[general_re]

For the truly paranoid, and/or those who have a fetish for truly fascist security schemes, the NSA published a series of guides about locking down Windows 2000 a few years ago. Although it's good to look through for tips about stuff that might have been missed, I recall leafing through it and thinking that only the truly masochistic would feel compelled to implement it all ;)

[general_re]

Truly, I could have said "truly" once or twice more. F*** it - it's late... ;)

[Ramius]

I did go through that. Funny you should mention it, and you're right. Only people that have a dungeon in the basement could endure it.

With *any* system, there is a trade-off between security and usability. Perfect security is impossible. Excellent security is possible, but most users will only put up with it for a little while before they go screaming to the board of directors wanting someone's head on a plate.

Good security is what we settle for in the real world.

Like I told my board of directors once: Look, you can spend however many millions of dollars on system security that you want, but you're protecting that server room with a twenty dollar lock.

[Alas Babylon!]

That's true, General. Good security is a fine balance between the users and and the system. If it's too hard, you'll spend all your time resetting passwords, and the users will wind up writing down the passwords, etc. Too lax, and anyone can get through it in a minute or so.

That's why I use the analogy of locking your car so it won't be stolen. Bottom line, a few simple steps can keep that from happening in most situations. A determined car thief, who really wants your car, can probably steal it despite any measures you take save sleeping in it with a shotgun. Same goes for network security.