Right Amount of Security on Machine

Question

I am basically asking this question to see if I am being unreasonable. My current employer has locked down the machines of all developers so that we do not have access to the root or c: drive. For example, I cannot write a directory under C:. I also cannot install any software which touches the registry. Is this an extreme action or am I overreacting to common security measures?

What is the extent of security on your company provided machine? To add some scope to this question, I am a web application developer and I'm talking about a laptop owned by the company.

Answer 1

It depends a lot on your work environment. In bigger firms, it may be unfeasible for everyone to get their custom configuration, and your employer may do this to simplify assistance.

Where I work, I changed the OS the day I arrived, and have always been mantaining my computer since.

Answer 2

This is not unusual as the default position for many large companies. The attitude is quite understandable as there may be many thousands of machines connected to a "secure" company network and the consequences of having a rogue machine can be severe.

You may be able to negotiate an exemption for your machine if you can demonstrate a real need for additional privileges but if it is a company laptop that you take off site and connect to external/public networks then this may be difficult.

Answer 3

We are using linux on our development PCs - that means that only people with root access are allowed to update PCs and to handle requests to install custom software.

That goes with linux philosophy, and it makes perfect sense, since it is so easy to screw up the system. Who are you going to call in that case?

Answer 4

It sounds like developers need a second PC to use as testing sandbox. This can be inconvenient to test development tools, but it is safer. Think of your main PC as you would a production server. If you blow it up the test PC, you fix it. This way you can continue working on the corporate standard machine maintained by the staff.

Answer 5

Just for contrast:

We are not allowed to install software on our PCs and that is enforced (we can be dismissed for plugging in a personal usb drive). There are regular scans of our PCs to ensure that no new ports have been opened and no extra software shows up.

This is on our low-security computers that we use to do web browsing and email.

The ones we use to develop on can't get to the net and adding anything to our stack requires filing paperwork, a committee meeting and a security review before we can try it out in dev. More forms if it becomes part of our production stack.

Yet still attackers (that we hired to test our security) were able to get on the first network and jump to the air-gap to the second, so we are continuing to improve our processes.

We are a pretty high-value target though.

I guess what you can do on your work computer has to relate to how important it is to your company to keep their network secure. I wouldn't want to be the one that accidentally installed the root kit that let attackers at all their customers credit cards, especially after the company made it clear that we weren't supposed to install anything.

Answer 6

I am a web application developer and I'm talking about a laptop owned by the company.

My current employer has locked down the machines of all developers so that we do not have access to the root or c: drive. For example, I cannot write a directory under C:. I also cannot install any software which touches the registry.

Are you able to do the work that your employer allocates to you?

If so, then you're out of luck and will just have to live with it.

If not, then you good grounds to complain.

In my experience, Developers generally do require a [very] high level of access to their machines just to do their jobs. This is largely down to the toolsets that they have to use and the environment in which they work, e.g. it's very hard to set up a new web site in IIS without elevated levels of permission and, if that's what they're paying you to do, then you should be allowed to do it.

Answer 7

In my opinion, you are focusing on the wrong thing here. Instead of asking for access to write to the C: drive or install software, you should be talking about what it is you need to do your job. The reason that these are locked down is that if you were to download a malicious piece of software or have a vulnerability in your machine that an attacker were to exploit, these are main rights that the attacker will use to solidify their access and expand it. Not to mention that insider threats are the biggest risk for many companies. Who says you can be trusted?

Figure out why specifically this is an issue i.e. what exactly can't you do that is causing you issues. And it's not "write to the C: drive". Why exactly do you need to write to the C: drive? Once you have enumerated the issues, take that list to your boss or the person in charge of security and ask for help in how to resolve these problems while maintaining security.