Introduction
Symantec Deployment Solution is dependent on the use of pre-boot operating systems in the management of workstation and server systems. The pre-boot environment is delivered to target workstation and server systems via network PXE servers or through the use of physical devices and media. This process has the potential for exposure to possible malicious activity from a person who may have already breached network security, either physically or through a remote network connection, or from a malicious but authorized network user. This paper will address these types of secondary security exposures.
The Pre-Boot Automation Process
When using Symantec Deployment Solutions to manage network computers, the targeted delivery of pre-boot operating systems is required to perform many tasks. When initiated from the Deployment Server console, DS administrators can boot a computer into a pre-boot environment for the purpose of remotely creating or deploying hard drive images, installing or removing software or updating computer settings. As a target computer is booted through a pre-boot environment (usually either Windows PE or Linux) network drive(s) can be mapped to provide access for necessary files.
Possible Security Concerns
This pre-boot process can also be initiated by a user from a workstation or server computer, allowing the computer to automatically boot and map any network drives that have been pre-set by Deployment Server administrators. The computer user will then have access to information on the mapped network drives including disk images. One possible security concern would allow a person to then upload their own arbitrary images or files to be distributed during normal Deployment Server operations.
Minimizing Security Concerns
The primary barrier for any security concern is always initial access to the network and network systems. The following recommendations should be followed to minimize the use of the Deployment Solution pre-boot automation in further potential network intrusion should initial security measures fail.
Conclusion
Potential security concerns when using Ghost Solution Suite 3.3 and Deployment Solution 8.x pre-boot processes, can be reasonably mitigated with careful consideration of network configurations and user access controls.