It’s a truism that many companies, after creating an initial security policy, fail to either enforce or amend that policy. Standing pat in the technology field is a recipe for creeping disaster. Witness the recent efforts by Microsoft to wean trailing-edge users from IE6. Old, creaky, bug-ridden, flaw-riddled as it may be, some organizations are grimly hanging because key applications will work with no other browser version.
This in itself might not be as bad if the use of this browser was restricted only to the corporate networks. Perhaps this was the original intent of the original security policy. But the policy in effect seems to have been written for desktop systems that never left the confines of the corporate office.
Consider the following. A company (we’ll call it BeanCo) is still distributing Windows XP, SP3 as it’s standard image for company-supplied computers (it’s ironic to see the XP login screen while looking at the Intel I-5, suitable for Windows 7 logo pasted on the front of the laptop). One of the things that the Windows XP firewall lacked was the ability to sense when the user had connected to an undefined (home/work, other) network, and ask what policy should be applied. If the answer was “big bad Internet,” certain capabilities (like file and printer sharing) were turned off.
Not so in the BeanCo standard release. All Windows sharing services are enabled by default. So turn them off at the firewall, you say. Ah HA! Not so fast, Bunky! Turns out that the group policy doesn’t allow a user to manipulate the firewall rules. Bazinga! Hoist on your own petard.
Now, it might be the case that the IT group at BeanCo assumed that the employee grabbing a quick latte at Starbucks in the morning who wants to check their corporate email, would fire up the corporate VPN client and join the corporate network, implying that the availability of these services would be protected by corporate security products. Of course, these services haven’t been disabled on the local WiFi network. On the other hand, corporate email is available via the Internet using (you guessed it) IE6. No VPN there. And what might happen in the presence of a targeted phishing email sent to the employee’s corporate address? Surfing to that address whilst in said coffee-shop doesn’t provide any of the corporate protection. Just you, your creaky old IE6, and a too-permissive set of firewall permissions.
It can cost a lot to keep up with the Joneses. It can cost even more if you don’t.
