Re: ridiculous situation

From: bda (bda@mirrorshades.net)
Date: 11/28/02

  • Next message: Brad Arlt: "Re: IPF/IPTable/??" 
    Date: Thu, 28 Nov 2002 15:11:50 -0500
From: bda <bda@mirrorshades.net>
To: harley mcdonald <harleyqmcdonald@yahoo.com>

    Write up a decently detailed plan for migrating each of the running
    services off the machines onto newly installed, secure boxes. You can't
    trust those machines, you can't really trust the previous
    administrator(s), and you can't trust what you don't know.

    Since it's just five machines, it wouldn't take a lot of time to dig
    through the machines, find out what they do, how they do it, and then
    move all of that stuff elsewhere.

    Just make sure you write up a proposoal and migration plan first, and
    then follow it -- making notes as you go along so it's all documented.

    I've been through this situation several times, unfortunately. The goal
    is not to go around replacing every machine when you first start a new
    job, or inherit new responsibilities, but to assess each new device as a
    security risk and take the appropriate actions.

    On Wed, Nov 27, 2002 at 12:06:12PM -0800, harley mcdonald wrote:
    > hi,
    >
    > this is kinda broad...say you've inherited 5 ( R.H.
    > linux ) machines. all of which have been on for a
    > year, not firewalled and not backed up.
    >
    > management has a "ain't broke don't fix" mentality. i
    > guess, what would you do? how would you be sure
    > there are no trojans, bots etc...chkrootkit and so on,
    > i suppose, but how reliable will the results be? how
    > can i be sure there isn't a key-logger in the kernel.
    >
    > you can't simply firewall them off and leave them for
    > dead. legal action can be taken against the company
    > in the event of a break-in and subsequent attacks on
    > other companies.
    >
    > and on and on.
    >
    > any ideas?
    >
    > h
    > ..
    >
    > __________________________________________________
    > Do you Yahoo!?
    > Yahoo! Web Hosting - Let the expert host your site
    > http://webhosting.yahoo.com 

    -- 
bda
Cyberpunk is dead.  Long live cyberpunk.
http://mirrorshades.org

    Relevant Pages

    • Re: recommended TS license setup
      ... two-way trust, and I see errors which I think are caused by the TS License ... If I fall back to installing the TS license server on a stand-alone system, ... Can license server installed on a standalone ... Most of my machines are members of the ad.nicc domain. ...
      (microsoft.public.windows.terminal_services)
    • Re: The Voting Process in Maryland
      ... I asked the polling "referee" why I should trust these machines to produce an honest count, and she said, "Well, I feel secure about them." ... Perhaps you take the voting process lightly. ... She was laughing at your inability to make speak your displeasure about the voting machines in an effective manner. ... Democrats posing as Republicans to lower Webb's vote. ...
      (rec.boats)
    • Re: The Voting Process in Maryland
      ... I asked the polling "referee" why I should trust these machines to produce an honest count, and she said, "Well, I feel secure about them." ... She is a very nice volunteer, who was laughing at you as soon as you walked away. ... Perhaps you take the voting process lightly. ... She was laughing at your inability to make speak your displeasure about the voting machines in an effective manner. ...
      (rec.boats)
    • Re: The Voting Process in Maryland
      ... I asked the polling "referee" why I should trust these machines to produce an honest count, and she said, "Well, I feel secure about them." ... She is a very nice volunteer, who was laughing at you as soon as you walked away. ... Perhaps you take the voting process lightly. ... She was laughing at your inability to make speak your displeasure about the voting machines in an effective manner. ...
      (rec.boats)
    • Re: Trust Requirements -- PDC to PDC Only?
      ... machines into the new subnet a few at a time by shifting the patch cables at ... Then setup the Trust ... As a substitute for Zone Transfers you might be able to use Conditional ...
      (microsoft.public.windows.server.active_directory)