Schneier on Security

Anonymous • March 31, 2008 2:31 AM

And then they’re asking me ‘Why have you disabled firewire port on my PC?’ Oh, boy… There are situations when you can’t say ‘no, thanks’ to a potential attacker as you can’t foresee if he will try to connect a firewire HDD to the laptop right now, the day after tomorrow or next month. You either put a control on it or you don’t do anything and live with the fear that sometimes a serious data loss may happen in your company. It may sound strange in my practice that administrators don’t worry about port security because they think it’s impossible to implement such a protection without having a special knowledge in that. Of course all of us do some special security audits on occasion. But the question is – should you do a device security audit trail on a regular basis or not? I used to think that’s impossible to lockdown devices in Windows. I thought I had to have linux to manage devices that easy. Sure, every PC has a BIOS and disabling device – no more than selecting “Disabled” next to device control options. But then you have to password your BIOS to prevent users from changing the device settings back. However having a password set on user computer BIOS just adds pressure on your support team and nothing more. Remember the old trick with resetting BIOS http://pubs.logicalexpressions.com/Pub0009/LPMArticle.asp?ID=156 some of us used back in the day. It has no real use except for problems with HID devices when you need to have users work with a USB mouse or a USB “whatever” and it doesn’t work because USB ports were disabled on a low level. So what do you do then? Go figure! I liked that Vista is much improved with its device management policies and special administrative templates for playing around with device security with removable storage protection. And still that wasn’t the best-fit solution for me (though it obviously holds some value). That’s mostly because of the poor management facilities that did not allow me to configure flexible rules to filter out all but some very concrete types of devices from use. Secondly, this solution doesn’t provide reliable tracing and reporting which makes it impossible to maintain within changing environments. I am not saying that it’s an easy task to do that in Windows. But despite all my fears and delusions I’ve finally found an elegant solution that allowed me to fine-tune device security throughout my domain. The answer was a desktop management solution. In my case, I found that was Scriptlogic’s Desktop Authority. I loved it for its broad device type support http://www.scriptlogic.com/desktop-authority-usb-device-lockdown.asp , ease of device access permission management and powerful reporting. The good thing about it was that I could specify a needed level of access depending on the user, some Active Directory properties associated with the user (such as user membership) and hardware class. The last thing really helps with managing laptops. You know that’s so hard to manage laptops nowadays – they are so feature-packed so you often get stuck when it turns that you can’t turn the Firewire off forever. When this is a general Firewire fault intrinsic to any Firewire bus version I believe that it also affects Vista machines too, right? Often it’s hard to implement device access permissions even though those are deemed easy. In Vista and the new Server you have one set of administrative templates. For Windows XP you don’t even have a factory made template so you have either create your own administrative template to stop device drivers or you live with that well-known KB allowing to import the scant ADM file targeting to disable access for USB/CD/Floppy. No-no…There is no doubt in my mind thaqt I was absolutely right that I insisted on purchasing Desktop Authority. The thing that I love in Desktop Authority is the extensive reporting. Its far beyond my home-made reporting scripts that I used to create myself in my ‘former administrative life’. Talking about USB security, I really like the report that collects the information for who was logged in when and which USB device he or she tried to plug in to which computer. That’s more than that log parsing that I did before. I think when you deal with Active Directory environments or any other complex environments you have to take control on the situation for every computer and every user registered within the directory services you can’t manage the whole thing with a per-machine handling. I am glad that I am not alone here and there are companies that make tools like Desktop Authority allowing me as administrator perform a complicated real-time control with SQL reporting without needing to rack my brains on how to solve the problem for each particular user. Why do I need to learn commands for devcon play with device classes, edit ACL for INF files when I can just configure it easier then it takes me configure password security policy in GPMC? So the adage ‘The more security you have the more work there will be’ doesn’t apply here. The thing is ‘ease of use’. Why do I care about complexity of rules when it’s easy for me to lockdown device access?
You guys here are security-pros and would really love to hear from you. What’s your practice in implementing device security in your Windows networks?