[geeks] Gmail's attraction

[Dan Duncan]

On Sun, 5 Sep 2004, Jonathan C. Patschke wrote:
> You give them separate accounts.  Proftpd makes this -easy-.  I'd assume
> there's some widget for 'doze that's equally simple.

Now you have users managing individual ftp servers and
expecting them to manage security, and a requirement to use
two different applications to send a file to a user (since I assume
they will also be sending an email telling them to get the file)
and now of course we have to make sure whatever ftp server we
choose is available and signed off on by security auditors.

> > Do you have that ability as a mere user, or does it require admin
> > privs?
>
> If you have "Power User" access to your workstation, you can share
> folders.  Most users have "Power User" access to placate them in that
> they can change the date and such.

When you expand user permissions, you increase the security risks.

> > How about letting mere users share out what may be privileged data
> > in a manner with NO AUDIT TRAIL WHATSOEVER?
>
> EMail does not solve this.  Does your company keep records of every
> single attachment that flies over the wire (not just the filename, but
> the contents, as filenames can easily be forged)?

I can't answer that question, but email with files attached is no
different than emails containing sensitive information inside, and
presumably there is already a mechanism in place to audit it.

> And you -CAN- enforce
> share-level audting as part of the domain policy.

True, but it creates a flood of logs and requires someone to audit them.

> > Perhaps you've never had the pleasure of having security auditors
> > crawling up your ass in a corporate environment,
>
> I'll one-up you.  I've been there in a -government environment-, one
> that has to goosestep by HIPAA.

Then you know how they feel about audit trails.  My last security
audit was by the Dept of Energy in a company that operates
nuclear power plants in a post 9/11 environment.  The data center
is guarded by personnel with fully automatic weapons.  Wheee!

> If the file's Large, it's horribly inefficient.  That 30% bloat doesn't
> help anyone, and a good number of gateways will tell you to stuff
> anything over 4MB up your backside.

True.

> > You get a virus scan,
>
> Oh, that's part of RFC 2822 now?  I must've missed that part.

Do you really propose a company not do virus scans on attachments?

Why are we even bothering to discuss security?

> > a delivery receipt, and a reasonable assurance that someone who
> > shouldn't have it didn't get it from you along with an auditable
> > paper trail.
>
> All of which can be forged.  Easily.  Never mind that the file is
> passing in the clear and can be picked up at -any- SMTP server along the
> way.

How many SMTP servers does it pass inside the company?

If you're worried about passing in the clear, why propose FTP?

> >> And Windows is the standard OS.  That doesn't mean it's worth a crap.
> >
> > No, but since it IS the standard OS in a corporate environment you
> > often have to work within that framework to make it as secure as
> > possible.  Letting users share out directories on their own breaks
> > that rule.
>
> No, it doesn't.  Sharing a folder saying that ONLY $user can get to it,
> with auditing, lets you know who got the file, from where, when.  Plus
> it's more efficient, kinder to the wire, and USING THE RIGHT TOOL FOR
> THE JOB.

And requires a lot more permissions and training for users to
properly maintain and an additional audit trail to watch.

I don't LIKE it that email has become a standard corporate method
of file transfer any more than I like it that Windoze has become
the corporate desktop platform, but in a given environment there
are advantages to limiting the number of tools users need to
work with.  Most users in a company have email and know how
to use it.  They don't necessarily have experience with FTP
or publishing web pages so if they need to send a file to
someone then email has the smallest learning curve.

Is it ideal?  No, of course not, but it allows an existing tool
with existing security to be used by users with existing knowledge,
all of which saves time and money.

Let me ask you this:  The last time you sent out a resume, how did you
send it and why?

-DanD

-- 
#  Dan Duncan (kd4igw)  dand at pcisys.net  http://pcisys.net/~dand
# "I can almost bend steel with my mind. I can bend anything
# if I try hard enough. But you can get too strong like that,
# so you have to be careful." - Martha Stewart to Oprah Winfrey in O Magazine.