13
  • Is being Paranoid considered an (unspoken) 'requirement' for a Sys/Net admin to have (obviously for security reasons)?

  • Is there such a thing as being overly paranoid?, or should we be trustful of others and not completely dwell on questioning scenarios through schizophrenic goggles?

    Is there a 'mid-ground' for this characteristic when it comes to security? (basically, what I'm asking is, who would YOU hire?)

UPDATE: I didn't expect people emphasizing so much on the word "PARANOIA". Please don't dwell too much on it, I could have used another word, but Paranoia is a word we commonly use with security. I've heard "too paranoid" and "need to be more paranoid" from a bunch of IT folk.

alt text

6
  • 8
    I'm not at liberty to answer that question...
    – msanford
    Jun 23, 2009 at 22:44
  • 2
    I am not paranoid! They are REALLY out to get me!!
    – Zoredache
    Jun 24, 2009 at 1:31
  • 2
    Just because they really are out to get you doesn't mean you aren't paranoid.
    – chaos
    Jun 24, 2009 at 4:50
  • 2
    No, he's quite astute... we really are out to get him...
    – RascalKing
    Jun 28, 2009 at 8:21
  • 1
    you don't need to be paranoid, but it helps Sep 30, 2010 at 23:11

23 Answers 23

13

Paranoia is a dysfunctional personality trait where an individual is suspicious or untrusting without reason. Acting without reason is the antithesis of a good SA.

A system administrator needs to deeply understand the systems they support and be able to quickly analyze problems against business requirements, assess risks, and prescribe action to mitigate problems/risks/etc. An SA also needs to understand the systems enough to quickly develop theories to guide the problem troubleshooting process, but also needs to make decisions based upon facts gathered.

Sometimes those duties makes one appear paranoid on the surface.

4
  • 5
    Paranoia is a thought process characterized by excessive anxiety or fear, often to the point of irrationality and delusion. I agree with you 100% and gave you the vote. Paranoia is not a skill but a problem that needs to be treated. Thanks duffbeer703.
    – Geo
    Jun 23, 2009 at 21:34
  • Re-worded the question, thanks!... Didn't think of paranoia as the disorder at first, but more like a commonly used noun for net/sys admins.
    – l0c0b0x
    Jun 23, 2009 at 21:58
  • @l0c0b0x - I think that one of the reasons why paranoia struck a cord with many people is that is how they perceive the infosec people that they run into. Often that perception is correct, as "security" is often based on theatrical value and is often "faith-based". Jun 24, 2009 at 11:53
  • -1 Who defines paranoia as dysfunctional (Wikipedia, MW, Oxford)? DSM defines pervasive paranoia as dysfunctional (Paranoid Personality Disorder), but paranoia itself is considered part of being human. Everything in moderation.
    – bias
    Aug 6, 2009 at 4:48
11

You're only paranoid until it HAPPENS... after that you were just "well prepared". ;-)

1
  • Exactly ... having "excessive fear" is a relative term.
    – bias
    Aug 6, 2009 at 4:41
8

Critical thinking is a required quality for a good SA. Obviously the clinical definition of paranoia is not what the OP was asking, but even the common definition is not "required".

To the unskilled eye, there may be little difference between a paranoid SA and one who thinks critically about issues like security.

Example: I block outbound SSH because I understand what you can do with SSH tunneling. I know of SAs who block it because "it's a security risk", without knowing what the specifics of that risk are. Am I a better SA for understanding the risk? Perhaps, but at the end of the day both of us took the same action.

Part of the art of being a SA is to know when something that you've been told requires more investigation before you act and when the information is trustworthy enough to act upon immediately.

1
  • Cargo cult security definitely plays a part. Sort of like renaming the Administrator account on a Windows machine. It doesn't DO much, but it sounds good. Jun 25, 2009 at 2:44
6

I believe that pragmatic paranoia is a healthy trait in a sysadmin. Thinking about bad things that might happen and how to avoid them can be extremely useful-- thinking about security and other potential problems makes a system more robust.

The trick is being able to assign weights and probabilities to possible outcomes. You have to be able to estimate the probability of a problem, the severity of the outcome if it occurs, and the cost of avoiding it, and then make pragmatic decisions based on those incomes. Being reasonably paranoid about the company's core data is smart. Being unreasonably paranoid about someone getting to the company's list of corporate holidays seems unhealthy.

4

You have to balance security with usability.

If you run a bank's network infrastructure, you need more security, but you can also afford to have more security, since it costs money to train users, to purchase and install new technology, and so forth. If you're running a university student network, you can easily afford, say, not to hand out RSA SecurID (time tokens) to students to log in. It's just not necessary.

Yes, I use full-disk encryption on all my (work, non-server) machines with available data destruction features enabled, even on my iPod. Why? I have a sensitive contact list, emails, trade secrets and material covered by non-disclosure agreements on some of these machines.

However, when I was an undergraduate student with nothing but my (not-for-publication) papers to preserve, I would never have gone to such lengths. However, in grad school, with possible novel/patentable or for-publication papers, you might want to take a slightly more secure approach.

Soapbox: I also know a few people who use big tools like 256-bit full-disk encryption, and then use a backup mechanism that stores their data in the clear, or worse, on some random untrusted remote server. The whole chain is important!

3

It does require the ability to think in terms of what can go wrong instead of what you want to go right. This style of thinking often seems paranoid to those who don't need to engage in it. Occupational hazard.

If your systems administration practices are actually predicated on the idea that people are actively conspiring to harm you personally, though, you may be too paranoid. :)

3

Yes.

I think what you were actually getting at is whether a person's brain defaults to trust mode or distrust? A sysadmin fights a concentrated, neverending stream of confidence scam artists. From the site trying to serve out malware to your users to the patter of bots and script kiddies on your firewall, it's all about keeping entities from convincing your systems and users that they're trustworthy.

We do not install the default, we hit the "custom" button. We do not give access and then narrow down the "known bad" ports, we shut it all down and then open up what's necessary until it works. We do not click 'Yes' unless there's a compelling reason to do so. We opt out.

There are a lot of fields where you have to assume the worst. Law and medical professionals can't take what people say at face value, either.

Our polar opposite is the dear trusting user who sees a box pop up with dire warnings and assumes that the box is intended to help them.

And when one wonders whether it's required - how many other business functions get to deny prime access to the owners/VPs of the company? It would be entirely reasonable for our owner to have the keys to every door and file cabinet in this building, but he can't have domain admin rights. To me, that defines appropriate 'paranoia'.

disclaimer: it's possible that there may be trusting types who are perfectly stellar admins, but those I've met who really stand out have all had a very healthy tendency in the opposite direction

2

In any organization of significant size, trust is unavoidably delegated away from the sysadmin for practical (and sometimes other) reasons. Such as giving the help-desk the ability to handle password resets and account lock-outs, or allowing the identity-management automation to handle account enable/disable which requires delegating that ability to HR types. When bringing a new admin on-board it is a good thing to see how comfortable they are with your organization's level of delegation.

Over all, a sysadmin should have enough of a security mind-set to call a hard stop on something that sounds suspicious, even if it does come from a higher level manager. What we do is part of the information security apparatus of where we work, and that should be part of our job[1]. There is a level of trust that needs to be established between decision makers and implementers, otherwise things can descend into the hard-lock of paranoia.

Admins that don't trust worth beans probably shouldn't be in larger organizations where the technology is handled by multiple people.

[1] Unless it isn't. Some organizations have delegated InfoSec to a dedicated department, from which marching orders are issued to the relevant parties.

2

If you are considering security, then there is no such thing as too much paranoia.

Other than that, I try for "slightly paranoid realism" over pessimism (I'll be optimistic when there is reason to be so, pessimistic otherwise, and might give benefit-of-the-doubt on occasion and upgrade mild pessimism to neutrality or neutrality to mild optimism).

Though the old adage than a pessimist is never disappointed is usually not wrong.

2
  • I agree that you can never be truly too paranoid about security, as long as you and your organization understand that the nature of security is a trade off between security and convenience. I can completely physically secure a program or building, requiring 36 character passwords and triple id security practices, but it will all be tossed aside by the user with that password written next to his monitor, or by a propped door for the staff smoker. One has to achieve a balance between user convenience and good enough security.
    – RascalKing
    Jun 23, 2009 at 21:42
  • Aye, there is always a point where human engineering or plain old human error can invalidate all technical and procedural protections, especially if your procedures are overly arduous. Likewise there comes a point when adding more security would stop anyone ever getting any work done. But you at least need to be paranoid enough to consider all the options (then realistic enough to know where compromises need to be worked out). Jun 23, 2009 at 21:56
2

Paranoia, in terms of your question, is justified.

Over-paranoia can be a problem. Risk assessment needs to be a driving factor in security. You can't always just lock everything down for the sake of locking it down. You have to measure risk in terms of:

  • Confidentiality - how important is it to keep something secret?
  • Availability - how important is it for people to be able to work with something at any given time?

Confidentiality is the easy one. We have our information. It's ours, not yours. Keep your mits off of it and stay out of my network.

Availability is the often overlooked one and usually is the victim in the case of over-paranoia. If you put measures in place that are so restrictive and prohibitive that your own people can't even do things with their data then that can be just as bad as loosing the data, resulting in wasted time, resources, production, etc.

There has to be a mid-ground for paranoia, as much of an oxy-moron as it sounds. You can't have over-paranoia and get business done. Over-paranoia belongs in theoretics and academia where proof-of-concepts can be developed and presented. Healthy paranoia takes these concepts and filters them through tailored risk-assessments in order to provide a workable solution.

2

What you are calling paranoia is probably related to what Bruce Schneier calls The Security Mindset. Quoting from his blog post:

Security requires a particular mindset. Security professionals -- at least the good ones -- see the world differently. They can't walk into a store without noticing how they might shoplift. They can't use a computer without wondering about the security vulnerabilities. They can't vote without trying to figure out how to vote twice. They just can't help it.

1
  • In other words, the best security mindset by that point of view, is the one that isn't gonna help you at all, seeing that he might be giving too much away by helping you :-)
    – Rook
    Jun 24, 2009 at 23:23
1

Personally it depends what your paranoid about, as a DBA my concerns are about data loss, downtime and data quality. So I find being paranoid about what could go wrong and putting contingency plans in place simply means I spend less time in firefighting major problems.

But as 3dinfluence say's it is a matter of finding the right balance between the risks, the expected losses and the resources to protect against any perceived or actual threat.

1

I am not exactly sure paranoia is the right word. We are all, to various degrees, knowledgeable about the bad things that can and do happen to our precious networks. Everything from pernicious script kiddies to well meaning users exist out there to cause havoc and unrest, thereby making our jobs tougher and causing the boss to look into that outsourcing firm that he has been hearing so much about (speaking of paranoid... :-)

I have found in my various careers that trust only goes so far as it has been abused (eg, the junior sysadmin who gives the admin password to the exchange servers to the manager who "just wants to have a look around"). People who have had their trust abused before are far less likely to give it again. Apply that to organizations, and you can see the first time someone takes down the network with a poorly timed gaffe causes reams of regulation to fall from above, not unlike the rain that falls from the pacific northwest skies (English major turned Tech here).

Basically, to put a long statement about psychology, technology and management in a short phrase: What most confuse for paranoia is a strong sense of caution fortified by the knowledge of what can (and most likely HAS) go wrong.

1

If you use this definition:

paranoia: a psychological disorder characterized by delusions of persecution or grandeur

..then no, paranoia isn't what you want in a sysadmin.

What you want, imho, is a sysadmin who understands a few things about security:

  • Systems and data have varying value to the continued welfare of the organization.
  • Understanding these relative values is the first part of the security equation. The higher the value, the more important it is to be aware of the risks to the system and/or data.
  • Remediating risks usually involves a tradeoff. A computer encased in cement is so 'secure' that no one can use it. So 'security by encasing in cement' is a great example of securing an asset so heavily that it loses all value to the organization.
  • The admin's own practices are part of this tradeoff equation. Simple example: the admin who keeps all important passwords in his head is a liability: what if his head explodes? How will the company continue profitable use of assets now that obliterated sysadmin = obliterated keys to kingdom.

"Paranoia", as defined, strikes me as an inability to properly maintain the risk/reward balance. I don't want to work with paranoid colleagues. I want to work with people who can communicate risks, balance against rewards, and formulate well-articulated plans and policies for achieving optimal balance between security and profitable use of assets.

3
  • I see you've updated the question. Hopefully this isn't too pedantic, but I respectfully submit that if you're equating security awareness with paranoia, then you're not in the right mindset. The way we think about things does influence the way we handle those things. Worse, if we're using phrases like 'not paranoid enough' with our customers, we're negatively influencing their thinking, too. About both us and the stuff we do.
    – quux
    Jun 23, 2009 at 22:19
  • It's only a bit pedantic ;) (wow, hadn't heard that word in a long time!), but it's really <b>my fault</b> for not taking the time to really think about my question, and how others might perceive it. Some of the answers here (about 60%) relate to what I was really asking about. How much is too much? (and not only as to how it affects others, but also how it could potentially drive you to insanity trying to think too much about security). Thanks for the comment though.
    – l0c0b0x
    Jun 24, 2009 at 4:33
  • How much is too much? In a nutshell, when the cost of security equals or exceeds the value of the secured asset, you can be positive you have too much security. Cost can be money, time, or both. Imagine I have a tool which saves a key worker 10 minutes of time every time he uses it. Now I go to secure it, requiring a 10 minute logon for each use (or requires 10 minutes of sysadmin work for each 10 minutes saved by normal employees). The tool is no longer profitable: doesn't save the company any time.
    – quux
    Jun 24, 2009 at 4:45
1

Theres certainly overly paranoid people. Those are the ones that lock every single tiny bit down and hamper the productivity of everyone else in order for ultimate security.

But I certainly think the right amount of paranoia is beneficial.

1

It's not so much about being paranoid as being clear about who you trust, and how much you trust them.

Do I/we perform a full source code security audit on every patch to my linux systems? No, because I trust them, and also because what I'm protecting doesn't warrant that level of effort. Is it worth testing patches on a test system to find any hidden gotchas before updating the live servers? Yes, because there is a limit to how much I trust them (and myself to apply them properly the first time).

Do I/we have a firewall between us and the internet? Yes, because there are plenty of people out there I explicitly do not trust.

1

I think you have to be super aware of every possible security risk, from user passwords to social engineering to outside hacking attempts to whatever. You name it. Not only that, but you also have to be ready for the 'next big thing'...always be thinking ahead. This will make you different, but thats your job.

A police officer is more aware of whats going on around him than a customer service rep. You should be the same. Its your responsibility and when it all goes to hell then it happened on your watch.

1

No it's not, but we all wish it were.

Do remember that security is much about availability - that includes securing availability of whatever the user needs access to. It's not only about disallowing everything.

1

Anyone that administers security on networked computer systems nowadays needs to be just a little paranoid - if you're not, you haven't been paying attention. That said, it can easily be taken too far. You have to strike a balance between security and usability.

One other way to think about the topic: you're not only preventing malicious activity, you're preventing accidental activity. Accidents are much more likely than break-ins.

In the end, it comes down to one thing: you're in charge of protecting your employer's systems and data, and you need to do whatever it takes to accomplish that goal, regardless of what others may label it.

0

I'm not sure if paranoia is a required trait...but it probably helps. But I think what is important is for someone to be able to identify potential security related issues, vectors of attack/breach, etc.

There is a level of trust between the employee and employer but at the same time I'm a big fan of least privilege security model. So trust only goes so far. After all accidents do happen...users will accidentally delete or move whole directory trees if they have permissions to do so.

But a balance has to be struck between security and getting out of the way of people doing their job.

0

i am more paranoid about something failing that was promised by a manuf that would not fail. so i always have multiple offsite backups and i cross backup to other file servers for redundancy. example hot server fail overs. gd

0

par·a·noi·a (pr-noi) n. 1. A psychotic disorder characterized by delusions of persecution with or without grandeur, often strenuously defended with apparent logic and reason. 2. Extreme, irrational distrust of others.

Now if you are paranoid or have paranoia than you probably are not aware of everything that can be done to keep security tight.

My recommendation:

Patches! Patches! Patches! Patch everything from workstations to servers! Especially if they are web facing! Overflows are a common way to gain control of systems and all too commonly they only happen to the critical web-fronted servers. Enforce patches for all systems through GPO and better yet deploy an internal WSUS server that updates frequently and so you can keep track of those problematic PC's that don't report in for patching.

Backups! Backups! Backups! Always know your backups are being performed of all critical data that is strickly for the corporation. Backup also of your system-critical servers along with a redundant solution.

Antivirus! One (1) per machine and a managed solution to perform network wide-sweeps and report to a central server. Assists in host infections and problematic machines/users. Remember that antivirus is to keep the system clean of common 'infections' not intrusions and also ment to keep the PC running fast and smooth. Too many defeat a primary reason for deployment.

Anti-Adware! One (1) per machine and for windows workstations, Windows Defender works great. Being an MSI it can be rolled out via group policy and monitored through event logs! Keeps the computer also running fast.

Firewalls! I am talking REAL firewalls, not your OS based firewall for the PC or even a software based firewall for the edge of your network. People use appliances like Cisco Pix, or ASA. because its not dependant on an OS and does ingress and egress and can be monitored very wall through syslog. Other good solutions are Checkpoint & Juniper/Nokia for coporate solutions. The first step in actually KNOWING what is happening on the network.

Proxy! Have all your users forced through a proxy so you can block them outbound at the firewall! A great place to keep your users on check or at least be able to perform forensics when someone does something stupid you can identify who and what.

Last and not least... Intrusion Detection System or Intrusion Prevent System (IDS or IPS) These systems are much like anti-virus on hosts except they run on networks. All traffic should be duplicated so it can be monitored by port spans on switch or put them inline outside or inside your firewall. People doing the real damage will most often be seen by these systems whether its vulnerability testing/scanning on large network segments or if a real intrusion happens and someone is able to run a huge scan on the inside of your network, you can identify them and shut them down.

If all these can be deployed than let your paranoia fade away because you are doing one hell of a job.

0

They have this saying "being a paranoid doesn't mean no one chases you". And I agree with it. Be paranoid, but know there's more to it. Stay alert and try to enjoy your role.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .