Re: Securing workstations from IT guys

[rohnskii () gmail com]

Others have already made most of the appropriate suggestions, so lets take a look at some of the issues associated with 
your original ideas:

<snip>
Here are the basics of what I intend to do:
1. Advise all HR users to shutdown their PC before they leave for the day.
2. Change all Local Admin passwords so that even IT helpdesk/other doesn't
know them.
3. Advise HR guys to assign passwords to their excel/word files.
4. Do not create shares off c drive giving 'everyone' access.
</snip>

#1- PC Shutdown has limited value against an IT insider because some newer PC/NIC combinations allow the PC to be 
powered on from the network to allow administrative work, ie patching.  Shutting down, or at least enabling & password 
locking the screensaver will prevent casual passer-by's (ie janitor) from using PC to steal info.  I don't think that 
anyone has mentioned yet that anyone with physical access to a PC can easily bypass the basic Windows password 
protection (another very good reason for not allowing local storage of sensitive data).

Also, I read an article about a company that implemented a policy and procedure to remotely (from the network) shut 
down all company PC's after work hours.  They did it as a cost saving measure, estimated to save them tens of thousands 
of dollars a year in electricity alone.

#2 If IT does not know the local admin password, how can they do their job, patching & maintaining the PC.  
Realistically, there shouldn't be any HR related applications that absolutely require end users to use the Admin ID to 
do their job.  And there is no other reason for user to know admin password.

#3 Using M$ Excel / Word passwords is ineffective.  Their implementation of encryption is very weak.  There are many 
tools for cracking them available on the internet.  Again, that type of password is only adequate protection from the 
"average" user, not from an informed thief, whether they work in IT or not.


An option I haven't seen mentioned yet is to store the sensitive documents offline.  Put them on a device that can 
easily be unplugged, ie a USB drive and lock them up at night.  If it is off line, no one (authorized or not) can 
access it.  Note, it has to be securely locked up because average office desks and file cabinets can be picked in no 
time flat.