

        The keyword there is technical.

        Generally speaking, technical users aren't at risk when using IM. You and I aren't going to open boobies.exe from a stranger, IM or not. But some guy in HR or Marketing might. Or they could just sit around the whole day wasting company time trading warez/yapping with friends. Chances are they'll use it for s

  • Yet another analogy (Score:4, Interesting)

    by dtfinch ( 661405 ) * on Wednesday December 28, 2005 @02:42PM (#14353461) Journal
    Putting "protected by [insert alarm company name here]" stickers on the windows of my house will discourage most of the amateurs from breaking in, even if I don't really have an alarm. Even the pros may skip to the next house without looking, unless they know I have something they want. Not that I condone improper use of cryptography or anything, but you can use analogies to support any position.
  • Or his opinions? Just curious...

  • Securing IM and P2P (Score:1, Insightful)

    by Anonymous Coward
    You guys amaze me. Take a really easy thing to solve, and make it sound like brain surgery.

    Start with an IM proxy i.e. IMLogic, fake up all of the DNS zones and names for the IM sites, and require specific group membership in AD to allow access to the proxy. If you're not in the group, you can't IM, and the proxy rules keep out the bad stuff while archiving all of the conversations for compliance purposes.

    For P2P, it should simply be disallowed. If a company runs a decent IDS/IPS system, it's very easy t
  • I'm surprised at this point that nobody's mentioned just how bizzare the topic is in some sense.

    I mean, Securing IM is a legitimate and important thing for corporate IT departments and people with real responsibilities to concern themselves with.

    On the other hand, "Securing P2P" is basically just another step forward in the arms race between those who would choose to flaunt copyright laws and those trying, however vainly, to stop them. Even if you would try to make the rather weak case that P2P has leg

  • I work for a large enterprise and we can't even use the personal version of IM. We do however use the corporate IM client (MSN Messenger v 4.6)
  • I am aware of the fact that different companies have different policies. This seems to be occasioned by the the fact the CEOs have different personalities and that many policies are based on whatever someone did in the the past that caused a problem.

    I am aware of the fact that different jobs require different types of concentration. For example, an assembly line worker can only relax after completing the task and before the line moves on. It tends to be a short fixed length of time. A software developer has

  • Thanks (from an author) (Score:3, Insightful)

    by Rurik ( 113882 ) on Wednesday December 28, 2005 @04:28PM (#14354106)
    Thanks for the brief, though good, review of the book. I'm B.B., author of three chapters of the book: 9, 11, 12 (Gnutella, BitTorrent, FastTrack). If you look at the book's profile on other sites, you'll see there were a variety of co-authors on the book. As a long time member of Slashdot, and a long time advocate of both Open Source applications and Linux, this was a small way for me to at least give a little back. My chapters were written from a Linux admin POV, with details and steps on iptables (with installing strings), self-made Snort rules, and Ethereal screen shots (which were done in Windows, my Linux boxes are headless) I can only speak for my sections, but I hoped that if a regular Windows admin picked it up, and saw how easy it was to create firewall rules in Linux, it may help to win some hearts and heads.

    Overall, it was an honor and priviledge (cliched, I know) to help out with the book, with a great bunch of other guys. And thanks Slashdot ;) //Feeling obliged to use Karma Bonus
  • When talking about limiting, monitoring, and controlling a given user's Internet access within a company, why not just hire better people.

    You can't control how badly the average user will mess things up but perhaps you can control the skill level of the average user within a company. If employees are good then they'll know to not click on suspicious links, waste company time chatting, or open suspicious attachments. Also, I believe that if a company would rather censor mediocre employees than hire good on

  • Ironically (Score:3, Informative)

    by Orion Blastar ( 457579 ) <.moc.liamg. .ta. .ratsalbnoiro.> on Wednesday December 28, 2005 @05:00PM (#14354259) Homepage Journal
    most companies that try to lock down their Internet programs often use Internet Explorer and Microsoft Outlook as the default web browser and email client. Yet these two programs have the most exploits of any Internet based programs out there. So even if you do lock down the ports of the firewall and stop users from installing programs, chances are the exploits will install the malware for you when they get the wrong email or click on the wrong link.

    99% of the malware infections that happened in the past four places that I worked in, were caused by management clicking on the wrong email or wrong link in Outlook or IE. They did lock down their Internet, turned off port forwarding, took away admin access, prevented the install of new programs (which screwed up Visual BASIC and MS-Access development, because they needed Admin access or else things don't work via certain controls), and other things.

    I think one of the funniest momments was getting the "Love Bug" email from the Network Administrator 12 times in a row that said "I LUV YOU!" over and over again. Guess who was using MS-Outlook and McAfee Anti-Virus and got infected due to some exploit? Needless to say I was smart enough not to open up those emails, unlike my co-workers who did, and sent me their own "I LUV YOU!" emails. :)

Slashdot Top Deals

All the simple programs have been written.

Close