Convenience is the Enemy of Security

The Network: A government contractor on the U.S. East Coast with 250+ servers and 100+ workstations.

The Expectation: System Administrators are highly aware and well trained on security procedures. They can be counted on to act mindfully at all times.

The Catch: Download and install of an unsigned, shareware utility to show disk space usage across local folders.

The Find: IT team received a low disk alert on a critical server. Speed is of the essence in clearing up the low disk condition – and so security takes a back seat. The Admin recalls a shareware utility that can show summary disk usage across local folders so that he can quickly decide which folders to delete/purge and recover from the ow disk condition. In his haste to resolve the operational condition, he disables enhanced security mode in the browser, downloads the utility from a shareware site and runs it on the server to get the job done quickly. This is risky behavior – exposing a critical server to a unsigned program downloaded form a shareware site.

The Fix: Re-education for super privileged administrator.

The Lesson: Make haste slowly; security is always a concern.