Yeah, just try it...
Oct. 15th, 2003 04:11 pm![[personal profile]](https://www.dreamwidth.org/img/silk/identity/user.png){kind=small}
tugrikSo today we have two mega-VIPs visiting us, from a rather huge (global) celphone company. They're doing what's called 'due diligence', where they poke and prod and audit everything they can get their over-eager hands on, to make sure everything in our contract is as we present it. I knew they were going to want internet access when they were here and I knew they were going to be really persnickety about security. My boss failed to believe, thinking we could just plug them into our corporate LAN and be done with it.
Ready for this, I'd previously set up both a wireless and a wired "customer DMZ". One of the VIPs asked for wireless access, and I happily gave him an 8-hour password. He logged in and started to surf the web -- causing the captive portal to ask him for name and password before allowing him to use our internet link. Perfect. The other had no wireless card and asked for a port to plug into. We cabled him to the ports in the conference room, and he was able to get online right away. Neither really had to do any configuration.
Both of them then proceeded to blatantly run scanning tools. Evil scanning tools. Yup, this wasn't access -- this was an audit. The DMZ functioned perfectly and they didn't find squat except a clean path to the Internet. They nodded, smiled, thanked me for the hook-up and jotted down a few notes.
If we'd let them just link to the LAN they would have found all kinds of things. I know the particular evil of the tools they were using. While they wouldn't have been able to do anything to our servers they could have done a lot to suss our infrastructure which would be quite an ugly mark on a security audit.
The urge to do a huge "I told you so" dance (wth all the stomping and wrecking of nearby objects involved) in front of my boss is incredible. I'll behave, though. :)
Ready for this, I'd previously set up both a wireless and a wired "customer DMZ". One of the VIPs asked for wireless access, and I happily gave him an 8-hour password. He logged in and started to surf the web -- causing the captive portal to ask him for name and password before allowing him to use our internet link. Perfect. The other had no wireless card and asked for a port to plug into. We cabled him to the ports in the conference room, and he was able to get online right away. Neither really had to do any configuration.
Both of them then proceeded to blatantly run scanning tools. Evil scanning tools. Yup, this wasn't access -- this was an audit. The DMZ functioned perfectly and they didn't find squat except a clean path to the Internet. They nodded, smiled, thanked me for the hook-up and jotted down a few notes.
If we'd let them just link to the LAN they would have found all kinds of things. I know the particular evil of the tools they were using. While they wouldn't have been able to do anything to our servers they could have done a lot to suss our infrastructure which would be quite an ugly mark on a security audit.
The urge to do a huge "I told you so" dance (wth all the stomping and wrecking of nearby objects involved) in front of my boss is incredible. I'll behave, though. :)
