Step 11: Lock down clients
Just when you think you've followed all the rules to safeguard your
business assets against viruses and hackers and burglars -- along comes
an employee with a "better" idea. Only it's not -- and it could unravel
all the smart security moves you've implemented so far.
Why Your Business is at Risk
It's a major commitment to properly safeguard your business from
external threats. If you've started down that path by updating your
software and virus protection and installing a firewall, you've already
made a significant investment of time, effort and money.
Unfortunately, the lack of stringent administration procedures can
unwittingly sabotage that security investment -- reversing the changes
you've made or inadvertently introducing new risks.
Basic Steps You Can Take
To ensure you get the full benefit of the safeguards you've put in
place, you may need to get proactive about "locking down" your client PCs.
That way users can't intentionally or unintentionally override the
security measures you've implemented.
Use the information below and the additional resources in the sidebar
that best fit your organization's needs. You may want to take advice from
several of the guides, depending on the operating systems and applications
on your network.
Practice least privilege: With Windows XP and Windows 2000, it's
possible to give users different permission levels based on the role they
play in your organization. Many small businesses tend to give all users
"Administrator" access on their PC so they can easily install new software
or make other changes. But by doing so, they make it easier for viruses to
infect the machine or for users to install software that violates company
software policy or protocols. You may want to consider:
| • |
Negating "Administrator" privileges for most
users and relying on the built-in "User" level privileges |
| • |
Developing your own criteria for privileges |
| • |
Having users request assistance from someone with
appropriate permissions when they need to do something that requires
more authority |
Use servers to manage clients: With Windows Servers it's
possible to centrally control client PCs, thereby giving an individual
user access to specific programs only. That way they can't make changes,
install new software or manipulate passwords.
