© Andrew Brown, 123RF.com
Acceptable Risk
As a system administrator, it's up to you to shield your systems and your users from the threats of malware, including viruses, spam, spyware, and detrimental payloads of all types. It's also your job to protect users from themselves – and to defend your company's assets against malicious attacks originating from outside and inside your network. But, there's only so much you can do. You can patch, update, upgrade, firewall, honeypot, intrusion detect, obscure, and minimize to the Nth degree, but you can't remove all risk. You have to draw the line on risk to determine how much of it you'll tolerate as an acceptable amount.
There's no way enforce a policy of zero risk tolerance. That is, unless you are going to unplug all of your computers from the network. You'll have to adopt a policy of acceptable risk. A good example of acceptable risk is to allow email attachments through your filtering system. If you allow users to receive email attachments, which can and do carry harmful payloads, you've decided to accept some level of risk.
Another example of acceptable risk is allowing users to have a local account on your systems. The acceptable risk is that you trust your users enough to keep their passwords secret and to maintain a high level of personal security: locking their laptops, preventing over-the-shoulder spying, using a secure VPN connection, keeping anti-virus programs up-to-date, and leaving the personal firewall on.
The risks associated with local login accounts are that they:
- provide an additional attack vector,
- are susceptible to man-in-the-middle attacks via remote login,
- allow a system intruder to easily backdoor a system later.
Acceptable risk does not mean you are asking for your systems to be exploited, hacked, owned, or compromised. It means you realize there's a reasonable limit to the amount of security due diligence that's possible while maintaining a profitable level of
...
Buy this article as PDF
(incl. VAT)
Buy ADMIN Magazine
US / Canada
UK / Australia
Related content
-
What's the Risk?
As system administrators, we are continually challenged with balancing risk vs. benefit. In everything we do, touch, or alter, there is risk. -
Vulnerability assessment best practices for enterprises
A vulnerability assessment is an important step toward protecting an organization's critical IT assets. -
Risky Business
For all the fear, uncertainty, and doubt still surrounding cloud technologies, you must take a level of acceptable risk to move forward. - NIST Releases Open Source Tool for Assessing Risk of AI Models
- NIST Releases Draft of Cybersecurity Security Framework v2.0
Subscribe to our ADMIN Newsletters
Subscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Most Popular
Support Our Work
ADMIN content is made possible with support from readers like you. Please consider contributing when you've found an article to be beneficial.
