Microsoft Small Business Server 2003 Unleashed

Your best defense for your workstation perimeter is truly an educated end user. Recent years have seen the increase of blended threats where viruses drop Trojans, or a machine is made into a bot to be used in a larger attack on another system or systems, or even rootkits where programs that were once only in the UNIX system are now are being introduced to the Windows administrator. Rootkits are designed to be undetected programs that silently gather data or other malicious tasks. Although the Windows administrator can control the workstations and can ensure that antivirus is kept up-to-date along with antispyware, the reality is that your best defense is a well-trained end user. Understanding social engineering attacks, choosing strong passwords, monitoring physical safetyall these are key elements that need help from the end users in your network.

So, what's the first step toward an educated end user? First and foremost is an acceptable use policy. Before you can set the security goals of your firm and put in place the technology tools to assist you in meeting these targets, you need to identify with the business owner what is deemed acceptable.

Is the firm you are consulting for bound by regulations to protect certain kinds of data? Is the data required to be handled and transmitted in a certain manner? Where is data stored throughout the network? All these questions need to be answered before you can set an acceptable use policy.

Sample policies can be found at the SANS.org website but need to be tailored to your needs and possibly reviewed by a human resource attorney. What does your firm consider acceptable in the office? Is unlimited instant messaging part of the acceptable business use of computer equipment at your firm? For some firms, IM is part of the business structure and is not considered a time waster. However, there should be guidelines and notification that conversations done on business equipment can be logged, reviewed, and tracked. For most firms, illegal downloading of digital assets is considered inappropriate at best, illegal at worst.

Make sure that the staff is informed that only approved software is allowed and that only those parties who have the rights to download should be downloading. Stress to everyone in the office how they too are a part of the security fabric of your network. Consider as part of your managed services, information about common security hoaxes and scams on the Internet. Some of the best resources for being aware of such scams include the web resources such as Snopes.com and the Oops newsletter from Sans.org. You may want to consider sending monthly reminders to your clients of these social engineering issues.

Tables 10.6 and 10.7 present two sample checklists that can serve as memory joggers for you to think about this as an ongoing process that needs to be reviewed regularly.

Use this monthly and annual review process to ensure that your desktop security goals are being met.