It’s a common theme with dropbox and services like this. Basically it comes down to how much risk that the organization is willing to take, especially when it comes to information disclosure ( You are sending your internal information (how sensitive? Who knows) to a third party service, which you can't verify their controls, or whom else other than you has access to that information, when it is sitting on their servers in whatever location on the globe they reside, so do you really feel comfortable about this? You are going to have to frame it in risk to the higher ups, and either make them accept it in writing or advise them in writing of the slippery slope they are going down. ( Either way you cover your arse, especially if you are dealing with regulatory entities that might find a security breach of the dropbox host, and the lack of due-diligence/Due-care on your higher up parts to properly protect and security the company crown jewels could lead to some serious fines/penalities and even jail time in certain countries.
Z Edward E. Ziots CISSP, Network +, Security + Network Engineer Lifespan Organization Email:ezi...@lifespan.org Cell:401-639-3505 -----Original Message----- From: Kurt Buff [mailto:kurt.b...@gmail.com] Sent: Wednesday, April 13, 2011 5:35 PM To: NT System Admin Issues Subject: Re: OT: Dropbox authentication: insecure by design On Wed, Apr 13, 2011 at 11:17, Andrew S. Baker <asbz...@gmail.com> wrote: >>>The takeaway here: Don't use any remote applications in the cloud for >>> anything you wouldn't want to see posted on the front page of the NY Times. > FTFY I'll accept that fix. > This is much ado about nothing. I don't believe as you do. > If your box is compromised, and you're > sharing things remotely, then you have more risks than if you weren't. That's not the risk I am concerned about. I'm concerned about the risk where you're sharing a Dropbox account with folks whose machines are not under your control, which, from my understanding, is one of the major use cases for this service. Putting aside any concerns about the security of the Dropbox infrastructure (which is a considerable question of its own), the security model for this is completely borked. > Feel free to suggest an authentication mechanism that would withstand the > initial premise of "your machine is exposed such that your config.db is > stolen". My initial premise that your Dropbox is exposed if your config.db is stolen - not the same thing. > Several of the comments, particularly those by alec muffett, provide > valuable information about the risk. > I'd welcome the ability to see where else systems are logged on to Dropbox, > but that's about the extent of my concern at this time. And, given that some influential staff in my org are using Dropbox, and started doing so without notifying IT, I'm concerned about that too, and that I don't have a good way to turn their access to it off. Kurt ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin
