RE: preventing run-as option

["Lariviere, Stephen" <Stephen.Lariviere () CITIZENSBANK com>]

Take the original case posed to this thread. The employees were using
other employee network credentials to be able launch I.E. and get
through the corporate firewall or proxy. This is not an exceptional
justification for allowing access to runAs. It is bad employee behavior
but most importantly it is a bad system security posture that is being
exploited by employees in order to perform actions that the company
obviously had gone through some effort to secure.





-----Original Message-----
From: listbounce () securityfocus com [mailto:listbounce () securityfocus com]
On Behalf Of Murda Mcloud
Sent: Wednesday, October 11, 2006 6:54 PM
To: 'Ansgar -59cobalt- Wiechers'; security-basics () securityfocus com
Subject: RE: preventing run-as option



I would find it very hard to do my job without RunAs. Closest thing to
sudo
that Windows has(only thing?). Helpdesk staff would also find it
difficult.
Which is why I think this a policy issue as much as anything else. If
someone has your creds then they can login as you, as well as use runas
as
you.(Apologies for all that 'as'). My exceptional justification is
practicality.
-----Original Message-----
From: listbounce () securityfocus com [mailto:listbounce () securityfocus com]
On
Behalf Of Ansgar -59cobalt- Wiechers
Sent: Wednesday, October 11, 2006 9:12 AM
To: security-basics () securityfocus com
Subject: Re: preventing run-as option

On 2006-10-10 Lariviere, Stephen wrote:
> Disable runAs all together. It is bad unless you have an exceptional
> justification for it.

You may want to elaborate on that one.

Regards
Ansgar Wiechers
-- 
"All vulnerabilities deserve a public fear period prior to patches
becoming available."
--Jason Coombs on Bugtraq

------------------------------------------------------------------------
---
This list is sponsored by: Norwich University

EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
The NSA has designated Norwich University a center of Academic
Excellence 
in Information Security. Our program offers unparalleled Infosec
management 
education and the case study affords you unmatched consulting
experience. 
Using interactive e-Learning technology, you can earn this esteemed
degree, 
without disrupting your career or home life.

http://www.msia.norwich.edu/secfocus
------------------------------------------------------------------------
---




------------------------------------------------------------------------
---
This list is sponsored by: Norwich University

EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
The NSA has designated Norwich University a center of Academic
Excellence 
in Information Security. Our program offers unparalleled Infosec
management 
education and the case study affords you unmatched consulting
experience. 
Using interactive e-Learning technology, you can earn this esteemed
degree, 
without disrupting your career or home life.

http://www.msia.norwich.edu/secfocus
------------------------------------------------------------------------
---


-----------------------------------------
Use of email is inherently insecure. Confidential information,
including account information, and personally identifiable
information, should not be transmitted via email, or email
attachment.  In no event shall Citizens or any of its affiliates
accept any responsibility for the loss, use or misuse of any
information including confidential information, which is sent to
Citizens or its affiliates via email, or email attachment. Citizens
does not guarantee the accuracy of any email or email attachment,
that an email will be received by Citizens or that Citizens will
respond to any email.
 
This email message is confidential and/or privileged. It is to be
used by the intended recipient only.  Use of the information
contained in this email by anyone other than the intended recipient
is strictly prohibited. If you have received this message in error,
please notify the sender immediately and promptly destroy any
record of this email.


---------------------------------------------------------------------------
This list is sponsored by: Norwich University

EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
The NSA has designated Norwich University a center of Academic Excellence
in Information Security. Our program offers unparalleled Infosec management
education and the case study affords you unmatched consulting experience.
Using interactive e-Learning technology, you can earn this esteemed degree,
without disrupting your career or home life.

http://www.msia.norwich.edu/secfocus
---------------------------------------------------------------------------