Slashdot Mirror
Employees Are The Biggest Security Threat
blankmange writes "BBC News is reporting that the employees of a company pose the biggest threat to security. "Digital cameras, MP3 players and handheld computers could be the tools that disgruntled UK employees use to sabotage computer systems or steal vital data, warn security experts. The removable memory cards inside the devices could be used to bring in software that looks for vulnerabilities on a company's internal network. The innocent-looking devices could also be used to smuggle out confidential or sensitive information." Unfortunately, this is not news, but it is amazing how slowly the general public, corporations included, comes around on issues like these. "
Yes, sounds stupid, but I would find it to be a better idea than to implement some kind of 1984/Farenheit 451 security "utopia". It should also help the companys success in the future. Happy people work better and doesn't try to screw you over (in the bad sense that is).
Ultimately it is employers who set the tone for a company. Employees actions are (in part) a reflection of how they are treated by employers.
call the BSA hotline.
Like I said in one of my previous posts on the subject (that I cannot find now for the life of me!), the company that I work for is already very wary of it's data and the "toys" people bring into the office. And now thanks to those keychain-sized USB drives, every guest has his keychain checked before he enters, and has to empty his pockets. Of course, you could still sneak one in, anything is possible as we aren't going to be implementing strip searches anytime soon. ;)
In the mean time, we keep all the sensitive data as locked down as possible, and hope for the best. I suppose in the end it is just part of human nature; even the most honest, trustworthy of people will steal from you if given the right motivation. Caring managers and a good working environment go a long way to prevent theft (and general unhappiness/turnover!), perhaps even moreso than good security personnel.
Sig: What Happened To The Censorware Project (censorware.org)
Oh yes, we should definately come around on issues where the 'biggest threat' is from the people with the 'inside track'. There's no better way to raise a generation on folx free from the confines of ethics and responsibility .. where anything that they can do technically and physically must be AOK, or else it would be impossible to to it.
You really have to be kidding me here. If your employees are truely taking their time to use their mp3 players to screw your business, you have more pressing concerns than the 'vulnerability' of the systems from the people who built them.
I suppose since most premeditated murders happen between people who know each other, we'd better wake up and start hiring personal bodygaurds to protect us from our loved ones too!
"Old man yells at systemd"
Another cause is common stupidity / ignorance. My wife works in a bank. Last year this bank interrogated two employees regarding theft of quite a large sum of money. It turned out to be one of their collegues, who used their terminals to make a few transactions. Those two wrongfully accused employees had a habit of not logging out or locking their terminal when leaving the desk. Cases like this make you wonder how often does this happen in other companies?
I have, and have for the last 7 years been in position of trust. I have earned that trust, I have never "screwed" any of my former employers even though I am generally so rooted into their systems , removing any and all access can be nearly impossible. BUT I wouldnt ever screw anyoneover and they know it. I am, the biggest potential hazzard to any company I work for, I once had a company take out 250,000 insurance policy on me for th company, It was matched by a personal policy of the same amount, they figured that was about what they would lose in 1-3 months following an early demise on my part.
My (ex-wifes) Uncle was a VP of a F-250 in HR, He had been out of work almost a year when he got the Job and was only there 2 years, He quit, we all thought him quite mad. He was going to start a company specifically for consulting of HR risk managment, it had an IT Slant, all the major companies putting these 200 million dollar implementations of ERP's in place made for a lot of problems if a 6$ an hour lackey ordered 10000 of something by accident and didnt catch it, the real time nature of the transactions througouth the company from purchasing to production to HR makes for a lot of fear on the corprate side. Fear SELLS Simply put. He is now about 40 and worth well over 5 million, 7 years ago he couldnt pay his morgate, all money made on the fears, and(solutions) to fear based on employee liability.
The company is made by employees, it can be broken by the employees, very simple........
Sig went tro...aahemmm.....fishing........
If people consider PDAs, MP3 players, and digital cameras a security threat as a channel for bringing data in and/or out of a company, just wait for the next generation cell phones/PDAs. When you have a 3G/GPRS/GPS/Bluetooth/802.11/IrDA/Ethernet/USB/Fir ewire/etc. capable personal phone, would employers let you bring it into work? Even if you had no hostile intentions yourself, your phone might be compromised by a trojan or virus that might attempt to spread from your phone into the corporate network over whatever communications medium is available.
With the wireless connectivity becoming so common, network security is losing its "air gap".
It might be noted that the IP Rights protection software might end up being a problem for Open Source software acceptance in the market and work place. Not necessarily due to (most) corporations really concerning themselves about people copying music, but with employees copying confidential files to unsecured devices.
An operating system/networking system that provided built-in guards for transferring confidential/private data from secured/official devices to unsecured/private devices might have a lot more appeal to a corporation than one that has no protections against random file copying.
(Given that we are reaching the point where we have more memory and CPU power in computers than we know what to do with, I would be highly interested in seeing more OS development that allows for (security) meta-data to be associated with areas of memory as far as the permissions/state of that memory goes. It would be really nice to see a system where, say, image data loaded from a website might be marked in the OS as "image (jpeg) from foo.bar.com -- unauthenticated, non-executable", so that if some thing else tried to trigger the CPU to jump to that area of memory and execute it, the OS would reject the attempt. This is going to be more important with Bluetooth/ad-hoc connectivity, 'media' which are almost programs in themselves (Flash, Java, JavaScript, etc.) -- simply turning off all support for 'dangerous' media may not be practical if their use becomes wide-spread. This sort of internal OS meta-data system would have a high overhead, of course. And yes, the side effect is that it makes IPR-type enforcement much more possible, but the security issues may start pushing systems development in that direction. Free software folks should think about this one -- it would be highly ironic if by implementing IPR management software in Windows, Microsoft then stepped up and managed to make an OS with a superior internal security model based on extending the IPR system to manage internal data/executable security. Better start looking for quad Athlon servers...)
Sadly, the NTFS file system has a richer system of file and directory permissions than anything Linux has to offer. Which is of course made moot by exploits that give the Microsoft user system level privileges, but the simplistic owner/group/world permission structure common to *nix systems is not a key selling point. The best permission structure I've personally dealt with was Novell's NDS, but they mistreated their sales channel so badly over the years they'd have troubling selling water to a guy who was on fire. Too bad, their cascading inheritance model was just amazing.
All of this is beside the point anyway, as the article deals with folks misusing resources they already have access to, not problems with people getting at files they are not normally allowed to see. A Linux user is just as capable as a windows user of burning files he has rights to onto a CD.
You're just jealous 'cuz the voices talk to *me*
Naturally the home account filled up pretty quickly at which point the remote and local servers began a game of ping pong betwen "Out of office" and "Mailbox is full" emails. Since we are an ISP and his 10MB account was on another large ISP this game of ping pong was going faster than a world champion on speed. As a side effect it also resulted in a DoS on the two mail servers as log files and message logs grew out of all proportion...
So it just goes to show; employees can cause grief even when they don't mean to.
UNIX? They're not even circumcised! Savages!
There's some things money can't buy, for the rest; raid the retirement fund.
We had a SW Architect who was really anything but. He WAS a great salesman and was able to BS his way out of trouble for ~2 years before they tossed his butt out. When he left, I had been there for ~6 months. In that time, he had burned roughly 150 CDs, he said for backup of our project (our TOTAL source was less than 2 floppies). He also password protected all of his PCs (forcing us to remove the BIOS battery).
Further, on the server, about 7GB of a 13GB HDD was of a format not recognized by the Mandrake installer. The only thing I could think of was that it was encrypted. Who knows what data was taken or what was on that partition. We reported what we saw and re-formatted...
Add another 4 months. They fired this guy but didn't revoke his user/pass. So he manages to find a server with telnet exposed to the internet and "hack in" (using his still working user/pass). He then procedes to go to every server he can find and rm -rf on every directory where he has access. They ended up rebuilding 3 Sun boxes.
No charges in either case.
Computer Science is Applied Philosophy
The theoretical permissions are one thing, the actual ones used in practice are another. As Microsoft Office requires the %WINNT% directory to be world writable, that means in practice, the majority of NT setups are insecure.
In my much younger days, back in the 70s, I worked on a loading dock of a department store. They had a guard there at all times making sure we didn't toss some merchanise into the back of a truck.
We worked our asses off for minimum wage (back in the 70s when jobs were REAL hard to come by). The joint treated us like slaves. They even removed the chairs where we wrote up the paperwork and install a table at standing height. Some manager was concerned we were taking too long to write up paperwork. We also in the beginning got two 15 minute breaks a day and then they took one of them away.
So they started having a huge problem with shrinkage out of the stock room. The more they clamped down, the more stock just disappeared. They "doubled the guard" and rotated out the old one and still the shrinkage continued.
What they weren't guarding was the trash compactor. They'd be pissing off employees so bad that some would go and grab a $500 stereo (our fulltime take home pay was $77/week) and tossed it into the trash compactor and hit CRUSH. A shitload of merchandise went into that thing...
Oh, and for the record, the company was Almart, they went out of business in the 80s, I never did anything like that (didn't have the balls). I eventually got fired, but not for that. I got fired for trying to get the UFCW union to represent the employees and the stupid idiots voted it down. Just as well though, since the store went "tits up" three years later. If the union got in there, they'd be blaming the union for them going out of business...
I originally thought the same thing - the employers are making the crappy workplace. That may or may not be the case. Over the last 8 years, I have seen so many slackers, dead-wood employees that have been kept on for no good reason. I started to wonder why. Then I heard about the pending lawsuits from former employees. Nowadays, you can't even fire someone without getting sued. It is stupid. People get stuck in a hole, and the company doesn't want to give them anything worth doing. Since they can't fire them for being un-driven losers, they give them crap jobs. Instead of working harder to actually reverse the situation, the employee just gets more bitter and lazy. I have seen people steal many many things from a company, because they feel the company "owes them". In one case, a guy claimed 20 hours of OT every week for about 8 months. His manager signed off on it because he was too spineless to challenge him. I know he didn't work it, because *I* was working it and he was nowhere to be found. In true corporate fashion, when it was discovered (by me), nothing was done. Nobody wanted to confront the situation. The guy eventually got PROMOTED! I figure he made out with about $30k.
I guess my argument is that no matter what your environment is like, people are going to try to screw the company. Granted, the worse the environment, the more it probably happens, but there are always going to be those disgruntled nut-jobs who feel the world owes them something. And I have seen companies do pretty crappy things too, like during the company meeting, announcing layoffs and those who weren't at the meeting were being escorted out of the building by police. This was to "preserve their dignity". Uh-huh.
Believe me, I know what it is like to be unhappy at a job. But you know what I did? I left. Employers have to cover their asses even more nowadays, when someone with the knowledge could easily F up their network, steal code/secrets, etc. Saying "don't piss off your employees" is no solution. Of course companies should have a good work environment, that is a no-brainer. But there will always be someone who wants more. You let people wear jeans, someone wants to wear shorts. Let them wear shorts, someone walks in with their bag hanging out. Let them wear sandals, someone walks around barefoot. No matter where I have worked, there has always been someone who was unhappy.
My beliefs do not require that you agree with them.