I saw the most horrific article in the WSJ today about how to defeat IT security “Ten Things Your IT Department Wont Tell You”. This is so wrong and so insecure I almost wrote the paper, but I dont care to argue with the columnist, instead I will just blog my unforgiving with them.
I wrote a response with 10 things a IT guy will tell you about why this is a Joke. note that I am 1:1 listing my items with the article so i say read that first to see my response. In the initial set-up for the story, Vauhini Vara talks about the specific reasons that IT staff block content or restrictions, she then implies in a national newspaper “not so fast…” basically this article is giving horrible ways for people to hack organization they work for. In fact she states that specifically for “hacking advice” not hacking as in modify hardware to make NES ROMS work, but hack as in bypass policy and procedure to undermine IT. unbelievable.
1. Send Giant Files
This is crazy dumb, the next time you want to transfer large files to customers of your company, ask your IT department for a FTP or file portal. anything else is defiance of policy and illegal transfer of data. For IT staff to prevent this just block all major sites and use content filtering such as Secure Computing Web-Washer / Sidewinder Firewalls, or Cisco Security Agent. To rip on Vauhini she states that you can look for a “secure padlock” haha yea i think that will solve all the worlds problems.
2. How to use software that is banned
Good old local admin rights or no local admin rights, if your company restricts local admin rights the software you run isnt going to mess anything up. To prevent this for IT just GPO disable the USB storage device. as for using web based applications – if it will go thru a content filter I dont care much if you use it. Anyone ever hear of Cisco Security Agent?
3. How to visit porn sites at work
if you cant figure out how to use google image cache to your advantage then your skills arnt 1337. If your a shop with a good firewall and HTTP proxy then this issue isnt valid.
4. How to clear your tracks on your work laptop
again this is a waste of a point to make a list of ten, this will not forensically remove data for the sites you have visited. dont forget that if someone is in question, they are loging your traffic off your box anyway. IT admins its called mirror port and wireshark, or a webproxy.
5. search work for documents from home
this here is a dangerous and insane idea, this is where I got mad with the paper for publishing this. All you just did Vauhini is make me decide to block google applications on the whole to prevent morons from running google desktop at work, if you need further information on this google “google desktop security threats” to stop this Cisco CSA
6. how to store work files online
this is just like #5 if your company has no corporate policy to banish users like this, make one and banish away. see my hacks on google calendar to see the fun that happens when people publish corporate data.
7. keep privacy while using web email
yes, the tips here are true, so if i have reason to suspect or policy to stop i just block the use of any chat or personal email. good job Vauhini looks like your disabling not enabling anything here. (i explain that last sentence in my closing remarks)
8. how to steal email for your blackberry
email is corporate property, if your against policy this tip wont land you anything but a monster.com account. see comments on tip 7
9. access personal email on blackberry
there is little risk here, so unless a company just isnt a fan of corporate use for personal gain – not having personal email on a corporate asset is the least of your concerns and this tip is basically null. except for the use of copy paste to release information. so BES can disable that function 
and BES has the ability to block all this. Also your corporate firewall if implemented correctly can block access to sites on a BB
10 how to look like your working
Vara looked like she was working when she alt tabed away from myspace long enough to write this column.
In the end, this list isnt anything bad, its just bad for employees that start to think they are smart by using them. If your company isn't blocking them today by technology or policy. Then your “smart” use of them will start to gain attention and they will be blocked. The tools that i linked to here will 100% block any crazy activity that the WSJ can come up with and misinform and ruin peoples day.
normally companies have guest wireless access, my recommendation bring in your own laptop and use that to do crap. Then your using a secure network for such activity and its not a company asset that your being a idiot with.
</rant>