Alerting My School of its Vulnerabilities

Quote:

---

Originally posted here by The Grunt
It's ignorance in its purest form.

---

This is not an uncommon occurence in the industry either. This is the reason law's like Sarbanes-Oxley have been enacted. And let me tell you SOx SUCKS! for a corporation with a dedicated manager and auditors/admins to handle it...it's hell on earth for an admin with too much work and not enough budget. I'd say ask Tiger Shark, but I don't think he's impacted, at a non-profit shop.

In the professional side, it comes down to DOCUMENT YOUR ASS OFF. Save all emails where you informed people. Archive emails offline and keep them safe. Save voicemails if you can (this can be tricky). But make sure you are telling whomever you need to about the problems, and documenting that you've done so.

BTW, a funny note struck me...you know what would have been even better than notifying him via anonymous email, would have been to send him the email FROM HIS OWN ACCOUNT what with that remailer being open on port 25. LMAO!

Quote:

---

How can you be in violation of the AUP when they are too lazy to restrict you from doing those things?

---

Let's start with the following premise:-

Policies are the adminstrative solutions to those technical problems that cannot be addressed, (be it through incompetence, inability or simply because there isn't anything you can do technologically to prevent the issue, (like a user taking a hammer to a monitor)

So... Where do we go from here? If I'm an incompetent admin I can write the policy to say:-

You are not allowed to visit http://www.hotblondsdoingthingstheir...tbeproudof.com

As the admin I have no clue how to stop you from doing it but, since I wrote it in the AUP, then you breach the AUP when you go there....

So it's all down to how the AUP is written..... Mine includes the following, (paraphrased):-

Quote:

---

Users are forbidden, under any circumstances, to carry out any action that may be considered by the MIS as hacking/cracking/subversion be it against the company network or any external network

---

It's my "catch all" item..... and it means that _even_ if I have missed something on the network _and_ even if I have not covered it in the previous 97 :D items in the AUP, if I think you are being an azzhole I can get you fired....

That's what AUP's are for and why you have to write them correctly to be effective.... Then you have to make sure that they are properly and regularly disemminated so the users have no excuse along the lines of "I was never told/was unaware/never knew that what I did was considered bad."

[Edit]

Zen:

I have HIPAA

Same **** different name.... ;)

[/Edit]

Well, it's good I stayed persistant. I got a reply from the school board promising that it would be looked into, and I got an apology letter from the administrator(Probably forced since it was cc'd to the school board.) I guess I'll see how things go and update if they get fixed or not. I don't think I'll offer my help, because I don't feel like working with an ******* administrator. Thanks for the help everyone. :)

Quote:

---

I don't think I'll offer my help, because I don't feel like working with an ******* administrator.

---

I think that is a bad idea right now. Having said that I _do_ counsel caution and distrust on your part.... They might be trying to flush you out.... It's the paranoid in me... :eek:

Everything you do now should be copied to both the admin and the board. You should address individual problems and should offer the solutions. In this way you show that your intent is benevolent and that you aren't trying to cause the problems but simply trying to help in fixing them.

Everything you send should be professionally written, concise and to the point. Hell, PM me and tell me the issue and the fix and I'll write the text for you... happily... I can "scribble" with the best of them.. ;)

Why should you work with an ******* administrator?

Because the world is full, of them... Someday soon you will be working for one and it's good experience..... trust me.... Tell this story to me in an interview and I'll probably hire you....

Thanks, but I included the fixes to the problem in the very first email. :)

Jareds411, changing the world one Admin at a time.

I love my humor.... Good job handling the matter.

Kind of reminds me, nevermind I won't go there.

Cheers :)

Yeah, I have to agree with Tiger Shark on how they might be trying to flush you out -- even the paranoid have enemies. Besides, that admin probably is out for your blood now. Keep it anon, and all will be well.

Having said that, I applaud you for your efforts, sir.

haha good job.

Very well done Jareds! I agree that anonimity is the best route to go as well. Having the Admin of your school openly gunning for you kinda makes it hard to go to that school... I'm curious if, after enough correspondence, the board might offer you his position?

/me gets this wicked gleam in his eyes...

haha blackice, thats EXACTLY what I was thinking(about the job)... But Id stay clear of this guy for now. last thing you want is a guy in the school system gunning for you.