What I Worry About When Web Publishing

re: What I Worry About When Web Publishing

Andrew Dugdell — Thu, 08 Sep 2005 00:33:28 GMT

My first thought is ammend your security policy (if one exists) to have users change their password after public confences/road trips. If you need some incentive to convince them, the defcon wall of shame (www.techfreakz.org/defcon10/?slide=38) does wonders. And I totally agree with "user re-education/awareness", training users to change their password at *trusted* locations. But these are just my personal thoughts. I'm keen to see what others think as well.

PS: do you trust this keyboard: http://dennisjudd.com/albums/funpics/tastatur.sized.jpg

The Missing Smartphone!

Dugie's musings on Glasshouses — Thu, 08 Sep 2005 00:47:27 GMT

I had the unthinkable yesterday, I couldn't find my phone!&nbsp; This was slightly complicated by the...

re: What I Worry About When Web Publishing

tristank — Thu, 08 Sep 2005 05:05:57 GMT

That keyboard is about right for the mental image of keyboard dirtiness I'm trying to conjure up!

re: What I Worry About When Web Publishing

Doofusdan — Sun, 11 Sep 2005 21:38:41 GMT

Very much on point.

Re the certificate solution you mention - yes, maybe that means the machine was ONCE trusted. But given the current state of Windows in particular, if a machine is not patched, does not have current AV software running, does not have current antispyware protection running, and does not have a good software firewall protecting it, I am not sure I can trust it NOW.

At the same time, I don't want to lock out access from clients that are not necessarily my company's to control. For maximum usefulness, people should be able to securely access web services from the widest range of machines, from potentially trustable ones (employees' personal computers for example) to completely untrustworthy ones - for example, those at a net cafe which pays no attention to security, because it doesn't seem to enhance the bottom line. In the middle of the spectrum are public internet access terminals at places which should be reasonably secured - like at a conference or university - but unfortunately it is so much work to keep clients secure that many such well-intentioned places do not necessarily cover all the bases.

That's my problem. How do I address it?

More on The Client Menace and Authentication

Blog du Tristank — Mon, 12 Sep 2005 14:16:14 GMT

A keylogging comment dissected. And hopefully addressed. But mainly dissected.

re: What I Worry About When Web Publishing

tristank — Mon, 12 Sep 2005 14:17:12 GMT

Hi Dan - the response ballooned, so I posted a new entry for it here:
http://blogs.technet.com/tristank/archive/2005/09/12/keyloggingfollowup.aspx

Hope there's something useful in the mess that helps clarify it all.

End of FY06 Blog Post

Blog du Tristank — Wed, 07 Jun 2006 13:12:12 GMT

If elected I solemnly promise no further technical content until FY07.