Control through Active Directory can only help to control normal users. If you can set a control, it can be unset. I have the knowledge to circumvent many controls, and write scripts that get information from the system and have had to do it for clients.

Disabling physical ports and devices is only viable if the user doesn’t boot in safe mode. A thumb stick with an OS on it can be booted (sometimes) this way, Passwords for access to bios functions are a must.

I think the safest way for security is using Virtual machines. 90% more effective in controlling users trying to bypass security controls, as the local physical devices are not used in saving/printing.

Mobile devices are a bigger headache. They have to be controlled, but be flexible enough to allow comms from off site access points.

We run all common protection methods, e.g., AV, etc., and perform regular audits over automated monitoring. We authenticate and authorize according to job/position. We maintain a security policy and publicize it, along with notification of changes.

As a software vendor of network security, auditing and compliance products, we’re in a position where many employees can know more details about how to cause trouble than there are safeguards available. We’ve tended over the past decade to move towards a focus on relationships with employees and less on obstacles made of software or hardware mechanisms.

Fundamental safeguards will always be in place. This protects from mistakes made by the best of us. But clear authentication combined with authorizations that are capability- and object-based, for employees who have a solid relationship with their employer and who always have access to a good security policy, into systems with strong monitoring, all tend to make most issues disappear.

Certainly, there is a potential for serious malicious damage by insiders. OTOH, I’ve yet to see any other environment where that wasn’t true anyway.

Tom

as for printer, only some computers are allowed to print.

we don’t allow any vendors to connect their laptop to our networks.

we too dont allow OWA and there is no wireless device in our office.