Re: [Full-disclosure] Computer name should match with your real identity?
lmao On Fri, Apr 29, 2011 at 4:13 PM, Brian Anderson brianlander...@gmail.comwrote: On 4/29/2011 9:17 AM, Cal Leeming wrote: Personally, I'd tell the admin the go and himself, and refuse outright. Although I do use tendency to use 'girls names' as server names, I never *ever* use my real name as the server/pc/user name. Hell no. On Fri, Apr 29, 2011 at 8:26 AM, taneja.secur...@gmail.com wrote: Yes, Be sure the machine name describes in full detail its function. My machines are public, confidential, secret, and top_secret. http://dilbert.com/strips/comic/2008-02-11/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
[Full-disclosure] Computer name should match with your real identity?
Hi, Recently got a policy from admin to change your PC name with your name + organisation name. I am not doing it for a long time as I feel it could be case of information leakage . So need any ref./case study/security policy referencing not to have real name . -Avii ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Computer name should match with your real identity?
On Fri, Apr 29, 2011 at 3:26 AM, taneja.secur...@gmail.com wrote: Recently got a policy from admin to change your PC name with your name + organisation name. System admins typically aren't responsible for policy creation depending on the size of the organization. Was the request made due to an organization policy change, a new guideline, or just because? Was the admin given the appropriate authority to request such a change? I am not doing it for a long time as I feel it could be case of information leakage . While that's a valid point worth considering, orders are orders, which is why it's important to know under whose authority did the admin request the change. So need any ref./case study/security policy referencing not to have real name . For starters, a computer isn't a person. A more appropriate location to store equipment assignment data is in an asset management/tracking system. This way there's an audit trail and accountability. The equipment becomes the users responsibility, so when/if it's transferred to another user, there's motivation for them to make sure their asset manager is informed. Otherwise, they risk being charged or held responsible if the equipment goes missing. Also, an environment with roaming profiles or multi-user systems will make the computer name irrelevant/invalid once another user or users logs in. There are probably dozens of other reasons that just aren't worth mentioning. Think most would agree the admin's request is a terrible idea. Perhaps you could recommend an alternative naming convention that will provide more benefit to the organization in the long run. A couple of examples: BIT02DWS9966 - Bureau of IT, Building #02, Desktop Workstation, Property/Asset Tag 9966. BFS07LWS9211 - Bureau of Financial Service, Building #07, Laptop (mobile) Workstation, Tag #9211. PDC01SVWB012 - Primary Data Center #01, Server, Virtual Machine, Web/HTTP, #012 DDC02SPEX022 - Disaster Recovery Data Center #02, Server, Physical, Exchange #022. location,3 char type class code,asset#/clusterid/whatever Can apply this convention to any type of device on the network: SDB for databases, MFP for multi-function printers, HFW for hardware firewalls, etc. To distinguish between dev/test, use a higher number in the suffix, 999, 998, etc. Prod will use 000, 001, 002, etc. Just an initial thought, others may have better suggestions.. Would like to know how other organizations address this issue, though. I personally hate seeing devices on a network with ridiculous names as though the IT infrastructure is some kind of kiddy cartoon world. Gonzo, Nemo, Simba, and the like are not appropriate and provide absolutely no benefit to anyone. If users need to access a resource using simba, create a DNS alias/entry... Uh-oh, Sponge-Bob is out of ink, can you reprint the report on the Chim-Chim!!?!on1e??! Yea, didn't make that up... And just to be clear, the proposed naming convention above isn't something to distribute to end users or folks using the services on a host. Have had developers ask me to audit their web applications and provide a url like, http://PDC01SVWB996.int.the-domain.org/some-lame-app/MyAwesomeTool.aspx;. No. Create a DNS entry, don't distribute the actual host name... Good luck. Regards, Guy www.nullamatix.com Key: 0x353DA923 ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Computer name should match with your real identity?
this is maybe to access theyre database, or belong to it, so they can basically track every pc, and possibly install psanYwhere as i know many corps want done, you do need to have proper name of pc for some of this stuff.. might be administral procedure, i would not stress on this to much id just ask about more about it... cheers! xd On 29 April 2011 17:26, taneja.secur...@gmail.com wrote: Hi, Recently got a policy from admin to change your PC name with your name + organisation name. I am not doing it for a long time as I feel it could be case of information leakage . So need any ref./case study/security policy referencing not to have real name . -Avii ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Computer name should match with your real identity?
Personally, I'd tell the admin the go and fuck himself, and refuse outright. Although I do use tendency to use 'girls names' as server names, I never *ever* use my real name as the server/pc/user name. Hell no. On Fri, Apr 29, 2011 at 8:26 AM, taneja.secur...@gmail.com wrote: Hi, Recently got a policy from admin to change your PC name with your name + organisation name. I am not doing it for a long time as I feel it could be case of information leakage . So need any ref./case study/security policy referencing not to have real name . -Avii ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Computer name should match with your real identity?
On 4/29/2011 9:17 AM, Cal Leeming wrote: Personally, I'd tell the admin the go and himself, and refuse outright. Although I do use tendency to use 'girls names' as server names, I never *ever* use my real name as the server/pc/user name. Hell no. On Fri, Apr 29, 2011 at 8:26 AM, taneja.secur...@gmail.com wrote: Yes, Be sure the machine name describes in full detail its function. My machines are public, confidential, secret, and top_secret. http://dilbert.com/strips/comic/2008-02-11/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Computer name should match with your real identity?
I am not doing it You are free to reject corporate policy as you see fit. Your personal effects will be at the security desk on Friday. We will mail your last check. it could be case of information leakage Internal NETBIOS/DNS names are generally helpful for identification of machines, and most places follow some soft of template of location+type+model+serial .. just so the IT department doesn't have to figure out some UNIX admin's scheme-de-jour of colors/gods/planets/whatever. Really .. what's easier to find the location/function of .. the machine named CORPHQWWWDEV1 or the one named Aristotle. Michael Holstein Cleveland State University ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Computer name should match with your real identity?
Recently got a policy from admin to change your PC name with your name + organisation name. The funnier with that thread, is that if you tell us that as a normal user, then that mean that you are a local admin, and most of user must be local admin if they sent that policy to everyone. Kinda a security issue just there, the computer name is just not important. who care your computer name when netbios traffic stay local on your lan. (ex, your co-worker must already know your name, i hope so) -phil ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Computer name should match with your real identity?
Same here as well for an across the global organization naming convention. W/S/L-workstation, server, laptop P/T/I-Prod/Test/Itegration BOS/HQ/FIN-Location or department www/sql/orc/fp-web, db, file and print etc lb01/hdn005-Load balanced, Help Desk North and numbers ETC -Original Message- From: full-disclosure-boun...@lists.grok.org.uk [mailto:full-disclosure-boun...@lists.grok.org.uk] On Behalf Of Michael Holstein Sent: Friday, April 29, 2011 3:17 PM To: taneja.secur...@gmail.com Cc: full-disclosure@lists.grok.org.uk Subject: Re: [Full-disclosure] Computer name should match with your real identity? I am not doing it You are free to reject corporate policy as you see fit. Your personal effects will be at the security desk on Friday. We will mail your last check. it could be case of information leakage Internal NETBIOS/DNS names are generally helpful for identification of machines, and most places follow some soft of template of location+type+model+serial .. just so the IT department doesn't have to figure out some UNIX admin's scheme-de-jour of colors/gods/planets/whatever. Really .. what's easier to find the location/function of .. the machine named CORPHQWWWDEV1 or the one named Aristotle. Michael Holstein Cleveland State University ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Computer name should match with your real identity?
On Fri, Apr 29, 2011 at 12:56:04PM +0530, taneja.secur...@gmail.com wrote: So need any ref./case study/security policy referencing not to have real name . RFC 1178 ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
