FC3 Security

[Rick Bilonick]

Alexander Boström wrote:

>tis 2005-03-08 klockan 23:58 -0500 skrev Rick Bilonick: 
>
>  
>
>>The data center would go ballistic if I used a router to set up a local 
>>lan with a firewall. (The unversity frowns on connecting routers and 
>>hubs to the network. It  wants one computer for each port/ip address. I 
>>think this is somewhat silly but what can I do?)
>>    
>>
>
>That is actually the most sane rule of all the rules that your IT
>department has imposed on the network. When they see a threat on the
>network the want to be able to 1) know the MAC of the infected, cracked
>or abused computer, 2) analyse the traffic and 3) pull the plug on the
>computer without loosing an entire office with many other computers
>along with it. Hence, they want to be in control over the routers and
>switches. That is sane.
>
>It is also somewhat understandable that they want to be in control over
>what runs on the computers. This allows them to make sure the computers
>are fully updated with the latest patches etc. However, this is not
>always practical because the needs of the users vary a lot. A Windows-
>only policy will definitely limit the available tools, which will very
>likely be a problem in a university setting. The curriculum of the
>students might be adapted to the available tools, but the researchers
>need some flexibility to do their job. If the systems offered by the IT
>department doesn't provide what you need to be able to do your job, then
>they must allow you to manage your own computers. If that requires them
>to somehow reorganise the network to feel safe, then so be it.
>
>What the people who manage the network should to is to actually meet
>with the people who use the network, get to know them and get a feel for
>who is capable of managing their own computers, regardless of the
>operating system. Some people really should be placed in front of a
>locked-down computer with no root/admin access, while some know what
>they're doing and can work with the network owners to keep it free from
>infection. Sometimes accidents will happen anyway, but as long as it's
>rare it something you can live with.
>
>Sometimes a single computer managed by its only user can grow
>organically to a set of servers and workstations managed by a sysadmin,
>which can then move up to the IT dept. and the computer system provided
>as a solution to the whole organisation, thus replacing a bunch of other
>user-managed single computers here and there. This is much more
>desirable than to just crush any non-sanctioned computer use.
>
>Buying a separate DSL seems like a waste of money, caused by a problem
>within the organisation.
>
>/Alexander Boström,
>University sysadmin.
>
>
>  
>
I agree completely. Unfortunately, we seem to work for the benefit of 
the data center IT group. They never ask our needs. There motto is: one 
size fits all. The thing is, it's my bad luck to have an office in the 
data center. Otherwise, I have no connection to the data center.

Rick B.