On Fri, 21 Nov 2008 18:13:27 GMT, n3td3v said: > Its sad when it comes to the state of affairs when random folks on a > mailing list need to advise the u.s department of defense because > their IT security staff suck. Yeah, especially when the random folks don't even understand the problem space. You ever consider the possibility that some of those machines *need* the removable media, because they are sneaker-netting highly sensitive data around (the sort that you'd be upset if it was on a network-accessible machine)? That puts constraints on what you can and can't do to secure the removable media. It's a bad idea to epoxy-glue the USB slots when that's the only way to get data in or out of the machine. Kinda boat-anchors it. Having said that, it *is* a good idea to configure the box so the removable media is flagged non-execute - unless the removable media includes the executable that's the machine's reason for being, but the media has to go back into the GSA-rated safe when you're done working with it. (And yes, there *are* boxes out there that don't *have* permanent storage - you have to check the removable storage in and out of the vault.)
Attachment:
pgpSMSYTe4PHY.pgp
Description: PGP signature
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/