[sdw2003] Whitelisting discussion?

[Tracy Reed]

On Tue, Jan 19, 2010 at 03:34:06PM -0800, Thaddeus Braun spake thusly:
> So it's more of a "corporate IT departments don't have a good idea of
> what software is running on all the computers within the corporation,
> and don't want the administrative overhead of managing all the change
> requests..." kind of thing. I hear you.

Yeah...

> Everything else was blocked, and users could not just click away the
> screen. It had to be brought to IT's attention and a discussion
> would be held before a decision was made.

This is the sort of thing where upper management must be *completely*
sold and committed to the idea and support IT unwaveringly. If it is
implemented, is a hassle for the users (which it will be, initially)
and user complaints begin mounting and management falters it will not
only make IT look bad but will seriously demoralize them.

> Apps like IE were troublesome since they called so many other apps,
> but even that was able to be managed. The hardest part were the
> updates every month from Microsoft, Adobe, etc. I believe the newer

Speaking of IE and updates...

The Google/industrial espionage/China incident of the last week has
brought to light 0-day IE and Adobe exploits. And on top of it all we
now have this come out just today:

http://lists.grok.org.uk/pipermail/full-disclosure/2010-January/072549.html

So even running as non-administrator will not prevent your machine
from being infected in undetectable ways.

-- 
Tracy Reed
http://tracyreed.org