Re: High ranking lusers

[Bennett Todd <bet () rahul net>]

> Little Boss:  The Big Boss wants a shell script to be setuid root.

If you're fighting that kind of brushfire, you're in full retreat, and
losing.

No point in even trying to tackle these head-on.

Instead, you need to get the security policy started. This would be a
fine place. Open with a section that gives the reason for the security
policy: that the organization has resources (information, tools for
manipulating it) that need to be protected from accidental and
deliberate damage and compromise. Then start a sub-section that
discusses programming risks. Since this case is motivating the effort,
introduce a sub-sub-section on setuid programming issues (Henry
Spencer's notes on setuid programming might be a good reference).

Then go back up and start rounding out the narrow and deep start, to
cover related issues, then spread out into other major topics of
security policy --- access control, software licensing, internet access
control, etc. Check out the RFC on security policy writing, any other
online resources you can find....

A few weeks or a month later, depending on how fast you read and type,
circulate the first rough draft by anyone else you work with who has a
security clue. Incorporate their changes, and with their permission list
them as co-authors. Then run the resulting draft by your immediate boss.

Trying to do security administration without a policy is a fruitless
battle.

As the policy is evolving, always examine --- and try to document in the
document --- the benefits of the risky practice in question (i.e. the
costs of finding safer ways to achieve the same end), the costs of the
security problem (easy insider root access, difficult insider root
access, difficult outsider root access, easy outsider root access) and
justify the proposed policy in terms of costs and benefits. That
language motivates management --- as it should.

Unless of course they're hopelessly and irreparable dain-brammaged, in
which case you should be tooling up your resume.

-Bennett