Physical access, while not impossible, would first result in loss of life first, or at least someone pointing a gun at my head. All cables, etc are within two rooms, one of them is deadbolted with a door lock (where I am), the other is in another room, where 1 cable leads to the server room. Explain to me how an employee is supposed to hook up a hub in there without my knowledge. Lets get realistic here. Also, the employees are all on the outside, with the exception of ONE employee, who is on the inside, and who knows less about hacking than your average brain-dead script kiddie. There are no mirrored ports on the switch. Yes, the FTP server is inaccessable from the outside, all employees use sftp from outside connections. The win98 machine is not a security threat, as it is behind a firewall, and on top of that, with iptables rules, no server or workstation can communicate to the Win98 machine. Thus, the win98 machine could even be unpatched for all I care. My main concern was the FTP server. Again, employees are not the risk here, as I am the only person with physical access to the switch, and the other person here is a brain-dead moron when it comes to anything other than how to scedule dates on their palm pilot, and to take telephone calls.


However, to humor you, if someone can get into the lightly secured office without my knowledge, and set up a hub in there also, what the hell is to stop them from just taking a gun and shooting the lock (or for the more dramatic, blowing a hole in the wall)? And if, *IF* there were more users, and say perhaps a hub or two, you would be damn sure that I would be setting the 98 machine up on the same switch as the FTP server, located in the server room. I may be paranoid, but to think that an employee who has U.S. government level security clearance would risk their job, their liberty, and their asses to own a win98 machine, or to steal their password, or to even root one of the Linux servers, that is going a bit far. I would consider the risk if it was civilians with nothing to lose, and we didnt prosecute, but our employees know better, with the type of info that we deal with.


As for the insecure win98 machine, yet again, it has *NO* ports open, so how the hell is someone going to cause a buffer overflow on a machine with no open ports. TCP/IP attacks, maybe, but like I said, the only system that can communicate with the 98 box is the FTP server. Not even the proxy is allowed to communicate to the win98 machine, as they have no need for surfing the net and what-not.