Slashdot Log In
The Enemy Within the Firewall
Posted by
ScuttleMonkey
on Mon Mar 13, 2006 04:32 PM
from the sowing-dissent-and-distrust-in-the-workplace dept.
from the sowing-dissent-and-distrust-in-the-workplace dept.
Mel Tom writes to tell us The Age is reporting that many businesses are now considering employees a much bigger threat to security than most external threats. From the article: "With email and instant messaging proving increasingly popular and devices such as laptop computers, mobile phones and USB storage devices more commonplace in the office, the opportunities for workplace crime are growing."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
One thing is sure (Score:5, Insightful)
Re:One thing is sure (Score:5, Insightful)
Parent
Make Sure You Own It! (Score:5, Insightful)
See the contradiction? Why should an employee care about something they don't own?
Given that the majority of companies wouldn't hesistate to act against the employees interest if there is any suggestion of compromosing the companies's interest, why should an employee protect a typical company's interest apart from doing the bare minimum required to preserve their own job?
Companies are just repaing the "benefits" of years of treating employees as "production units".
Yes I'm posting as an AC because I don't want any potential employers to know that I don't really care about their company apart from the fact it pays me money.
(I'm not advocating slacking off in life or being bitter and twisted. Just make sure the things you dedicate yourself to are either THINGS YOU OWN or a charitable cause that you think is worthy. Working for someone else's profit is what you do to make money so you can do do what really matters. Don't dedicate your life to making profit for someone else.)
Parent
Re:Make Sure You Own It! (Score:4, Insightful)
See the contradiction? Why should an employee care about something they don't own?
Because of a phenomenon known in scientific circles as the paycheck.
Parent
Re:Make Sure You Own It! (Score:5, Insightful)
See the contradiction? Why should an employee care about something they don't own?
>>>Because of a phenomenon known in scientific circles as the paycheck.
There is a fundamental point overlooked here. I assume you're just being flippant but, the original poster didn't say he planned on destroying or stealing, only that he didn't care. The man in the apartment downstairs from me has a nice car, and I respect the car by not doing anything untoward to it but, I don't care about the car. The paycheck will make us work on things we wouldn't otherwise work on. It won't make us care.
Now if pride of work can be achieved then, I'll care.
Parent
Re:Make Sure You Own It! (Score:4, Insightful)
Most businesses that have only one customer are doomed. To be accurate this analogy would require that the employee be allowed to work for multiple employers and be allowed to balance the interests of those employers. Most employers would not not happy with this and would probably accuse the employee of not having the company's interests at heart and sack them.
Despite the talk, a business DOESN'T have its customers' interests at heart. The main interest of a business is making money. It is interested in the customers interests only as far as those interests make the business money. (Try proposing to IBM that they give you a million dollars because you are a customer and it is in your interest.)
*If* an employee treats themselves as a business they should only be furthering their employer's interests to the extent that they align with their own and make themselves money.
Parent
Re:One thing is sure (Score:5, Interesting)
True, but taking my fingerprints and putting them on file at the FBI within the first hour of a new job is criminal treatment. After all the SEC, FBI, and other background checks you still get put on file at the FBI when taking a job at most brokerage firms (at least here in NYC).
It's beyond technical. At many companies you're treated as if they need to always look over your shoulder. Those cameras aren't there for your benefit. They're there to catch you if you do anything wrong.
Parent
Re:One thing is sure (Score:5, Insightful)
Parent
Re:One thing is sure (Score:5, Interesting)
At my last 3 jobs (Over 4 years), it was required to take these things. Along with the occasional piss-in-the-cup drug test. At many workplaces, companies are running background checks on existing employees. The tests are a "requirement of your continued employment here at the company".
Does this make people feel like a criminal?
Parent
Re:One thing is sure (Score:5, Funny)
Parent
Re:One thing is sure (Score:4, Insightful)
Perhaps because you have "ownership" of the production database and will catch living hell if you break it.
But, if you accidentally hose your desktop, there is no real recourse against you? It only ends up costing the IT group time and money to fix your problem. (maybe not you personally, but "users" in general may have set the pattern...)
Parent
Re:One thing is sure (Score:5, Insightful)
While I can certainly understand why you say that, the article's headline 'the enemy within the firewall' was a bit of a troll.
More like 'the hapless idiot within the firewall' because the article is more about external attacker using employees's as a vector rather then the employees themselves being the attacker.
And really - when I say 'the hapless idiot' I'm being far too harsh - after all, it only takes inserting a music CD to potentially install a rootkit on a company's (windows) PC.
Parent
Re:One thing is sure (Score:5, Insightful)
You're right that I was responding to the tone of the article and headline.
I've worked for companies that think of employees as liabilities they reluctantly put up with because there isn't another option. It comes through loud and clear in their policies. Security measures that add no security but are humiliating, stark double standards for management and staff, headlines about corporate malfeasance and record-breaking bonuses, etc.
I think treating employees like family is a better approach. Give them some trust, but have policies in place. My mother, for example, has a computer with very strict security policies that she can't change. That is appropriate, and she has thanked me for it. Same approach will work for employees.
Parent
Insiders ARE threats! (remember iBill last week?) (Score:5, Insightful)
Insiders can be real threats, the BIGGEST threats. An insider can steal much more than a hacker ever can. And many insiders think they can get away with it. Just look at the porn-billing iBill incident made public last week.
The best policy is to log everything that happens in an enterprise, to a level required to reconstruct past bad behavior. You can't keep your insiders away from information they need to do their jobs. Trust, but also verify! There are products out there like Sensage (http://www.sensage.com/ [sensage.com] ) that can collect, centralize, and make available years of log data for an IT organization. While this might not prevent the theft in the first place, a company can crack down on and prosecute current/former misbehaving insiders. Sensage will do very well, as will many other companies in this space (including recent Slashdot heavy banner-advertiser Splunk (http://www.splunk.com/ [splunk.com] ) ).
I look forward to seeing how well these products do. It's time one of them went public so we can gauge interest.
Parent
And this is new? (Score:5, Insightful)
Re:And this is new? (Score:5, Interesting)
You don't have to treat your employees like criminals in order to reduce the threat that an insider may pose. You just have to take rational approaches to tighten access.
Parent
It's in the Hacker's Handbook (Score:4, Insightful)
And that's the crux of it. If you have discretionary access controls (or no meaningful access controls at all) then you're as trusting as the person who leaves a spare key under the doormat. Under a totally trusting environment, that actually works very well and can improve efficiency. Where trust is unrealistic or inappropriate, you need better defenses.
I believe it has passed the point where most businesses should be using B1-comparable systems for as much as possible, and should use secure networking where practical.
IPSec for all traffic would be good. All web traffic over SSL would be excellent, Kerberos is good. SSH is good. Telnet is bad. Rsh/Rlogin is evil. Both easy-to-guess and impossible to remember passwords are diabolical. Wireless without 802.1x security or better is satanic. Unpatched computers that "don't matter" (and so never supervised or monitored) are so far beyond the deepest pits of Hades that they should be burned at the stake and their transistors scattered to the four corners of the world.
Parent
This Has Been Why... (Score:5, Informative)
Forbidden IM (Score:4, Insightful)
Parent
Re:Forbidden IM (Score:3, Insightful)
Re:Forbidden IM (Score:3, Insightful)
Until they lock down down which systems you can hit at port 443. Are you gonna start port-hopping? Then they get really draconic and employ a total "deny unless permitted" outbound ruleset.
Yeah, it can be limiting. In a way, an organization which does this gets what it deserves: workers buckled into the traces with blinders around their eyes, plodding away. Kinda like a team of draft horses pulling a big ol'
Re:This Has Been Why... (Score:5, Interesting)
That's a bit naive. Most of our employees are devious little buggers. As soon as no-one is looking they're sending amusing flash/avi/mpeg between themselves, forwarding jokes someone outside sent to their gmail account (and they've cut-n-pasted them into work mail), etc.
What it really comes down to is establishing a policy and what sanction will be forthcoming on violations. I knew one company that had zero tolerance. A couple sackings and everyone left was quite clear on proper behaviour.
Parent
Re:This Has Been Why... (Score:4, Insightful)
I've seen companies that have syadmins spend who their time monitoring employees and sacking the ones who use gmail from work, post to Slashdot, or other non-authorized activities under the guise efficiency and security. But it is really an excuse: it was cheaper to hire several semi-technical wannabes to monitor employee activities than to pay one good sysadmin to properly secure the network.
Most of the employees only have a computer on their desk to send email and use Microsoft Office. Those people don't need to be administrative users.
Parent
Re:This Has Been Why... (Score:4, Interesting)
They had separate computers set up in the lounge area for IM, web email, games, etc. They were outside the network, and the rules on using them were very lax. We could do whatever we wanted on them, but IT wouldn't come running all that quickly if they were broken. Basically, it was like having a foosball table, but far more practical.
The flipside of this policy was that all the other machines were for pure work-related usage...period. Company email was for company business...period. As wierd as it sounds, the employees really liked this setup.
It's the 21st century...employees have an expectation of being reachable by family and friends when they are on the job, even if it's not a life-threatening emergency. Companies that institute an outright ban on this behavior are living in the past. Companies that let a single computer be used for both personal and professional business are asking for a world of pain.
Parent
Duh! (Score:3, Funny)
Then the ONLY real solution is... (Score:5, Funny)
Seriously, how can anyone get any work done with all this security risks running around?
Not much new here (Score:5, Insightful)
Re:Not much new here (Score:4, Insightful)
Parent
Here's Some News (Score:5, Funny)
Gee someone ought to come up with a name for this... let's see, we can call it "Social Engineering". Hopefully no bad guys will read about this and start using it now....
The enemy within the gates (Score:4, Insightful)
crime opportunities (Score:5, Interesting)
The article mentions scarce spending on addressing internal security threats: im looking around my office, and there is just nothing you can do! Even if you completely lock down desktops (the latest image was set up as to disable all HW and SW installs), and I personally had an admin pw within days!), there is still email. And loaner laptops.
I hear that this type of complete personal information fetches $10 per record amongst certain unscrupulous Brooklyn programmers.
Come think of it... where DID i put all my floppies?
From the well-duh-department... (Score:4, Funny)
Employees often suck. In retail, they rip you off more than your "customers". (I can't call a shoplifter a customer
Kevin Mitnick was able to get employees to give him tons of "sensitive" information just by asking for it. They take their laptops home and surf porn and get 0wn3d and bring the trojans and malware inside the firewall. Hell, they can even VPN the crud in from home or Starbucks too.
I suggest 1) firing all employees you can 2) treat the remaining ones to a paycut 3) installing spy mechanisms inside of their office, computer, and bathrooms to "keep them honest", and let go of the ones that don't make the cut.
We don't need no stinking happy employee. We need one that does what they are told, and is already happy to do what they are told. Thats it.
Internal security is a double-edged sword. (Score:5, Interesting)
opportunities for workplace crime are growing? (Score:3, Informative)
This may be more because of incompetent netadmins than vile employees. Maybe more so because of lax security. Tighten up the computers, the type of traffic that can travel, the ports, the installed apps, passwords etc and an employee on a mission cant break in except into her own account. Security in a workplace lan is more than just put an MS Windows 2000 Server Firewall, its segregated security groupings per department and employee.
Security is good. Give it a shot.
Re:opportunities for workplace crime are growing? (Score:5, Insightful)
If an employee wants to screw up his employer, there are 1001 ways to do that-- with or without involving IT staff or systems.
There is nothing new here except that more and more companies are treating their employees as disposable temps that can be dropped simply to increase share price. It is not surprising that in today's enviroments employees are more likely to feel they need revenge.
Security lapses happen for a reason. Instead of attempting the sisphian task of "locking down" all systems, perhaps companies should address the root causes that incentivise their employees to behave badly.
Parent
Who is the enemy? (Score:5, Insightful)
Employees are no longer being thought of as possible risks, but confirmed dangers that must be actively confronted every step of the way. Proactive security measures enacted in a passive way that does not interfere with day to day work in an unreasonable fashion, or impact the work environment in a disproportionate manner are giving way to managers that are far more focused on what their employees are deliberately doing wrong, than on the actual work at hand.
By creating this atmosphere of hostility and distrust which cannot be overcome by proving oneself through hard work and carrying out duties in a thoughtful, honest way, managers are encouraging high-turnover, poor communication between workers, poor attitudes towards work and customers, and an atmosphere of little or no respect for the organization which anyone can tell you is the first step towards encouraging workplace crime.
Re:Who is the enemy? (Score:5, Insightful)
The problem is that this is absolutely true in western society. Everyone is waiting to take everyone for all they're worth. Witness patent battles, intellectual property and copyright battles, lawsuits, hostile takeovers, noncompete agreements and violations of noncompete agreements, "new enterpreneurship" in which you work to gain expertise, then leave the company and start your own doing the same things, corporate cutbacks in benefits and resorting to temp workers and outsourcing... From my view, virtually every practice in the free market, even those that are applauded, are of marginal ethics and morality at best. The basic premise of taking as much wealth as possible from others because you are clever enough to win it at their expense makes the entire pile of rubbish stink.
Everyone is in this for his or herself, and the offensively rich can routinely be heard to say to the poor labor force: "You should have seized the opportunity like I did," or "it's not my fault if you don't know how to build wealth."
Everything is fair game--it's only illegal if someone richer than you or less clever than you is able to stop you from getting away with it. So companies should be paranoid, because all of their employees would steal everything not nailed down if they could get ahold of it, and employees should be paranoid, because companies would press employees bodies and minds into perpetual, dehumanizing forced labor if they could.
Parent
Re:Who is the enemy? (Score:4, Informative)
Free markets are not zero-sum. Wealth can be created, not just "taken", and capitalism encourages that better than the alternatives.
Parent
Greed doesn't win (Score:5, Informative)
Parent
Re:Who is the enemy? (Score:5, Insightful)
Bank employees (at least the ones I know and talk to) definitely do not feel that they are treated like criminals, but most of them are not allowed into the vault at any time they like for any reason they would like. Similarly I would consider it a reasonable policy to specify IT polices to limit access to databases that contained confidential data.
Access policies are just one example of a reasonable IT policy for protecting corporate data and infrastructure. Really most acceptable use policies are also reasonable when you get down to it as well.
As recent as the 2005 CSI/FBI Computer Crime and Security Survey roughly 50% of all network intrusion/unauthorized use was from inside jobs. This can have a substantial material impact on a company, it is only reasonable that they take steps to minimize this as well. Reasonable policies to protect corporate assets are not the same as treating you like a criminal, hence the word reasonable. From reading the article I do not see anyone saying that extreme steps should be taken either, just that this is an area that should not be ignored and deserves some thought.
Really the argument that IT policies intended to limit access or specify accepted use for equipment is tantamount to treating you like a criminal is just an overreaction by technologically sophisticated people that resent the idea of being told that they can't do anything they want.
Parent
All employees or just executives? (Score:5, Insightful)
Always has been, always will be a problem (Score:4, Insightful)
Careful screening during hiring, sufficient training and re-training during employment, as well as attentiveness are the keys to mitigating these problems. Restricting e-mail, firewalls, etc., are simply putting fingers in the dike.
Is security the answer? (Score:5, Insightful)
The only effect of security is going to be that the few loyal employees you have get pissed and turn against you too. And for anyone who has done only a little bit of hacking, we all know useful security is way too expensive... You'd need to audit virtually everything that's going on on a server and there are only a few government agencies that can efford that much money.
So why not do something more useful with the money? Free coke for employees on tuesdays. Or fix that darn pothole at the entrance of the parking lot. Put a few plants up in the office... That is all money better spent than on some lack luster, process bound security measures...
Peter.
Re:Is security the answer? (Score:4, Funny)
Parent
Re:Is security the answer? (Score:4, Informative)
There are all sorts of other examples that could apply to anyone; for example, an employee who feels bored or unchallenged at work, or is otherwise just lazy, might spend too much time engaging in compromising activities (whether they be playing games or using P2P networks). And some people just don't know any better than to disclose information they shouldn't -- I personally have worked for a company that hired a private detective to try and get a job at a rival company and pick up information from other employees while he was there.
The point is that you can't entirely point the finger at management. Yes, it's in management's best interest to create an engaging and enjoyable work environment for everyone, but the most they can really do is try. Whether or not they succeed, that's still no reason to skimp on internal security measures.
Parent
Biotech (Score:4, Interesting)
I work in the biotech biz. We've been warned about Chinese "students" snafing our secrets. Thought it was a lot of tinfoil hat paranoia until we saw logs of HUGE attachments going to Asian hotmail addresses. Guess what some of those attachements were? Research data going straight back to China.
Needless to say, his worker agreements were terminated and the person shipped back.
Who do you trust then? (Score:5, Insightful)
There will always be a level of trust needed between employers and employees since even if the president of a company can set up the security for a company they would still have to trust someone to enforce it, and that person would have the ability to abuse.
IT 101 (Score:5, Funny)
Cough.. Ahem.. & what about we honest employee (Score:5, Insightful)
Fortunately, my job does stimulate me (it's not perfect but it's more good than bad) & allows me to live comfortably within the law. I'm treated pretty well, fairly autonomous in what I do & I have no interest in screwing over my employer - I don't care what money I was offered for "trade secrets", I wouldn't do it; my integrity is far more important to me.
The point I'm trying to make is that in my experience, most people are like me rather than potential criminals - it's just a shame that anyone who works for an American company at the moment (like me) constantly has Sarbanes Oxley rammed down their throats & endless training about "work ethics" purely because a few corrupt CEOs in other companies have decided not to work ethically.
At the end of it all, it is *just* a job and most people are inventive enough to find other sources of legal income if they choose to resign and walk out the door. If I chose to walk out the door, my employer can take their laptop back & any backups of my data - I'm just not interested in keeping it/
Sure, there are internal security threats in any organisation but mostly it's due to employee stupidity rather than criminal activities - and in my view, no company spends enough on training employees to be less stupid; it's far easier to close down a few more ports on the firewall and put a few more banned sites in the web proxies than educate people about the dangers of webmail.
And I am *STILL TRULY AMAZED* at the number of Windows users around me who do NOT change that STUPID default setting of "Hide extensions of known file types" - the BIGGEST security threat of all... believe me, turn that setting off and tell people not to open .BAT, .EXE and Office documents from sources they do not 100% trust & your security problems will dramatically reduce overnight.
A nation of fear and paranoia (Score:4, Insightful)
Whatever happened to rugged individualism, proud freedom, and respect for individual dignity without need for spying on employees, and fretting about "intellectual property" and "national security." How diminished we have become, how pathetic, how cowering.
Fight back damn it, join unions to protect your rights at work, protest, make yourself heard before the candle of freedom is extinquished entirely.