Re: Is it safe to use social securty number as intranet username? (long)

From: Barry Margolin (barmar@genuity.net)
Date: 05/17/02 

From: Barry Margolin <barmar@genuity.net>
Date: Fri, 17 May 2002 15:08:07 GMT

In article <OAYE8.6474$v23.189769982@newssvr17.news.prodigy.com>,
MARK BURGGRAF <mburggra1@prodigy.net> wrote:
>Mathias Grimmberger <mgri@zaphod.sax.de> wrote in message
>news:m3adqzsurg.fsf@zaphod.sax.de...
>> > How would the coffee boy get access to the internal database of the
>> > intranet server?
>
>Easy. In most cases now-a-days he doesn't even need to be an employee. Our
>company uses a 'wire-less' intra-net in addition to the traditional
>'hardwire'. This accomodates laptops, etc. I've written several memo's
>with step by step instructions on how some one could sit in our parking lot
>and hack into our net-work. I've offered a demonstation...

Access to the network is not the same as access to the internal database of
the server. If the machine is properly secured, people with access to the
network should only be able to access their own accounts.

If people can hack into servers with important data on it, then you have a
far bigger problem. 

-- 
Barry Margolin, barmar@genuity.net
Genuity, Woburn, MA
*** DON'T SEND TECHNICAL QUESTIONS DIRECTLY TO ME, post them to newsgroups.
Please DON'T copy followups to me -- I'll assume it wasn't posted to the group.

Relevant Pages