Archive for the ‘Security’ Category

Barebones leaving process.

July 18, 2009

While most businesses have a collection of processes covering their IT infrastructure, one area that is often neglected is when staff leave. Its highly likely that most companies will have user accounts still active for staff that have left some time ago. This not only leads to administrative problems but can also be a security risk.

The most obvious course of action when a staff member leaves is to simply delete their account. While this is a quick process, and immediately gets around the security issues, it can often cause other problems. There are a number of things which should be considered when putting together a leaving process:

Is the user’s email data going to be needed going forward? Experience from our IT helpdesk tells us that you can guarantee that just after the account is deleted, a manager will ask you to check for something!

  • Does email still need to be received at the user’s address?
  • Is the user’s profile stored on a server and does it need to be kept?
  • Does the user’s profile or data need to be accessible on their old PC?

Bearing these points in mind, the following is a recommended process for when staff leave:-

  1. Log in to their account and export they email to a PST file. Copy this PST to a leavers’ area on a data drive, along with any other PSTs they may have. If other staff need access to their email, they can be given a copy of this PST.
  2. If they have a server based profile, move their profile to the leavers’ area and delete their local copy on their PC (this avoids whoever uses their PC afterwards potentially having access to data they shouldn’t).
  3. If they just have a local profile, copy this to the leavers’ area and then delete it from their PC.
  4. If they have a personal network drive, copy this to the leavers’ area and then delete.
  5. Amend their primary SMTP email address to be something generic (such as adding a zz at the start). Their previous address can then be assigned to another user if mail still needs to be received.
  6. Disable their Active Directory account, which also disables their mailbox and hides them from the GAL.
  7. After a period of time, such as 30 days, their account should be deleted (this covers them possibly changing their mind and coming back!).
  8. Periodically, the leavers’ area on the server can be archived to tape or DVD to recover disk space.

This process will ensure that leavers’ accounts are dealt with correctly but their user data is still available should it be required.

Password blues.

June 10, 2009

For the average computer user, password management often involves either their pet’s name or a selection of Post-It notes on their monitor.  While for some this may be the only way to remember their passwords, there are a number of guidelines that can be followed to ensure users create strong, secure passwords that are also easy to remember without having to write them down.

It’s a popularly held belief that the best passwords are those made up of random strings of upper and lower case letters, numbers, and other symbols.  While these are indeed the most difficult to crack via a brute force attack and tend to be impervious to dictionary attacks, they are also the most difficult to remember and therefore the most likely to be written done.  The most complex password becomes useless when its easily accessible by other people.

The complexity of a password increases exponentially as the password’s length increases.  There are over 10,000 more password combinations for a 15 character password using just lower case letters than there are for an 8 character password using upper and lower case letters, numbers, and all the symbols easily accessible on a normal keyboard.  Therefore, you don’t need to use every character available just to get a complex password.

Many people also don’t realise that Windows passwords can be up to 127 characters long and can also contain a space.  This makes it very easy to construct a complex password, which is in essence a pass phrase, which is easy to remember.  A good way to start is to take a simple phrase, such as “summer is” here and apply some standard rules to it.  For example, you could capitalise the second letter or each word, rather than the first, to make it more difficult to guess.  You could then add a specific symbol at the end of the password.  Lastly, you could substitute specific letters for symbols or numbers (such as “@” for “a” and “5″ for “s”).  This makes the password “5Ummer i5 hEre!” which is very complex and well protected from common password attacks.  If you keep the same set of standard rules, it’s also easy to remember.  Additionally, if you need to write anything down, you can write down the rules rather than the password itself which is a much lower risk.

When you need to change your password, you simply need to select a new phrase and apply the same rules – “now its autumn” would then become “nOw iT5 @Utumn!”, another complex yet easy to remember password.

One last point – there is always going to be a need at some point to write down a password.  Some passwords, such as the Windows Directory Services Restore Mode password, are designed to never be used except in an emergency.  These are therefore going to need to be recorded somewhere to ensure access when needed.  Writing these passwords down is not in itself a security risk – it’s what you do after they are written down that can cause the problem.  Locking the password is a safe with controlled access should present very little risk at all, and as the use of these passwords is very limited, it shouldn’t be a problem if accessing them takes time.