Product SiteDocumentation Site

Chapter 2. End User Security Introduction

Mike Fedora Project McGrath

Fedora Infrastructure Lead
Fedora Project
2.1. End User Standards
2.2. Security Incidents
End user security is a critical aspect of a total security solution. All too often security breaches are the result of human error and as such everyone must take an active role to ensure their own security and the security of the organization. High levels of technical skill are not required to keep a secure environment. This chapter does not focus on computer settings or the like. It instead focuses on actions that should be taken by every individual in order to keep a secure working environment.

2.1. End User Standards

Users who have questions about any of the below items should contact their helpdesk or technical support team for answers. Do not ignore an item because of confusion about what it is.
Required Config Lines
CompleteRequirementActionComment
Must NotPassword DisseminationAny and all passwords must be kept secret, known only to the person who created it. Under no circumstances should a user give a password to anyone unless law enforcement requires it. Discuss with your lawyer in the event of a required legal dissemination. Passwords should not be given to management, technical professionals, or anyone else who asks for it.
MustPassword EntropyAll passwords must meet all of the following requirements. 1. Passwords must be at least 8 characters long. 2. Each password must have at least 1 numeric integer. 3) All passwords must have at least 1 lower case letter. 4) all passwords must have at least 1 upper case letter. 5) all passwords must have at least one non letter / non number character in them.
MustDekstop LockingAny time you physically leave your workstation or any other host that contains a user input or user output device (like keyboard, mouse and monitor for example), either lock the screen, shell, or log out completely.
Should NotPassword ReusePeople should not reuse passwords in environments where there is not a single sign on for everything. This is especially the case with password protected keys, encrypted shares, access to personal sites like retirement, bank, etc. This is not always avoidable but use different passwords where it is possible.
Should NotSoftware installationUsers should not install any software that is not approved. Contact your helpdesk for more information - To be filled out. Advanced or power users who are running programs or scripts that have not been installed by the helpdesk may be liable for any damage they do. When possible scripts or programs should not be run as your normal user if possible. Especially if this user account has access to sensitive passwords or keys.
Should NotSoftware installationUsers should not install any software that is not approved. Contact your helpdesk for more information - To be filled out. Advanced or power users who are running programs or scripts that have not been installed by the helpdesk may be liable for any damage they do. When possible scripts or programs should not be run as your normal user if possible. Especially if this user account has access to sensitive passwords or keys.
Must NotRelocate information offsiteInformation contained on file shares, in databases or on your workstation should be assumed to have a non-sharable license. As such it should not be transfered offsite without the express written concent of both the CIO (To be filled out) and the CSO (To be filled out). This includes printed copies or data in any form.
MustKey SecurityAny keys kept on any host must be readable only by the owner of that key.
MustEncryption BackupsUsers who use encryption keys must have those keys backed up to a location that can be taken offline. Ideally a usb key or other such device. This device must be kept in a secure location and only connected to a host while a backup is being made, or while a key from that device is being used. The filesystem this key backup exists on should be encrypted.