Re: Height of paranoia

["Adam Pal" <pal_adam () gmx net>]

Hi Wali

As a fist measurement, i would separate the executive managers network, move the stations to another/new network 
segment. There you can also enable a different set of ACL rules.

As a 2nd measurement i would use point-to-point encryption, high confidential emails should be encryptet however so 
that would be a good time to apply it. 
There are a lot of tools, but you can pick one which is costs-effective and easy to implement in outlook. 


regards

Adam Pal


-------- Original-Nachricht --------
> Datum: Wed, 27 Aug 2008 19:55:14 +0400
> Von: "WALI" <hkhasgiwale () gmail com>
> An: security-basics () securityfocus com
> Betreff: Height of paranoia

> It's a given that all workstations have XP firewall enabled, an enterprise
> grade antivirus and Windows defender installed. I am the security guy.
>
> The need is that there are a couple top management executives that have 
> highly confidential data/emails residing on their desktops, and quite a
> few 
> times, the information seems to have leaked out.
>
> Discounting the 'word of mouth' of their secretaries or the end recipients
> of that information, I want to take as many precautions from the IT
> security 
> perspective as possible and even bring our domain admins and helpdesk 
> personnel into the realm of doubt.
>
> We have a Windows 20003/exchange 2003 environment of about a 2000 users. 
> Here's what I have thought:
>
> 1. If I detach these executive PCs from the domain. Mails will stop
> landing 
> in MS Outlook. Is there a way around? Also DNS security doesn't register
> any 
> PC unless it's joined to a domain. I thought of this to make it out of 
> bounds by system/domain admins. I have a feeling that their port 3389 gets
> accessed when they aren't around.
>
> 2. Alternatively, create a private vlan on the core switch and make these 
> PCs as it's members. Put an ACL and deny everything except ports required
> to 
> authenticate to AD and exchange and few other web applications. Monitor
> port 
> memberships regularly.
>
> 3. How to secure their emails from exchange admins (it's the height, I 
> know).
>
> Pls advise!! 

-- 
Psssst! Schon das coole Video vom GMX MultiMessenger gesehen?
Der Eine für Alle: http://www.gmx.net/de/go/messenger03