Last Updated on September 30, 2010 by Dave Farquhar
Friday, 6/16/00
NT security consulting. I think there’s a special place in hell for recruiters, slimebags that they are, but I’m starting to wonder if that place isn’t next door to the special place for consultants. I took a consulting gig that basically amounts to setting up an NT domain correctly–how many times does one have to say don’t put a server on DHCP, just give it an IP address? It’ll probably also involve building a Linux box to serve as a firewall, since this is a school that suspects its students have been tapping into the office network from the lab and nuking (or possibly changing) files. Kids today, I’ll tell ya…
Putting the two networks on separate NT domains and TCP/IP subnets should make that difficult, but with a Linux box that doesn’t speak SMB sitting between the two networks, it should be impossible. It’s also tempting to just unbind TCP/IP from the MS client and use NetBEUI as the networking protocol in the office for added security. That way, even if someone did manage to get into the Linux box, they still wouldn’t be able to do anything useful.
Come to think of it, with TCP/IP unbound from the MS client, do they even need a firewall? Maybe those extraneous protocols that shipped with Windows are useful for something after all… NetBEUI’s awfully chatty, too chatty for large networks, but this is a small network.
I speak harshly of consultants because my predecessor documented absolutely nothing that he did. I mean, I understand the temptation to make a client dependent on you, but if you do a good job and then hand over total documentation of their network, why on earth would any sane client go to another consultant afterward? Methinks they’d trust you to the death.
Then again, maybe I still have a naive, idealistic view of human nature…
Look out, George Brett… Can’t resist. The company picnic was today, and I played softball. Led off and played catcher (yes, I was the odd catcher batting leadoff, and the odd leadoff batter who can’t run). I went 1-for-2. Thought I stroked a single to right my first at-bat, but it curved foul, and I fanned on the next pitch. Next at-bat, with a runner on and two out, I stroked a single to right. The runner advanced to third on the play; I was thrown out trying to take second on a close play.
I thought swinging the bat would be a good test on my wrists, and it was. They held up. Hitting everything to right field indicates low bat speed, but that’s to be expected I think. I was a bit surprised I could swing the bat at all, let alone do anything productive with it. Now if I’d only stayed at first, because the batter after me led off the next inning with a long homer to center, which would have been a three-run shot if I’d been more conservative.
David Farquhar is a computer security professional, entrepreneur, and author. He started his career as a part-time computer technician in 1994, worked his way up to system administrator by 1997, and has specialized in vulnerability management since 2013. He invests in real estate on the side and his hobbies include O gauge trains, baseball cards, and retro computers and video games. A University of Missouri graduate, he holds CISSP and Security+ certifications. He lives in St. Louis with his family.