Re: Height of paranoia

[Chad Perrin <perrin () apotheon com>]

On Wed, Aug 27, 2008 at 07:55:14PM +0400, WALI wrote:
> It's a given that all workstations have XP firewall enabled, an enterprise 
> grade antivirus and Windows defender installed. I am the security guy.
>
> The need is that there are a couple top management executives that have 
> highly confidential data/emails residing on their desktops, and quite a few 
> times, the information seems to have leaked out.
>
> Discounting the 'word of mouth' of their secretaries or the end recipients 
> of that information, I want to take as many precautions from the IT 
> security perspective as possible and even bring our domain admins and 
> helpdesk personnel into the realm of doubt.
>
> We have a Windows 20003/exchange 2003 environment of about a 2000 users. 
> Here's what I have thought:
>
> 1. If I detach these executive PCs from the domain. Mails will stop landing 
> in MS Outlook. Is there a way around? Also DNS security doesn't register 
> any PC unless it's joined to a domain. I thought of this to make it out of 
> bounds by system/domain admins. I have a feeling that their port 3389 gets 
> accessed when they aren't around.
>
> 2. Alternatively, create a private vlan on the core switch and make these 
> PCs as it's members. Put an ACL and deny everything except ports required 
> to authenticate to AD and exchange and few other web applications. Monitor 
> port memberships regularly.
>
> 3. How to secure their emails from exchange admins (it's the height, I 
> know).

Have you considered setting them up to use file and email encryption?

Are you positive these workstations are not infected somehow?

I don't know all the details of your circumstances, but I'd want to set
up integrity auditing and file/email encryption to protect sensitive data
on such systems.  Without a good integrity auditing system (maintained on
a separate system where it won't be compromised if the audited system is
compromised, naturally), you just cannot be 100% certain the system isn't
compromised.

-- 
Chad Perrin
Larry Wall: "You can never entirely stop being what you once were.
That's why it's important to be the right person today, and not put it
off till tomorrow."

Attachment: _bin
Description: