Employees Are The Biggest Security Threat 332
blankmange writes "BBC News is reporting that the employees of a company pose the biggest threat to security. "Digital cameras, MP3 players and handheld computers could be the tools that disgruntled UK employees use to sabotage computer systems or steal vital data, warn security experts. The removable memory cards inside the devices could be used to bring in software that looks for vulnerabilities on a company's internal network. The innocent-looking devices could also be used to smuggle out confidential or sensitive information." Unfortunately, this is not news, but it is amazing how slowly the general public, corporations included, comes around on issues like these. "
or.. (Score:3, Insightful)
Re:or.. (Score:4, Funny)
These items and memory sticks, digital camers & mp3 players can be hidden in people's clothing, and therefore, the real solution is to disallow all clothing on the premises of the business. People could also hide such items up their butt, so you'll need to check there too before allowing employees admittance. (Well, maybe not the CD...)
Re:or.. (Score:2)
Anyways... Internal vulnerability to attack is nothing new, its always been considered the most likely source of an attempt on an organization's security. However, recent reports from law enforcement show that the rising threat of external attack is starting to become more serious than in previous years.
Of course, internal vulnerability to fraud and data theft are still very important (USB keychain datastorage, keystroke monitors, and cd burners in workstations pose significant risks).
2002 CSI/FBI Computer Crime and Security Survey [gocsi.com]
Hackers: a Canadian police perspective Part I [rcmp-grc.gc.ca]
Re:or.. (Score:3, Funny)
the real solution is to disallow all clothing on the premises of the business
I hope to god that you're planning on making attendance at the gym mandatory.
Re:or.. (Score:2)
And this is news? (Score:3, Funny)
Plus when someone is about to be fired they try to e-mail 500 megs of files to thier 10 meg home account. E-mail Bounce of Death anyone?
Re:And this is news? (Score:5, Funny)
Naturally the home account filled up pretty quickly at which point the remote and local servers began a game of ping pong betwen "Out of office" and "Mailbox is full" emails. Since we are an ISP and his 10MB account was on another large ISP this game of ping pong was going faster than a world champion on speed. As a side effect it also resulted in a DoS on the two mail servers as log files and message logs grew out of all proportion...
So it just goes to show; employees can cause grief even when they don't mean to.
Re:And this is news? (Score:3, Insightful)
How many times have I had to respond to "urgent network problems" only to find out the problem was someone installed some shit like "NetAccelrator" on a LAN connected computer (they say they saw an error message telling them their connection wasn't optimized...) or CyberPatrol so their kids can play afterhours. Nevermind the problems with clients DoSing us with their Outlook/IIS/Sircam worms, the biggest DoS is people installing Gnutella and other sharing programs and giving downloaders full bandwidth, thinking it will make their downloads faster.
Even software that doesn't usually mess up a computers network stack or even use the network can wreak havock. Enter the user who thinks he knows everything he needs to know, but really only knows how to break everything he touches. Send him to a training course? Only if you want to teach him how to break more stuff, even with the best ACL's!
Re:And this is news? (Score:2)
Make the workers not disgruntal then... (Score:5, Insightful)
Re:Make the workers not disgruntal then... (Score:3, Funny)
Re:Make the workers not disgruntled then (Score:2)
Then they immediately ask me for penetration testing.
Double entendre? (Score:2, Funny)
Can you sue them for sexual harassment?
[ wink wink nudge nudge ]
I was waiting for this argument ! (Score:5, Insightful)
I originally thought the same thing - the employers are making the crappy workplace. That may or may not be the case. Over the last 8 years, I have seen so many slackers, dead-wood employees that have been kept on for no good reason. I started to wonder why. Then I heard about the pending lawsuits from former employees. Nowadays, you can't even fire someone without getting sued. It is stupid. People get stuck in a hole, and the company doesn't want to give them anything worth doing. Since they can't fire them for being un-driven losers, they give them crap jobs. Instead of working harder to actually reverse the situation, the employee just gets more bitter and lazy. I have seen people steal many many things from a company, because they feel the company "owes them". In one case, a guy claimed 20 hours of OT every week for about 8 months. His manager signed off on it because he was too spineless to challenge him. I know he didn't work it, because *I* was working it and he was nowhere to be found. In true corporate fashion, when it was discovered (by me), nothing was done. Nobody wanted to confront the situation. The guy eventually got PROMOTED! I figure he made out with about $30k.
I guess my argument is that no matter what your environment is like, people are going to try to screw the company. Granted, the worse the environment, the more it probably happens, but there are always going to be those disgruntled nut-jobs who feel the world owes them something. And I have seen companies do pretty crappy things too, like during the company meeting, announcing layoffs and those who weren't at the meeting were being escorted out of the building by police. This was to "preserve their dignity". Uh-huh.
Believe me, I know what it is like to be unhappy at a job. But you know what I did? I left. Employers have to cover their asses even more nowadays, when someone with the knowledge could easily F up their network, steal code/secrets, etc. Saying "don't piss off your employees" is no solution. Of course companies should have a good work environment, that is a no-brainer. But there will always be someone who wants more. You let people wear jeans, someone wants to wear shorts. Let them wear shorts, someone walks in with their bag hanging out. Let them wear sandals, someone walks around barefoot. No matter where I have worked, there has always been someone who was unhappy.
What about employers (Score:5, Insightful)
Re:What about employers (Score:2, Insightful)
They're correct, in part, about the usage of new media technologies to move information in ways that companies hadn't considered in the past. Sure someone could pop in with a USB-keychain device and copy company secrets, however if someone REALLY wants to copy/duplicate materials, there are a million different ways to do it and bypass typical security precautions.
If I was travelling with confidential data to any country which I was at all wary about, sure, I'd hide my data on a smartmedia card for my digital camera, or for large amounts, hide it on my nomad jukebox rather than putting it on an encrypted file on the laptop - if they don't know it's there, they can't ask/force you to decode it can they? Likewise for "copying secrets" from a job - anyone with half a clue would use something a little less obvious than walking out the front door with a burned CD if they were at all worried about getting caught.
By far the larger issue (IMHO) is typical "stupid company workers". I've lost track of how many times my co-workers have forwarded bogus virus notification emails, emails with annoying executable christmas crap, and other assorted garbage to me.
That's the sort of thing that needs to be "fixed" IMHO. Granted, a disgruntled employee can do a lot of short-term damage, but typical bumbling employees can do enough minor damage spread out over a long term to cost more in terms of support hours and money.
Re:What about employers (Score:2)
Re:What about employers (Score:2, Insightful)
Re:What about employers (Score:2)
Your argument makes sense, but you have to remember employers are people too. When you find a bad employer you generally can unroot a specific subculture or clic at the root of the problem. Often it is a group of political players in management or the jerk in IS who is trying to build a little kingdom with the computers.
It is not the employer who sets the tone of the company, it is the people who set the tone of the company in the name of the company.
Upper management can battle a lot of these problems. Unfortunately, there is a small set of employees who, no matter how good they have it, will sabotage their employer. Some are set on insider trading, others studied Machiavelli and want to put the words of the dark one in practice. These people can eat the heart out of both good and bad employers.
it's easier than that to cause harm... (Score:5, Funny)
Already wary of this... (Score:5, Interesting)
In the mean time, we keep all the sensitive data as locked down as possible, and hope for the best. I suppose in the end it is just part of human nature; even the most honest, trustworthy of people will steal from you if given the right motivation. Caring managers and a good working environment go a long way to prevent theft (and general unhappiness/turnover!), perhaps even moreso than good security personnel.
Re:Already wary of this... (Score:2, Interesting)
- "Digital cameras, MP3 players and handheld computers could be the tools that disgruntled UK employees use to sabotage computer systems or steal vital data, warn security experts."
- "The innocent-looking devices could also be used to smuggle out confidential or sensitive information."
- "One way that unhappy employees might try to damage computer systems is by smuggling in programs on devices such as digital cameras, handheld computers and MP3 players. "
- "Mr Longhurst said because digital cameras, MP3 players and handheld computers swapped information with a PC they could be used for nefarious purposes. "
- "Disgruntled employees could easily load hacking software on to the memory card for their digital camera at home, transfer the software on to a PC at work and let it run loose, said Mr Longhurst."
Yes, we should all be concerned and watchful for both internal and external security issues. Yes, trusted employees have the potential to cause more damage because they have better access to information and first hand knowledge of the systems, security and policies. But listing a whole bunch of "could's" and "might's" is as insightful as saying:- "employees could use their Bic pen to damage Post-it notes you have for sale by writing 'buy me
:-p' on each sheet."
The article clearly ignores that *most* security problems are from the outside. When will companies realize there is a simple solution: keep your employees happy; keep happy employees.Re:Already wary of this... (Score:5, Insightful)
And your guests stand for this?
Folks, three times in recent months I've walked out on places, or canceled tickets to an event that said they wanted to search me. Yes, it's their right to ask, and it's my right to say "No". Then it's up to them to decide which they want more - me, or their rule
To quote a Sci-Fi story being written by a guy on the net:
Re:Yep, that's the one (Score:2)
Re:Already wary of this... (Score:3, Informative)
Chris Mattern
Re:Already wary of this... (Score:2)
Travis
Re:Already wary of this... (Score:2)
You'll live up to their expectations. Good for you...
You'll live down to their expectations too? How terribly sad.
Reminds me of NSA security alert on "Furby" toys (Score:5, Funny)
Sig: What Happened To The Censorware Project (censorware.org) [sethf.com]
What issues? (Score:2, Insightful)
Employees could bring in matches and burn the building down too. You need to have employees you can trust. Sometimes you will get it wrong and one of them will betray you.
People who have access to your premises or systems could misuse that access.
Nothing new here, so what issues are people slowly coming around on?
Re:What issues? (Score:2, Funny)
Only if you take their staplers away from them.
anomie...look it up. (Score:4, Insightful)
This is some serious social breakdown we're seeing here. I remember the days when you would get hired by a company, and then not only would your employer actually give a fuck about you...they would assume that you were on their side by default. Maybe this should tell us something about the mindset of modern management. They hate us...they naturally assume that we hate them. Gattaca here we come.
In other news... (Score:5, Funny)
Re:In other news... (Score:4, Funny)
Oh, thank God for that. It *was* a bad dream after all...
Rights (Score:2, Insightful)
Dumb Question (Score:2, Interesting)
This bit of lucidity brought to you by..something!
Re:Dumb Question (Score:2)
I was wondering the same thing. The best reasoning that I could come up with is that it's the real-world equivalent of steganography. Just like steganography, it allows you to superficially hide data in such a way that many people will completely miss it. And just like steganography, you're in trouble if someone knows what they're looking for. Fortunately, both this system and steganography can be used as an additional layer on top of any other practices -- there's nothing to prevent you from PGP encrypting the hidden data.
Still, there's the classic drawback that steganographically hidden data implies that you have something to hide. Of course that seems to be the area where this non-conventional smuggling excels. A security guard isn't likely to check the contents of an mp3 player for hidden data. At worst, you'll just be prohibited from bringing the player in the office.
Comes around on issues like these? (Score:5, Interesting)
You really have to be kidding me here. If your employees are truely taking their time to use their mp3 players to screw your business, you have more pressing concerns than the 'vulnerability' of the systems from the people who built them.
I suppose since most premeditated murders happen between people who know each other, we'd better wake up and start hiring personal bodygaurds to protect us from our loved ones too!
Re:Comes around on issues like these? (Score:3, Informative)
I can't count the number of companies I've done work for that had glaring flaws in their physical security practices. Like one door with Pentagon level security, and a back door with absolutely none. I've walked through doors on military bases I shouldn't have been able to get NEAR, and that was without even trying.
The sad fact is that a lot of organizations haven't dealt with that revelation in any kind of rational, or even internally consistent manner. They generally react with panic, and implement a whole lot of rashly designed security plans that sound complete, but are actually so riddled with holes they might as well have done nothing.
Linux, Anyone (Score:2, Interesting)
Microsoft has loaded up their system with so many features that its almost impossible to stop someone finding a backdoor way in. While you can pretty much tie up a M$ system, its not easy to do and you will probably be patching it till the cows come home. Surely better to have *nix systems which can really lock down the user to the required tasks? Particularly with regard to things like file accesses and so on? I still think that there is a huge potential here for *nix OS's - anything to do with security generally leaves M$ smelling less that rosy.
My 2c worth,
Michael
It has nothing to do with Linux... (Score:2)
Re:It has nothing to do with Linux... (Score:2)
Re:Linux, Anyone (Score:5, Insightful)
All of this is beside the point anyway, as the article deals with folks misusing resources they already have access to, not problems with people getting at files they are not normally allowed to see. A Linux user is just as capable as a windows user of burning files he has rights to onto a CD.
Re:Linux, Anyone (Score:5, Insightful)
Well what do you want? (Score:3, Informative)
If you're really worried about corporate security, that kind of stuff is a real risk. It's not even the employees who are doing it, it's just the fact that there is a channel that data is flowing on in and out of the company that isn't protected and not subject to it. Once that exists, it's just a matter of someone hijacking it to use it for their own plans.
Another cause... (Score:5, Interesting)
Im glad this isnt news, true nonetheless (Score:5, Informative)
My (ex-wifes) Uncle was a VP of a F-250 in HR, He had been out of work almost a year when he got the Job and was only there 2 years, He quit, we all thought him quite mad. He was going to start a company specifically for consulting of HR risk managment, it had an IT Slant, all the major companies putting these 200 million dollar implementations of ERP's in place made for a lot of problems if a 6$ an hour lackey ordered 10000 of something by accident and didnt catch it, the real time nature of the transactions througouth the company from purchasing to production to HR makes for a lot of fear on the corprate side. Fear SELLS Simply put. He is now about 40 and worth well over 5 million, 7 years ago he couldnt pay his morgate, all money made on the fears, and(solutions) to fear based on employee liability.
The company is made by employees, it can be broken by the employees, very simple........
Re:Im glad this isnt news, true nonetheless (Score:2, Insightful)
Re:Im glad this isnt news, true nonetheless (Score:2)
You seem to write at a 3rd or 4th grade level... perhaps you should consider a remedial english class?
Re:Im glad this isnt news, true nonetheless (Score:4, Funny)
Well, that's management material right there! You wouldn't want the person in charge of making decisions to articulate their thought clearly and precisely, would you?
What, me worry? (Score:2)
Any executive smart enough to bring in a camera and load it up with data could take his laptop, make a big encryped
Appropriate Dilbert Quote: (Score:3, Funny)
Powerbooks ? (Score:2)
The innocent-looking devices could also be used to smuggle out confidential or sensitive information
Do the sexy new Powerbooks [slashdot.org] qualify as innocent-looking devices ? :)
Keyword is "trust" (Score:3, Interesting)
You also trust your employes not to burn down
the office, but you are still allowing them
to use matches. How is that different?
Re:Keyword is "trust" (Score:2)
People are insecure. We know this. (Score:3, Interesting)
Simply put, it's very hard to keep something secure when a person's well-being is threatened. If someone held me up at an ATM, building entrance, anything with password access, you'd bet I'd most likely give up the information to survive.
It's interesting to note that the article mostly focuses on malicious intent on the part of employee. That's not surprising, but far more surprising are the holes left by the everyday user. Take a look around the non-development areas of your company. How many have passwords on post-its? How much good will a secure network do if the front door to the building isn't locked down just as tight?
Do it "the old fashioned way" (Score:2)
No surprise (Score:2, Interesting)
And for cryin' out loud, You with anal ascii pic, grow up. How many sites do you visit with that pic anyway? "hehe! Hehe! *snort* It's the highlight of my day! *snort* hehe!" Get a life.
They are worried about an MP3 player? (Score:3, Interesting)
Are they going to ban CDs too?
I know that employees are the biggest security risks, but there has to be some sort of diminishing return in this. Besides, locking down your network on both the internal and external side is work that can't be avoided or established through policy.
Who needs 'innocent-looking devices' for smuggling (Score:3, Interesting)
or worse... what happens when someone realizes that instead of a 500 dollar mp3 player... they can use a 5 cent floppy disk! Lord no! we must eliminate such things.
Memory sticks... ? (Score:2)
... and we're soon expecting also FBI to realize that even floppy disks can be used for similar purposes.
Even innocent looking floppy disks (i.e. the kind that doesnt have "Warning, contains Virus and/or other malicious code!" printed on it) may soon be concidered a threat to the company security.
It's only starting -- next stop, wireless (Score:5, Insightful)
With the wireless connectivity becoming so common, network security is losing its "air gap".
It might be noted that the IP Rights protection software might end up being a problem for Open Source software acceptance in the market and work place. Not necessarily due to (most) corporations really concerning themselves about people copying music, but with employees copying confidential files to unsecured devices.
An operating system/networking system that provided built-in guards for transferring confidential/private data from secured/official devices to unsecured/private devices might have a lot more appeal to a corporation than one that has no protections against random file copying.
(Given that we are reaching the point where we have more memory and CPU power in computers than we know what to do with, I would be highly interested in seeing more OS development that allows for (security) meta-data to be associated with areas of memory as far as the permissions/state of that memory goes. It would be really nice to see a system where, say, image data loaded from a website might be marked in the OS as "image (jpeg) from foo.bar.com -- unauthenticated, non-executable", so that if some thing else tried to trigger the CPU to jump to that area of memory and execute it, the OS would reject the attempt. This is going to be more important with Bluetooth/ad-hoc connectivity, 'media' which are almost programs in themselves (Flash, Java, JavaScript, etc.) -- simply turning off all support for 'dangerous' media may not be practical if their use becomes wide-spread. This sort of internal OS meta-data system would have a high overhead, of course. And yes, the side effect is that it makes IPR-type enforcement much more possible, but the security issues may start pushing systems development in that direction. Free software folks should think about this one -- it would be highly ironic if by implementing IPR management software in Windows, Microsoft then stepped up and managed to make an OS with a superior internal security model based on extending the IPR system to manage internal data/executable security. Better start looking for quad Athlon servers...)
Re:It's only starting -- next stop, wireless (Score:2)
Oh, you mean like IBM's AS/400 operating system? [ibm.com]
contradictory practices (Score:3, Informative)
for instance, where i work, they've decided to block any web-based email (through a fairly thick piece of software, which just blocks any site with sendmail includes). This makes some sense, because you really can't trust people, no matter how many times you tell them, not to open attachments... they can't filter through each of these sites which bypass the main email systems..
however... here's the absurd part... they still seem to allow rampant use of peer-to-peer connections. People use AIM all the time... as if this were secure! And security argues that it serves a "business need." ahem.
Re:contradictory practices (Score:2)
When you look after your employees happily, including but not limited to giving them a decent salary, they feel sufficient loyalty that you don't *need* draconian security measures.
Works for me - both the last and current job have simple iptables firewalls, and no restrictions on what flows at censorship level. And do we see major info leak? No. We employee sensible honourable clueful folks, and look after them OK. No problem.
Damn. (Score:3, Funny)
Some Asian companies understand this already! (Score:4, Informative)
Hrmm even before? (Score:2)
Some miss the obvious (Score:4, Interesting)
Another brilliant common hole (at least in financial companies): block ports 21 and most others through the firewall so employees won't ftp files to or from their workstations over the intranet. Of course no employee is smart enough to configure their ftp client to use port 80.
Companies are getting scared of the latest techie gadgets, but so often don't even take care of what should be obvious to any educated IT security employee.
Re:Some miss the obvious (Score:2)
That won't work on NAI/McAfee VirusScan, at least; VS doesn't trust the OS to know what type the file is.
Re:Some miss the obvious (Score:3, Informative)
hehehehee...reminds me of something i did at my last job. i used to work at a very large financial company, the only access to the internet was http via a proxy server. i couldn't get access to my external email accounts. so i built an http tunnel to encapsulate ssh back to my box at home.
http://www.nocrew.org/software/httptunnel.
from there i could do anything i wanted. moral of the story : never f with a network engineer.
Speaking of which (Score:2)
Anyways, the've got a proxy where they supposedly monitor and also prevent certain sites.
However, the proxy only works on port 21, 80, and the standard proxy port (8080?), but you get unfiltered access to all other ports (No inbound connections however, so only passive-mode ftp)
Anyways, so what I ended up doing was:
telnetted into my box at home, installed a proxy, set it up to use an odd port, and wa-la. Along with I installed Cygwin, ssh into my machine, and use my machine as if I was there
Corporate Managers everywher are saying... (Score:3, Funny)
Big Corporate Lackey: "We already do that, sir!"
Big Corporate Manager: "Damn, that was a close one! I thought for a moment there we had a security breach on our hands. Good work. Let's go play some golf."
Big Corporate Lackey: "I'll get the clubs, sir!"
Management (Score:2, Informative)
So remember managers... (Score:5, Funny)
There's some things money can't buy, for the rest; raid the retirement fund.
Re:So remember managers... (Score:2)
Of course, I eventually succumbed to the dilbertesque syndrome of realizing I could flick my finger all day long and it wouldn't impact the company one bit, so now I only work for small-midsized companies. But this security never bothered me: the one time my friend had her film confiscated, they just developed it to make sure there was no sensitive data on it (for free, even) and sent her the pics/negatives afterwards.
Re:So remember managers... (Score:2)
Losing employees is only a problem if your annual churn rate goes to high. Many senior managers consider not losing someone a sign that their subordinate managers aren't managing effectively. Six Sigma, anyone?
-1 Redundant (Score:5, Interesting)
We had a SW Architect who was really anything but. He WAS a great salesman and was able to BS his way out of trouble for ~2 years before they tossed his butt out. When he left, I had been there for ~6 months. In that time, he had burned roughly 150 CDs, he said for backup of our project (our TOTAL source was less than 2 floppies). He also password protected all of his PCs (forcing us to remove the BIOS battery).
Further, on the server, about 7GB of a 13GB HDD was of a format not recognized by the Mandrake installer. The only thing I could think of was that it was encrypted. Who knows what data was taken or what was on that partition. We reported what we saw and re-formatted...
Add another 4 months. They fired this guy but didn't revoke his user/pass. So he manages to find a server with telnet exposed to the internet and "hack in" (using his still working user/pass). He then procedes to go to every server he can find and rm -rf on every directory where he has access. They ended up rebuilding 3 Sun boxes.
No charges in either case.
Same 'ol debate, different face (Score:2, Interesting)
FUD Marketing (Score:4, Funny)
There could be a good research paper here. Is it because these folks have too much idle time on their hands? Is it because the line of work keeps them focusing on negative activities? Is it because they are exposed to the company's weaknesses and become tempted by them? Is it because this line of work attracts thieves? Is it because companies use the 'it takes a thief to catch a thief' philosophy? Do 'Heads of Security' purposely hire thieves to keep levels of theft up, so as to justify bigger budgets? Outsourcing 'Security' does not solve the problem, it just makes it into someone else's profit center.
My father tells the story of a guy working at an auto assembly plant who took home an entire car -- piece by piece!
This 'article' is not News. Look at it's source. It's a marketing piece. Slashdot fell for someone's FUD marketing. I know it's Monday morning, but still...
Showing off my book larnin' (Score:2)
Sed quis custodiet ipsos custodies? loosely, "But who will guard the guards themselves?")
Obviously it's been a problem for a lot longer than 50 years.
"Security Department" is #1 security threat? (Score:2)
Network security should be different. I know plenty of 'reformed hackers' who are now in the "Information Security" business, and none of them collect and keep customer data that they should not have.
A big part of the reason physical security is a cause of internal theft is that most of the guards have time on their hands and get paid not much more than minimum wage. Neither should be true for information security :-)
Anybody have a link to the old joke about they guy who worked in a government factory during the war and wanted his own jeep. So each day he would steal a different part, and after two years, he put it all together in his basement and had himself a beautiful new anti-aircraft gun?My own experience with Employee Security (Score:3, Insightful)
In my last (regrettable) job, everyone was treated as an enemy (unless you were related to the boss, but lets not go there). The way people were scrutinized and monitored was ridiculous. Even those of us who'd been there for a while, and had proven ourselves 'loyal' were given this scrutiny. It ended up creating an environment where resentment and suspicion made one feel they were under seige. That atmosphere fostered more employee dishonesty than anywhere i've worked before or since. I still remember the
Of course, the places I worked before and after treated people with a 'we'll trust you until you do something to destroy that trust' mentality, which I'm finding is rarer and rarer these days. But you know what? The crew at the place I'm at now is completely loyal, the turnover is practically nil, and the job satisfaction surveys are at about 90%. Compare that to my last job...
In summary, do unto others yadda yadda... if you treat your employees like criminals from day one, they won't disappoint you.
It's a threat only if... (Score:2)
If you have your NT boxes (assuming you are a Windows shop, you have NT or one of the NT variants.. 2000 and XP are NT no matter what microsoft says.. if you have 98 then please slap a giant L on your forhead)
and you dont have them locked down so that only members of the administrator group can add hardware (USB smartmedia/cf/memorystick/whatever reader) then you deserve having your employees trash your systems and network. Mp3's and digital cameras are not a threat at my facility except for taking photos of sensitive materials.. of which they dont have access to even see. the bigger threat is a CD with the offending software on it.. (Yes, I have the CD drives locked down, and no floppy drives are installed. or just emailling themselves the hackerware..
So what do you do? well everyone has a simple linux box running a network intrusion detection system right? A simple Linux box with multiple network cards and Demarc Pure secure.
Heck it even catches virii coming in throught the router from corperate..
If your IS/IT personell has no skills in security.. It's time to train them or hire a security person. Any company the runs without a IT/IS person full time..... I shudder to think about the quality of the system let alone how secure it is.
Where SHOULD the threat come from? (Score:3, Interesting)
I saw a good talk by Dr. Richard Walton, the director of the Communications Electronics Security Group [cesg.gov.uk].
To paraphrase, he said, "Currently we know that about 80% of threats come from inside. But no one ever asks what the desirable value for this number should be. I propose that it should be 100%." He said we should trust insiders rather than outsiders, and trust people rather than machines. Or again paraphrasing, he said that we can trust machines to correctly do whatever they are told, unfortunately machines can't distinguish whether a set of instructions are "good" or "bad", whereas most of the time, most of the people inside your organization will do the right thing.
Memories (Score:2, Funny)
I figured out early on that not only can you get pictures out of digital cameras, you can put them in as well. I grabbed his memory stick, put it in my memory stick reader, and downloaded some juicy pr0n and mixed it in with the photos.
He had a very hard time explaining where the photos came from.
Actual report (Score:2, Informative)
Real security (Score:4, Insightful)
Just how exactly does it improve the security of your systems to punish employees for exposing flaws? This guarantees that the only people scanning for vulnerabilities are outsiders and insiders with evil intent. Give scanning tools to employees and offer to pay them a bonus for reporting problems!
There is so much wrongheaded thinking out there, it is no wonder to me that security problems remain so numerous.
Scanning Tools are like hammer drills... (Score:3, Insightful)
The only employee who should be 'scanning for vulnerabilities' here is me. Anybody we catch scanning without express written permission (generally from the CTO) is assumed to have 'evil intent'.
You can't just go off on your personal quest for vulnerable systems randomly on your employer's network, unless you actually want to end up like Randal Schwartz [lightlink.com]
Speaking of 'wrongheaded thinking'. Consider the risks of encouraging random scans by non-security employees:There are numerous reasons not to encourage random employeers to scan your network.
- Some badly-written scanners will DOS even well-written OSes and applications.
- Some legacy systems still running in corporate networks react badly to being scanned. This isn't good, but it is a reality.
- Who needs 1,000 identical 'Tool X' scan reports of the same network?
- Scanning generates extra network traffic and 'hits' on IDS systems. See previous item.
- Allowing random 'good' employees to run scans will make it harder to detect the 'evil' employees.
- How do you detect when a worm (Nimda?) or a trojan included in some shareware package starts scanning your network without the user's knowledge?
- What happens when 'Tool X' is distributed with a trojan, or simply hacked to silently CC the report summary to scanreport2002@hotmail.com?
- When 'Joe minimum wage' finds an easily exploited hole in the payroll server, you expect him to report it before trying it out for himself?
- Scanning random remote IP ranges can 'bring up' backup ISDN and other toll circuits, incurring a real expense.
- Do you encourage your average employee to check for unlocked doors and cabinets outside of their own work area, or do you have dedicated security personnel?
I agree that somebody should be scanning the internal network, just as somebody should be checking for unlocked doors. But that somebody should not be just any random employee who takes it upon themselves to test security....
In related news... (Score:2)
Preliminary testing will be started in the second half of this year with disposal of the offending intellects beginning early next year.
In related news: Life can cause death! (Score:2, Funny)
Prof. Harald Dumpfbacke Radab claims that by removing all living people from society, death could be reduced by up to 99.8%!
Realism, blame and the corporate mindset (Score:2, Insightful)
Companies like labelling the nefarious and elusive "black hat" as the primary risk because it makes it incredibly easy for them to say "There's nothign we can do!" or, perhaps in more cases, "We're doing everything we can!" This is roughly equivalent to a heroin addict telling someone that they've done everything in their power to avoid being gunned down in cold blood by their dealer. Never mind the fact that more junkies die from overdoses than from being gunned down by their dealer. Admitting the greater risk would entail acknowledging that employees aren't happy and might want to cause the company harm. This in turn indicates some flaw in the way the company conducts business, and opens them up for criticism. It's not surprising in the least that companies fear black hats more than they fear their own, because to fear their own would be to admit fault.
I'm just curious, of the 48% that report insiders as he cause of their greatest breaches, what percentage of those could be chalked up to insane or psychotic renegade employees as opposed to employees that may have had a semi-legitimate complaint that were driven to malice by a company's own policies and practices.
And all this USB key chain/MP3 player crap, I mean come on. If an insider wants to move data out of a company, its easy. In this arena these new devices are about as original as the floppy disk. Virtually anyone could e-mail attachments of reasonable size off site. I've never worked for a company with a proxy that blocked HTTP uploads (although I'm sure they exist) and what about the xerox machine? Should we get rid of that too?
Yes, employees *are* a threat (Score:2, Insightful)
But to ignore the security issue is very, very wrong for a number of reasons.
- In some cases, the employer's clients may demand certain measures be taken to protect ther data.
- In some cases, not having proper measures against theft of confidential data, can make one liable for *huge* lawsuits if the data is stolen. (Think medical records).
- Most importantly: in any group of employees, there'll be a couple of rotten apples in the bunch, no matter how nice and cuddly the employer. Those same employees are the ones that might steal wallets or other stuff from their co-workers desks. It's sad, but it happens everywhere, and to not be on your guard against it is plain silly.
The vicious circle of employee threat (Score:2)
Then there are the places where I hated the envrionment. Management carried unrealistic expectations, and refused to give us the tools (responsibility) needed to reach the goals they set. I've never stolen from or willfully damaged company property, but I knew others who did, and understood why they did that.
It seems that naming your employees as your primary security risk, and taking severe actions against them is throwing oil on the fire. With an attitude of 'We don't trust you, and we are going to assume you've done something wrong' is going to do nothing but make the borderline employees even more pissed off and likely to do something damaging.
I don't think anyone starts a new job with the exepectation of being bitter, lazy, or vindictive. It takes months to years of abuse by a company before they get that way.
The latest issue... (Score:3, Funny)
Health: Cigarettes cause cancer!
Politics: Research shows politicians like money.
Business: Profit helps businesses grow.
Computer security: Your employees' root access is a security threat!
Re:Yeah right... (Score:3, Interesting)
Re:Yeah right... (Score:5, Interesting)
In my much younger days, back in the 70s, I worked on a loading dock of a department store. They had a guard there at all times making sure we didn't toss some merchanise into the back of a truck.
We worked our asses off for minimum wage (back in the 70s when jobs were REAL hard to come by). The joint treated us like slaves. They even removed the chairs where we wrote up the paperwork and install a table at standing height. Some manager was concerned we were taking too long to write up paperwork. We also in the beginning got two 15 minute breaks a day and then they took one of them away.
So they started having a huge problem with shrinkage out of the stock room. The more they clamped down, the more stock just disappeared. They "doubled the guard" and rotated out the old one and still the shrinkage continued.
What they weren't guarding was the trash compactor. They'd be pissing off employees so bad that some would go and grab a $500 stereo (our fulltime take home pay was $77/week) and tossed it into the trash compactor and hit CRUSH. A shitload of merchandise went into that thing...
Oh, and for the record, the company was Almart, they went out of business in the 80s, I never did anything like that (didn't have the balls). I eventually got fired, but not for that. I got fired for trying to get the UFCW union to represent the employees and the stupid idiots voted it down. Just as well though, since the store went "tits up" three years later. If the union got in there, they'd be blaming the union for them going out of business...
Re:Yeah right... (Score:3, Funny)
I use a lead bag, the sort for protecting film's through x-ray machines
never failed me yet. I used to stand behind the plain clothes store detective in HMV while I put the CDs in it. Not for any reason other than it makes a better story
I got nicked pushing a trolley through the doors @ ASDA (now wal-mart) with over £170 of er goriceries in it my bravado having taken over my reasoning. Can't complain though I'd had over £200 of groceries out of the same store that week. My best haul was going up the the security guard in the door with a full trolley and asking him where the cardboard boxes where so I could use them to put the groceries in:
sg
me
sg : "That's ok Sir, I'll get someone to do it for you"
And I stood there watching the ASDA employees putting my unpaid for shopping into bags for me so I could carry it to the car!
happy days
Re:Yeah right... (Score:3, Insightful)
Go read up on "the elasticity of demand" and then study the common agricultural policy and how governments destroy food to keep the prices up to protect the economy.
I would never threaten or attack any member of staff, they are just people but I'll abuse their trust and enjoy the intellectual arms races in removing stuff from stores. Heck, it's not even that I can't afford it. Stealing is fun.
Re:Yeah right... (Score:2)
My personal issue is with stores with an over abundance of staff with nothing to do. Here in Canada we have a national store with locations all over, and they're vast stores with about 5 people in the entire store at most times except for weekends. Virtually every time I've gone in there on a non-busy period, I've got a personal floor-walker following me around, lamely trying to pretend that they just happen to be interested in the same stuff that I am. Do I act like a thief? Nope. Have I ever shoplifted? Absolutely not. Do they have too many employees with nothing better to do than to discourage sales, paying attention to the odd customer while ignoring the employees stuff their pockets with merchandise? Absolutely.
Re:Not so obvious (Score:2)