Monday, August 10, 2009

Network inventory reviews

The remote employee had called the Help desk to request a unique software installation. In this company, employees have limited privileges on their systems and can't install software themselves-instead, they must contact the Help desk for assistance. The Help desk technician initiated a remote session to the employee's laptop and was preparing to remotely install the requested network inventory reviews software when she noticed something suspicious: The local Guest account was enabled and given administrator privileges with a password set to never expire. The company's standard laptop image always disables the Guest account, and the only way the account can be enabled is if an administrator with root privileges changes it. But for an administrator to make such a change is against company policy, and the remote employee couldn't have made it herself. To make a bad situation worse, the Help desk tech noticed that a non-standard piece of software-an FTP utility-as well as a nonstandard email program were installed on the laptop.

No comments: