State your helpful network security tips here

[lullysing]

(I'll start)

Well, i have found that the most important tools is not the shiniest device or the most powerful servers, but simply in using the amazing planning power of the pen and paper.

Pen and paper, especially in the early stages of planning and development of networks, will save headaches and a lot of hotfixes. Planning ahead,determining network topology, allowed services and such will save you time and effort, and save you from encroaching "scope creep". with your plan already laid out, getting to work will be easier as things will have mostly been organised in advance.



_____________________________
when someone asks for your username and password, and much *clickely clickely* is happening in the background, know enough that you should be worried.

 

[Langley]

Make user education a priority. Most security lapses are the result of poor security habits or a lack of understanding among users. It does no good to have a 12 character mixed alphanumeric password if the user writes it on the front of the monitor housing (true story).

Exploitation of careless users will beat 128bit DES encryption every time.

Mac

"There are only 10 kinds of people in this world... those who understand binary and those who don't"

langley_mckelvy@cd4.co.harris.tx.us

 

[jrbarnett]

If you are on a Novell system, reserve Administrator equivalent logins for when they are required - as you can then easily see if you can access folders/files on the server that have rights set incorrectly through Windows Explorer (eg if Everyone group has rights to a person's home directory).

John

 

[jujogert]

Avoid noting down the passwords. Your brain, like a fartile garden have much more capacity than you can plant.

 

[michigan]

I agree 100% about training the end user. Nothing worse then an end user with floppies from home

Revisit your network shares, privledges, rights, etc....
I recently had a virus sneak into the network, via someone using hotmail to grab an infected attachment. Once in the system, the virus had a field day. Touching this, corrupting that. It was mutating quicker than the antivirus scanners could find it.

By disabling all users accounts, the virus stopped immediately. A virus can "usually" only map drives or see what the user (it came in on) can see. It can only go where the user can go.

This allowed me to scan/deleted all instances of the virus. Then, enable all user's accounts once again.

I personally will be redesigning our networked drives, mappings and security settings across the board. Hopefully, I will be able to contain a virus to a specific dept., drive or only a few folders on the network if this should ever happen again. But the disable all accounts (Novell Netware 6.x) worked in a pinch.

 

[bluedragon2]

Baseline, Network drawings, and Documentation...and keep them updated...

Check the baselines periodically.
Keep the drawings and documentation up to date.



Blue

If I wasn't Blue, I would just be a Dragon...