Security Considerations When Using
Bardon Data Systems
Today the risks associated with inadequate computer security are well documented, yet many organizations fail to consider the desktop PC in their security strategy.
Studies have shown that most computer related security breaches involving loss of funds are accomplished by attacks from the inside, that is, by authorized users engaging in unauthorized activity.
The desktop PC or laptop is the point of entrance to the network and data for most users but many organizations fail to include these computers in their security strategy. Often the enterprise will establish a firewall and network security, focusing most of their energy on protecting their data from outside intruders and leaving their desktop and laptop computers open to intrusion, modification of system and data or even data theft. This type of activity becomes extremely difficult to track when there is no security at the point of entry to the network.
System downtime occurs due to both malicious tampering and accidental modifications by well meaning but unknowledgeable users.
Whether the concerns are controlling cost of ownership due to maintenance or protection of sensitive, proprietary data, reliance on inadequately controlled systems can have serious consequences.
Many organizations monitor the whereabouts of individuals in their buildings, and with good reason. In so doing they are able to keep people out of areas they aren't authorized to be in, and if there is a problem they are able to determine who was in the area at the time. Many of these same organizations will allow anyone who sits down at a computer to wander anywhere they want to on the network or on the local hard drive, unchecked and unmonitored. Users are able to run or even install programs, visit websites, and copy, modify or delete data. Unknowledgeable users can wreak havoc on a system while attempting to install their own software or fix an existing problem.
"What will it cost your organization if proprietary or confidential data is wrong? What if it is lost, or manipulated?" These are the sorts of questions that should be asked when determining security needs. All data is sensitive to some degree, exactly how sensitive is unique to each environment. In many organizations the loss or exposure of a corporate officer's contact manager could be catastrophic. Lack of adequate security can compromise the ability of organizations to perform their mission. Accidental modifications performed by well-meaning users can lead to data loss or inaccuracy and downtime for the individual PC or the whole network. All occurrences of this sort lead to significant increases in Total Cost of Ownership of IT resources.
A directed attack by an insider with specific goals or objectives can have far worse consequences. Organizations that spend thousands of dollars on firewalls to protect themselves from attacks from outside intruders often fail to consider how much more damage an insider with knowledge of the system and unrestricted access to it could do. Financial information stored temporarily on an executive's desktop (against company policy, "but it's only overnight") is prey to opportunistic insiders who already have access to the system. Data can be distributed instantly across the globe over the phone, fax or internet, and the user only has to get to it once to do this. Malicious modifications could destroy the value of data, whether it is client lists, proprietary product information or financial data.
Inability to maintain confidentiality, such as loss or exposure of confidential information, can lead to loss of confidence and possible legal repercussions. Every organization, regardless of size, maintains information that should remain confidential. Such information could be client contact data, students' grades or corporate financial information. Exposure of any information of this type would result in a loss of faith on the part of clients and customers.
Goals of Effective Desktop System Security
Adequately secured systems deter, prevent or detect unauthorized disclosure, modification or use of information. Additionally, secure systems should assure operational continuity and maximize productivity. Security goals for desktop systems are outlined below.
Maintain data integrity
Operational data must be trusted. This requires minimizing errors and omissions, and protecting systems against deliberate actions to change the content of the data. In addition, inadvertent actions which threaten data validity must be prevented.
Every organization, regardless of its mission, must be able to assure its patrons of the privacy of their data. Privacy requirements may be dictated by statute or by internal policy.
Eliminate computer downtime
Computer downtime has many potential causes. Novice users often make accidental changes to configurations. Malicious changes are made in attempt to breach security or to prevent operation of the computer or network.
Control configurations and settings
Users should be unable to introduce unauthorized or undocumented software. They should also be prevented from changing system configurations. Activity is monitored and logged in order to track the source of unauthorized activity.
There are some common security attributes that should be present in any system if it is to be considered secure. These principals emphasize identification, prevention and accountability.
Identification and authentication of users
Users should have an account number or user name, used in tandem with another means of authentication, such as a secret password. Passwords should be changed regularly, and anytime there is the possibility of exposure of passwords. In addition, failed attempts to log on should be monitored in order to detect unauthorized access attempts. Users should be automatically logged off after specified periods of inactivity in order to ensure that the person using the computer is the person logged on.
Enforcement of least possible privilege
It is necessary to not only ensure that only authorized users can access the system, but that authorized users have an appropriate level of access to data or capabilities. Users should only have access to information and transaction authority (for example, modification or deletion of data) that is required by their job responsibilities. For example, many individuals need the ability to access data, but only a few may need to be able to modify it. There should be a means, such as assigning users to groups, to easily assign each user to the specific levels of access.
Records should be kept of activities performed by users. This requires a positive means of identifying users (password) and a routine record of activity. Information to be recorded depends on what is significant about each system, but should include such things as unauthorized logon attempts and failed password attempts.
There are significant risks on failing to properly secure the desktop and laptop PC in enterprise. Many administrators are guilty of focusing on preventing threats from outside the network while neglecting security on the inside. Inside attacks are responsible for the majority of computer related financial losses. Other risks include loss of confidentiality and increased TCO due to improper computer usage that requires a technician to correct. By applying some basic security principals and implementing tools to control and monitor user actions, risk can be drastically reduced.
Threat Assessment of Malicious Code and External Attacks (NISTIR4939)