Slashdot Mirror
Mitnick: Security Not about Technology
renai42 writes "Companies eager to tighten up their information security perimeters should focus not on technology but on teaching their employees how to say 'no', ex-hacker done good Kevin Mitnick told a full house at Toshiba's MobileXchange conference in Melbourne yesterday. 'We can't expect our employees to be human lie detectors,' Mitnick said. 'One of the most difficult challenges in corporate cultures is getting people to modify their politeness norms.'"
Isn't this what (ex)hackers have been telling the IT industry all along?
'We can't expect our employees to be human lie detectors,' Mitnick said.
Sure we can: http://content.monster.com/martynemko/articles/arI do tech support at my school. My self and two guys finnally finished our new mobile computer lab. Laptops with WiFi cards installed. It makes me sad to think after we get the things nice, clean, working, etc that the idiots will have the things broken beyond recognition by the end of next week. ;_;
The ultimate security leak, people. >_
Speaking is NOT communication
I'm so sick of this guy's so-called "hacker" fame. He tricked a bunch of early tech no-nothings into telling him their passwords and protocols and now he's living off it forever. Jobs and Woz hacked the phone system, but then they went on to produce something. What has this guy actually ever produced, written, made? Seriously, I don't know and maybe that's a problem. He must have produced something valuable, but I don't know what it is. I'm sure some Slashdot guy will tell me, but isn't it funny that no novice (like me) knows what the hell he's ever done creatively/intellectually in his life?
Technical or human, good security requires balencing convenience and control. If you give your employies the power to refuse information to potential customers, you gain control and security but loose convience and maybe money. If you tighten your network down so much that users have to jump through hoops to send files to each other, you may be more secure, but the hassle will lead to lost productivity. You can't try to too hard for control or for freedom. You have to weigh threat and risk. You want to ensure against potential disasters, and eliminate any more likely security risks. It's probably too costly to treat a low threat but high risk (common) security hole as if it were a disaster. This is why stores find it cheaper to set prices assuming a certain ammount of shoplifting will occur. It would cost too much in lost sales and increesed labor to secure the store against all theft. Training your dumbass users, helpdesk, and even sysadmins to recognise social engneering, might just cost more then any losses from security breaches.
------ Take away the right to say fuck and you take away the right to say fuck the government.
remember this
The best education consists in immunizing people against systematic attempts at education. - Paul Feyerabend
THEN, you can fix "social engineering"
StupidChildren...the reason jesus is crying
Simple answer is to put a heavy duty cross-cut shredder beside that recycle bin or even better one that reduces documents to something resembling confetti. Certainly some paper waste companies do shred the paper they pick up, sometimes right in the truck they use to pick up the recycling. However for important or sensitive information you should not rely on this "service". Also a company rep, manager, or other person should verify that shredding takes place either by casually visiting the pick-up vehicle if they shred on-site or performing a site audit/visit at any central recycling facility to confirm the company is doing what they claim and what you are paying them for.
FOr myself, if it's particularly sensitive I'll shred the stuff at home.
Speaking of home and bringing up home workers. Companies should also provide a cross-cut shredder as well as that company computer, printer, or other technology for work-at-home employees. Teach them to shred stuff, even allow them to shred personal stuff if they have them. It will provide some added "noise" to the company confidential shredded documents.
It's just that they don't know when to say "no" versus when not to say "no".
Any dealing with any large, bureaucratic organization (a government bureau of any stripe, any telco, any cable company, any other sort of "utility", eBay/PayPal, Microsoft, IBM, etc.) will demonstrate quite aptly that no, they have no bloody problem saying "no". You can make a reasonable request and they'll quite cheerfully say "no" since it isn't part of their "script" to say "yes". (Then they'll tell you they're "sorry" they couldn't say yes. They aren't.) Meanwhile, the "bad guys" probably know how to work the system anyhow, and can get them to say "yes" by understanding said "script".
Simple example: I do business under my initials, and PayPal wouldn't let me change the name on my account to my initials for "security reasons". Even after I provided proof that both of my bank accounts had already been changed (to my initials). Even after I went back and forth with them at least half a dozen times. I finally had to go in the "back way" via talking to an ex-PayPal employee, who talked to a current PayPal employee, etc. etc...
They wouldn't change my name to my initials despite indisputable (and verifiable) proof from two established brick-and-mortar banks, yet they have absolutely no problems letting you set a crappy-ass password on your account... You see? Their priorities are backwards. They love saying "no", but they have no clue when to do it and when not to. The end result is that they suffer not only from security risks, but from bad PR.
With spending like this, exactly what are "conservatives" conserving?
I consider The Art of Deception to be up there with Bruce Schneier's two books, Secrets and Lies, and Beyond Fear. It is a real eye-opener on the techniques a social engineer can use, and should be mandatory reading for anybody entering the infosec field. You can be pretty sure that he has used all the techniques described, just that the names, places and times have been changed to protect the innocent.
If you choose to get it, look for the "lost" Chapter 1 on the Internet.
I've also noticed that his new book, The Art of Intrusion has just been released. I'm sure I'll get it in the near future.
The Internet's nature is peer to peer - 20050301_cs_profs.pdf
From my experience in the workplace (100% tech savvy people, it's a software company): On the servers that force users to change their passwords every 90 days, most users use their regular password plus a number, adding exactly nothing to the security.
People do need to get on with their work or life if they forgot their passwords, account names or access numbers. Since there is no reasonable way to prove identity of unfamiliar people over the phone, a support person will just fool around a bit and then let you have what you need. A skilled con man can own you, but in the end he will be the one in jail and you will just suffer a few hours of inconvenience proving which transactions are yours and which aren't. I am sure Kevin regrets his stupidity.
Or you can do business with smaller shops that personally know all their customers. I bet they will have no problem "authenticating" you over the phone and may not even need passwords.
I agree, but you forgot about the lying reporter who blew Kevins case into the huge federal fiasco that it became rather than a normal case where someone got into a system and had a peek, left few footprints adn did little (actually no) damage.
He didn't even profit fron the things he did. Outsmarted people with big paychecks. That is why they wanted him so bad. He embarrassed the big boys and also was made an example of by the press and then the Feds who needed another whipping boy "big bad hacker" whom they claim was trying to bring down the nation.
His real crime was seeing things they didn't want him to see. Or to put it better, showing that the buisness types can't nesisarily protect our privacy.
My point being that the feds/cops are just tools and it's really all about the money.
01101101 01111001 00100000 01110011 01101001 01100111
you dont work in a real IT environment.
examples? sure!
marketing manager that demands he needs admin rights. other managers that think they need admin rights so it snowballs and then corperate deems that most have admin rights, or better yet the idiots in the NOC set the global user profile to put them in the administrator group for some failed attemptto push out a path and forgets to move everyone back.
corperate IT is hell. as the NOC morons are sure they know more, the managers demand more access or threaten your job, then bitch that they clicked on a strange attachment and want to know why you are not protecting them.
solution? thow their asses under the bus. when a manager or Director infects his computer and then the office, ANNOUNCE who it was, espically to the IT heads.
Dont know what lumpy works at, but this is the norm for the 4 corperations I worked at.
My org was hit bad. One could ssh into a remote host and within seconds the box would be rooted and keystroke loggers installed.
No amount of "social" training can solve this problem.
BTW. The software based loggers are professional quality. They are undetectable without booting from known good media and examining the kernel, all its modules, and all applicatiions. Hardware based keystoke loggers are available too.