Re: [Full-disclosure] Computer name should match with your real identity?

[Guy <full-disclosure@xxxxxxxxxxxxxx>]

On Fri, Apr 29, 2011 at 3:26 AM,  <taneja.security@xxxxxxxxx> wrote:
> Recently got a policy from admin to change your PC name with your "name" +
> organisation name.
>

System admins typically aren't responsible for policy creation
depending on the size of the organization. Was the request made due to
an organization policy change, a new guideline, or just "because"?

Was the admin given the appropriate authority to request such a change?

> I am not doing it for a long time as I feel it could be case of
> "information leakage" .
>

While that's a valid point worth considering, orders are orders, which
is why it's important to know under whose authority did the admin
request the change.

> So need any ref./case study/security policy referencing not to have real
> name .
>

For starters, a computer isn't a person. A more appropriate location
to store equipment assignment data is in an asset management/tracking
system. This way there's an audit trail and accountability. The
equipment becomes the users responsibility, so when/if it's
transferred to another user, there's motivation for them to make sure
their asset manager is informed. Otherwise, they risk being charged or
held responsible if the equipment goes "missing."

Also, an environment with roaming profiles or multi-user systems will
make the computer name irrelevant/invalid once another user or users
logs in. There are probably dozens of other reasons that just aren't
worth mentioning. Think most would agree the admin's request is a
terrible idea.

Perhaps you could recommend an alternative naming convention that will
provide more benefit to the organization in the long run.

A couple of examples:

BIT02DWS9966 - Bureau of IT, Building #02, Desktop Workstation,
Property/Asset Tag 9966.
BFS07LWS9211 - Bureau of Financial Service, Building #07, Laptop
(mobile) Workstation, Tag #9211.
PDC01SVWB012 - Primary Data Center #01, Server, Virtual Machine, Web/HTTP, #012
DDC02SPEX022 - Disaster Recovery Data Center #02, Server, Physical,
Exchange #022.

<location>,<3 char type class code>,<asset#/clusterid/whatever>

Can apply this convention to any type of device on the network: SDB
for databases, MFP for multi-function printers, HFW for hardware
firewalls, etc.

To distinguish between dev/test, use a higher number in the suffix,
999, 998, etc. Prod will use 000, 001, 002, etc.

Just an initial thought, others may have better suggestions.. Would
like to know how other organizations address this issue, though.

I personally hate seeing devices on a network with ridiculous names as
though the IT infrastructure is some kind of kiddy cartoon world.
Gonzo, Nemo, Simba, and the like are not appropriate and provide
absolutely no benefit to anyone. If users need to access a resource
using "simba", create a DNS alias/entry...

"Uh-oh, Sponge-Bob is out of ink, can you reprint the report on the
Chim-Chim!!?!on1e??!"

Yea, didn't make that up...

And just to be clear, the proposed naming convention above isn't
something to distribute to end users or folks using the services on a
host.

Have had developers ask me to audit their web applications and provide
a url like, 
"http://PDC01SVWB996.int.the-domain.org/some-lame-app/MyAwesomeTool.aspx";.

No. Create a DNS entry, don't distribute the actual host name... Good luck.

Regards,

Guy
www.nullamatix.com
Key: 0x353DA923

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/