>As we all know from system security experience, the simplest and
>greatest reducer of risk is to implement strict control of passwords.
>After that you prioritize based on likelihood of attack, potential for
>damage etc. etc.
I prefer to reduce this problem to a more generic statement
of principle: "The greatest risk is your users." I solve that problem
by throwing them all off my firewall completely. That way I have
exactly 2 passwords I need to worry about, no worries about .rhosts
or any nonsense like one of my users deciding to fire up IRC.
Password control, password aging, scripts to remove .rhosts
files every night, etc, etc. are all just means of attacking the
symptom. Solve the problem.
mjr.
|
|
