View Single Post
Posts: 245 | Thanked: 25 times | Joined on Apr 2007
#30
Really, what a lot of this comes down to (as always) is convenience and ease of use vs. security. You can make a very secure, locked-down system, and it will work well for things like data entry/web/etc. If you need to do things beyond that, you generally need to relax some rules or remove policies - again, I'm speaking VERY generally here - such as adding VisualStudio users to a "Debug" group that has SOME administrator privileges. At my previous university, all USB ports were disabled in BIOS of the machines in a certain lab because a large, costly database lived on a server, and the licensing terms prohibited anything that could be used to copy off that database. The result was a revolt by graduate students that eventually led to the company changing the licensing terms to allow signed affidavits that we would not copy their data. The loss of usability in this case outweighed the added "security" for the data, and caused a lot of work for the IT folks and legal types in re-negotiating the contract. Again, as always, there is no perfect trade-off between ease of use and security.

I work in a university environment that is reasonably secure. All users must authenticate against Active Directory to get access to network resources, public jacks are protected via 802.1x, and private (office) jacks are somewhat protected against things like MAC flooding. The wireless network is secured by WPA2 and a Radius server which authenticates with the AD controller. Windows and Mac client machines must use the site-licensed antivirus, a VPN is in place to connect from home, all outgoing connections are NATed, traffic shaping reduces the burden of file sharing, and strong passwords are enforced along with changes every 60 days, etc. Linux is not an officially sanctioned OS, but I know that I, among others, use it daily in both workstation and server roles, with IT approval for the servers. Thus, I'd classify it as a pretty secure network, certainly on par with some corporate networks, but not as secure as a certain local very large company that I hear about from students. This makes sense, as most of our data is about students, and is protected by Federal privacy laws. It would certainly be bad for it to leak, but it would not cause the end of existence for the university.

How do I know my Linux machine (not N800) is secure? Two reasons:
1. I only run SSH as a service, and have passwords that are secure as defined by the local AD server, and changed every 60 days. The fact that no other servers are running automatically lowers the number of exploits that can be used, but doesn't eliminate all threats. Being behind a NAT firewall also means that the only people that could be hacking against my machine are on-campus, and I know for certain that port-scanning detection is in place on the network, and Ethernet jacks that exhibit the signs of running a port scan are shut down immediately.
2. I run a rootkit checker every week as a cron job and email the report to myself. Could something get by? Yes, but I feel I'm exercising due diligence in protecting the machine and the network by doing so.

So, to return to the original poster's question, "Is my N800 secure? Should it be allowed onto the campus network?" Well, the answer is obviously different than some corporate settings, for the reasons outlined above, but the answer is "If it can meet the same requirements as other devices allowed on the network, then yes". That means, if IT doesn't allow personal laptops or PDA's to connect to local resources, this device would be included. If policy prohibits card readers, this device would also be included. In my case, the device can support the wireless connection security the same as any student laptop, so there's no reason not to allow it on the network. Could it have malware? Yes. Could that malware potentially damage the network, attached devices, or data? Yes. Could a student or faculty laptop have the same effect? Yes. That's why so many protections are on the network, to allow a (for a university) reasonable trade-off between security and ease of use.