| T.R | Title | User | Personal
Name | Date | Lines |
|---|
| 249.1 | NETWORK SECURITY | CURRNT::DAW | VTX does it with pages !! | Wed Jun 07 1989 10:05 | 20 |
| A memo dated 16-Jan-89 from Murray Smith of Information Services,
details Urgent security actions to be carried out by system managers
at all Basingstoke sites, in order to recover from a virus which
affected all nodes over the previous weekend.
point 6 of the memo states:
"ALL accounts with privileges above the norm must have their passwords
changed immediately.
NB
No account with priviliges must have the qualifier REMOTE which
allows SET HOST access."
perhaps your point of contact could be Murray Smith Jamie.
If anyone is interested I have a hard-copy of the memo
Regards
Rob
|
| 249.2 | | VULCAN::EBDON | Kimberly is a diamond (mine) | Wed Jun 07 1989 10:19 | 4 |
| Fortunately the sub's haven't adopted this policy, otherwise they'd
be unsupportable.
Terry
|
| 249.3 | | CURRNT::BADMAN | Compulsive Neophiliac | Wed Jun 07 1989 10:29 | 31 |
| Thanks, Rob. I'd actually like to discuss security standards here
since I think that it's something that many people could have an
opinion on.
RE the memo.
The network worm is the cause of all this then, eh ? This would
explain why nobody has bothered to impose restrictions on dial-in
accounts, I suppose. Wouldn't it be a better idea to force everyone
to use the password generator for their accounts ? That is secure
yet has no painful side effects. Didn't the worm only work properly
if it could get into the decnet account with password "decnet" ?
Isn't that poor system management more than anything else ?
Do people who have workstations adopt these security standards ?
Honestly ?!
RE .2
Yes, I made that point in my mail to Norman Jackson; sometime, a
supporter needs to log into a privileged account on a remote network.
If everyone adopted our impractical security standards, then there
would be a lot of angry people.
Jamie.
|
| 249.4 | The original memo | CURRNT::BADMAN | Compulsive Neophiliac | Wed Jun 07 1989 10:31 | 75 |
| I thought it would save me a fair bit of typing if I included the memo
I sent in this note ...
Jamie.
I N T E R O F F I C E M E M O R A N D U M
Date: 19-May-1989 05:43pm BST
From: Jamie Badman (in name only!)
BADMANJ
Dept:
Tel No:
TO: Remote Addressee ( NORMAN JACKSON @KRR )
Subject: VMS Account Security Standards
Hello Norman,
Having recently requested extended privileges for my VMS account, I have
come up against some problems regarding Digital UK security standards and I
wonder if you could clarify the situation for me.
I require SYSPRV for my account. I am told by I.S. Operations that when
given such a privilege, the ability for me to perform a remote connect to
my account is removed. This apparently is a UK Security standard. On
speaking to the person running the I.S Operations team in the Crescent,
I am told that there is no way that I can have both the privilege and the
ability to set host into my acount at the same time, because of standards.
Aside from these standards causing me considerable inconvenience, I
envisage some further problems ...
- In the development environment in ADG, the installation documentation for
a product should contain the output from an installation. Software
installations have to run from accounts with extended privileges. The
output has to be captured by the SET HOST 0/LOG command. Obviously, this
causes a violation of the security standards. It is, however, a necessary
aspect of the installation documentation.
- In the support environment, the situation arises where a problem occurs
on a remote system and it can only be solved by the supporter logging into
the remote system. The supporter also requires privileges on the remote
system to solve the problem. This again violates the security standards.
- Many people are able to dial into the Digital network from terminals in
their home. Some of these people have privileged accounts. For all
intents and purposes, there is no difference from the system security
point of view between dialling in and setting host from a remote system.
Finally, the reason I find the standards inconvenient;
- I work in Basingstoke yet live in Reading. I often need to work
weekends etc in order to meet project deadlines. With the security
standards currently implemented I can no longer work from Dec Park
as I used to in the days when I had minimum privileges. I have to
travel into Basingstoke to do my work.
I wonder if you could comment on the reasons for the standard given the
above points ? I personally feel that it should be more of a recommendation
than a standard; perhaps authorization for waiving the standard for
accounts could be implemented - perhaps a form signed by a manager of a
certain level or above ?
Cheers,
Jamie.
|
| 249.5 | LOCAL SECURITY ? | CURRNT::DAW | VTX does it with pages !! | Thu Jun 08 1989 10:35 | 37 |
| Hi Jamie,
just to clarify about the worm, a memo was sent to all system managers
from Jean-Pierre Demoulin (IS Information security) which detailed
what to do about the virus. The only points mentioned in this memo
were:
"First you need to secure your insecure systems, it means put a
wrong USERNAME and an invalid password for the DECNET task object,
and to check that no obvious password is set for all accounts.
A version of CRACKIT will soon be available to help you check all
your accounts.
A list of INSECURE accounts was distributed in the INSECURE report
for December."
the memo went further to detail how to stop the worm on your machine
and further how to stop it on another machine.
It seems that the decision for having privileged accounts without
remote access is a local one, from reading the Security mails that
I received. Another point of contact could obviously be Jerry Thompson,
but also Peter Russell, who I think is "VERY HOT" on security issues.
I'd agree with you that having a privileged account with NOREMOTE
access is sometines awkward, especially if you use a VAXstation
II GPX, where you have to set host to all accounts.
One possible solution is to have two accounts, for example DAW (no
privilige but remote access) and DAWP (privileged). This works in
some situations but I guess if the machines aren't local you'd still
have the same problem.
Regards,
Rob
|
| 249.6 | Security is (unfortunately) necessary. | CURRNT::RUSSELL | Oh, NO! You didn't press THAT key! | Fri Jun 09 1989 09:39 | 35 |
| Jamie,
Security in general is an area that has not recieved enough
attention in the past.
There are many things that have been done incorrectly in the
past; the recent "worm" simply helped to focus some attention
in this area.
Many things are being done in this area that are invisible to
you; some things that are being done are visible (the recent
audit I did, for example.)
There is obviously a balance between "being able to do your job
efectively", and the "need for security". I am sure the
balance isn't always at the right point......
If you would like to discuss this further, please pop round and
see any one of the CCG. For obvious reasons, I don't want to go
into details here.....
But also, don't forget Digital is a very "open" company. I'm
sure most of us have worked in organisations wher security was
*much* stricter that here. And by Security, I mean *all* aspects,
not just computer security. I certainly don't want to see us in
a situation where, if someone asks me a question, I have to say,
"Why do you need to know that? Show me the necessary authorisation."
Security is something we should all be aware of, and "do our bit".
Hmmm, maybe we could "dig for victory" and plant potatoes on the
grassy verges, and get better chips in the canteen....
Peter.
|
| 249.7 | | CHEST::WANDA | | Fri Jun 09 1989 11:29 | 11 |
|
Hello Jamie,
I would be extremely interested in seeing Norman Jackson's reply
to you posted in this notes file.
Regards,
Wanda
|
| 249.8 | Hope for the future! | BIGHUN::HARVEY | The Devon Dumpling | Fri Jun 09 1989 15:33 | 24 |
| > Does this mean that there is a local policy that covers this ?
>
> Where can I get a copy of such a policy ?
>
> Who do I speak to to get the policy changed ?
Jamie,
There's a guy who's just joined the UK IS Strategic Planning Group,
- Jim Cahill - his role is to specifically look at security, and all
the issues arising.
He works with the Euro security groups, and has contacts with Norman
Jackson.
As I said, he's new, and just trying to set up contacts, and let
people know what he is doing.
- why not give him a call?.
- Invite him down to one of your unit meetings, or a group of you who
are specifically interested in security?
Heather
|