Slashdot Mirror

← Back to Stories (view on slashdot.org)

Mitnick: Security Not about Technology

Posted by CowboyNeal on from the locking-the-doors dept.

renai42 writes "Companies eager to tighten up their information security perimeters should focus not on technology but on teaching their employees how to say 'no', ex-hacker done good Kevin Mitnick told a full house at Toshiba's MobileXchange conference in Melbourne yesterday. 'We can't expect our employees to be human lie detectors,' Mitnick said. 'One of the most difficult challenges in corporate cultures is getting people to modify their politeness norms.'"

32 of 387 comments (clear)

  1. As Nancy Reagan would put it... by carninja · · Score: 5, Funny

    Just say NO!

  2. FREE KEVIN! by Anonymous Coward · · Score: 5, Funny

    oh wait..nevermind..its 2005

  3. How is this news? by Anonymous Coward · · Score: 4, Interesting

    Isn't this what (ex)hackers have been telling the IT industry all along?

    1. Re:How is this news? by digitalchinky · · Score: 4, Interesting

      When working as sys-admin I clearly tell people 'Do NOT give ME your password, I don't need it to do my job' - Ten seconds later - Now log in for me, 12 seconds later, my password is 'fluffy'...

      People are dumb until it's too late, not all, but enough to make the stereotype hold true anyway.

    2. Re:How is this news? by Anonymous Coward · · Score: 5, Insightful

      I don't really believe that most people are dumb. Most people just want to do their job, whatever it is, and they think that it is up to YOU to prevent people from "hacking the system." In their mind if something goes wrong, it's YOUR fault.

      The biggest problem is that people's views are flawed, they need to be told WHY they shouldn't give their passwords out. Rather than saying, "I won't ever ask for your password, don't give it out," say something like, "there are these people who use social engineering..." etc...

      Will this prevent social engineering attacks? No, but it WILL help to prevent them. People won't do what they are told if they don't know why they shouldn't do it, regardless of the profession (is that enough double negatives?)

      But what do I know, I'm just Anonymous Coward.

    3. Re:How is this news? by Linker3000 · · Score: 5, Interesting

      In my previous job I worked as a trainer and consultant for many blue chip companies and spent a lot of time in their corporate HQs, Call Centres and Help Desks.

      Invariably, front desk security was adequate, but it was easy to get into many Call Centres and Help Desks without a key card, fob or access code simply by waiting for an employee to walk towards the main door and then approaching the same door carrying an abviously heavy, large box full of training manuals - most people in service delivery roles want to be helpful so they often hold the door open for you! In 6 years of consulting I was only ever challenged once.

      In reverse, I would occasionally be coming out of a building and someone would ask me to hold the door because they had forgotten their pass - it would really piss them off when refused to let them in and said if they waited outside I would fetch a team leader or manager for them!

      --
      AT&ROFLMAO
  4. Sure we can... by Anonymous Coward · · Score: 5, Interesting

    'We can't expect our employees to be human lie detectors,' Mitnick said.

    Sure we can: http://content.monster.com/martynemko/articles/arc hive/lying/
  5. pots and kettles by Jippy+T+Flounder · · Score: 5, Funny

    and in other news... "reformed serial rapist teaches women to 'just say no'"

    --
    ---- I was woken up this morning by a face full of fur. Damn cat thought my head made a good pillow.
  6. Please... by jpiggot · · Score: 4, Insightful
    "politeness norms" my ass...

    What employees need to do is follow the very simple instructions they're given. Change your password regularly. Don't make it obvious. Log out of the system when you're done. Don't use the same password at every site you visit. Etc...

    It's simple, Private Pile...if you lock up that jelly doughnut in your footlocker, it's going to make it very hard for people to steal it.

    --
    StupidChildren...the reason jesus is crying
    1. Re:Please... by tji · · Score: 4, Insightful

      > Change your password regularly. Don't make it obvious. Log out of the system when you're done

      That's fine for making general users more secure..

      What he's talking about is more to do with making admin types more skeptical / less polite. The common 'exploits' that Mitnick, and many others, have done is to learn enough about a target company's practices, and talk your way into getting privileges that employees get.

      e.g. call the phone company's internal support line, talk the talk of the phone technician, and get them to change your account, give you information, etc.

      Or, call a corporate support line complaining of problems with your dialup access to the corporate network. Get them to reset "your" password for you, and you're in the network. 99% of the calls they get are legitimate employees, probably with the same old problems. If you sound like one of those normal employees, the support people will work hard to get you access to the network.

    2. Re:Please... by Anonymous Coward · · Score: 5, Informative

      Good grief, changing your password regularly and make it non obvious... this is just such an outdated view that it's almost comical.

      Two immediate issues - sure, the employees computer comes up every 'X' number of days and forces a password change. Most employees alternate between "password A" and "password B" with the only difference being one different letter or number.

      Second issue, the password is forced to be some 8 character password that conforms to a complexity rule that requires letters and numbers, a mix of upper and lower case, and sometimes some non-letter/number characters. These conforming passwords are ones that very few, if any employees can remember so they do what? Write it on a post-it note and stick it on the monitor, under the keyboard, in a drawer, between the pages of the intercompany printed phone book or employee manual or some other 'safe' place that could be determined by an unauthorized person. How do these contribute to increased security??

      Better to break those "politeness norms". You see someone you don't recognize involve them in a conversation. Introduce yourself, ask them about themselves, what they do, who their supervisor is. It's not confrontational, it's non-threatening, and if the person does not seem genuine the questioning employee can make a report to building security with a description. Stop tail-gating at controlled entrances, keep an eye out for co-workers who may forget or seem to be having problems. Respond to unusal requests from outside people by telling the caller you don't have the information handy but can call them back with it within a short time. It also gives time to check with others if the sharing of information is unclear. ALWAYS call back however even if it is to tell the caller that the information cannot be relased. These subtle changes as well as others should foster a culture of security that becomes so second nature to every legitimate employee that the "simple rules" and the threats that accompany non-compliance are no longer the focus.

      I've been promoting and exposing these concepts as an admin and IT Manager since at least the mid 90's.

    3. Re:Please... by FireFury03 · · Score: 5, Insightful

      Change your password regularly.

      No, most security experts will tell you this is a very stupid thing to require people to do. Your password system should enforce strong passwords anyway. Enforcing strong passwords which have to change every month just encourages people to write them on a post-it and stick it to their monitor because no one can remember passwords that change that regularly unless they're really simple.

      What's more, it doesn't actually do much for the security anyway: if someone hands random people their password then you're pretty much screwed anyway - people aren't going to wait until after the password change to try and use that password. If someone is brute-forcing passwords then they stand the same mathematical chance of hitting the new password as they did with the old password so no more security there. Infact, the only security it gives you is if someone steals your encrypted password file and it's going to take them a few months to crack. But if random people can get the password database then you've got bigger security concerns than weak passwords.

      --
      http://blog.nexusuk.org
  7. C&C by shannara256 · · Score: 5, Insightful

    As CABAL said in Command & Conquer: Tiberian Sun,

    "The systems are impenetrable. There are no weak points. The technology is without flaw. The Human element, as always, is riddled with imperfection."

  8. Social Evolution by MrAsstastic · · Score: 4, Insightful

    This is exactly how things become worse as time goes on. Now regular folks are going to become more rude and less interested in working with you to get things done. Trust me, the sheeple don't know how to defeat social engineering. They are used to fear and terror and will be distrustful of your attempts to get work done. A few can defend against rogue attempts to illicit secure information, but most will just be jerks about it and everybody hurts. More negativity. Well, it's something to work on and I guess that's what we do here on Earth...we work on stuff together. We talk about it on Slashdot, we IM our buddies and send them interesting links. Slowly their minds change to our influence. I found out at an early age how easily I can manipulate good people and it sickens me. I grew up, matured and avoid it at all costs. But it does come with a heavy price. Sometimes it is very hard to deal with good people. Especially stuck down here in my parents basement, looking for light swords and good time travel techniques. Forward into the fray.

  9. Re:Con-man gains fame at others expense... by vhold · · Score: 5, Insightful

    What's particularly ironic is that his success mostly stems from getting caught. Had he not failed at the thing he is such an expert on, he'd never have been considered an expert.

  10. Policy, Process, Training. And still, holes. by jafac · · Score: 5, Insightful

    My employer holds regular training sessions for all employess on computer security, with a strong focus on resistance to social engineering methods. There are also several levels of the training, a basic course for the rank-and-file, a higher level course for those higher-ups and engineers who have to protect subcontractors and customers proprietary data, and a more intense set of courses for the IT and security folks. (We manage both physical and information security).

    Have we had information stolen? Yes. We've had unscrupulous employees go to work for competitors and give them proprietary data, we've had subsidiaries sell controlled technology to foreign powers (and got bitchslapped for it too!).

    Point is, machines are easy to secure. More often than not, theyll protect what you tell them to, especially if you have competent engineers. But the weak link is ALWAYS the human one. The most careful companies can apply careful policy, process, and training, like my employer does, and they can also hire tons of babysitters, big brothers, and such. And the information still flies out the door.

    --

    These are my friends, See how they glisten. See this one shine, how he smiles in the light.
  11. trade off by delirium+of+disorder · · Score: 5, Interesting

    Technical or human, good security requires balencing convenience and control. If you give your employies the power to refuse information to potential customers, you gain control and security but loose convience and maybe money. If you tighten your network down so much that users have to jump through hoops to send files to each other, you may be more secure, but the hassle will lead to lost productivity. You can't try to too hard for control or for freedom. You have to weigh threat and risk. You want to ensure against potential disasters, and eliminate any more likely security risks. It's probably too costly to treat a low threat but high risk (common) security hole as if it were a disaster. This is why stores find it cheaper to set prices assuming a certain ammount of shoplifting will occur. It would cost too much in lost sales and increesed labor to secure the store against all theft. Training your dumbass users, helpdesk, and even sysadmins to recognise social engneering, might just cost more then any losses from security breaches.

    --
    ------ Take away the right to say fuck and you take away the right to say fuck the government.
  12. Mitnick by Stalyn · · Score: 4, Interesting

    remember this

    --
    The best education consists in immunizing people against systematic attempts at education. - Paul Feyerabend
  13. Dumpster Diving For Info by eric31415927 · · Score: 5, Insightful

    What do you do with your print outs? Do they wind up in the filing cabinet, the shredder, the recycle bin, the trash? I've seen many people trying to be green by chucking their papers in the big blue recycle bin. I'm sure much of this blue-bin fodder should have been shredded.

  14. Relevant quote (Schneier): by chris_eineke · · Score: 5, Insightful

    "But if you think technology can solve your security problems [...] then you don't understand the problems and you don't understand the technology."
    - Bruce Schneier

    --
    "All you have to do is be fragile and grateful. So stay the underdog." Chuck Palahniuk, Choke
  15. Definition of geek by EmbeddedJanitor · · Score: 5, Funny

    Has not yet said "no"... actually hasn't been asked yet either!

    --
    Engineering is the art of compromise.
  16. Only useful for a small subset of threats by nasor · · Score: 4, Insightful

    I suspect (but of course can't provide any real evidence) that the vast majority of computer break-ins are by young people who are simply looking for any system to break into, not targeting a specific company. Most 'crackers' probably just pick a known vulnerability and search around for a system that hasn't fixed it yet. They don't particularly care who they break into, so long as they're breaking into somewhere.

    These social engineering attacks that Mitnick has built a career warning people about seem more relevant to situations were the cracker has some very specific goal in mind regarding a specific organization - dedicated industrial spies who want specific information from a particular company, etc. While I'm sure that sort of threat is a concern for many companies, I don't think it's typical of how and why computers usually get hacked into.

  17. Mitnick's never been "inside the fence" by SuperBanana · · Score: 5, Insightful
    We can't expect our employees to be human lie detectors,' Mitnick said. 'One of the most difficult challenges in corporate cultures is getting people to modify their politeness norms.

    Mmm...no.

    This is the problem with Mitnick- he's never been inside of the fence. Ever. He's always been peering in from the outside, either as an attacker or a consultant. Unless you work in IT as regular staff, you don't realize the root causes.

    The problem isn't with training people to say no, or to stick to policies. Especially in a medium to large organization, there's little problem getting people to stick to policies if they make sense or aren't an unreasonable impediment to workflow. The word is "bureaucracy", and so often, it's used by lazy people to avoid work.

    Security problems come from three areas:

    • Security policies written by the incompetent
    • Security policies influenced by corporate politics, such as "oh, the controller will complain if his accountants keep having to change their passwords, we share a boss, and he's got a lot of favor with the boss, so I don't want to piss him off" (see above)
    • Security policies so complex or cumbersome, they're ignored or not followed as strictly as necessary (see above)

    Notice a pattern? Security policies written by the incompetent.

    A company I worked at had to comply with Sarbanes-Oxley regulations. This was interpreted to mean that every 90 days, all the employee domain passwords would expire. Because a large portion of the company used Macs (to make a long story short, you can't easily set up a Mac to let users change Active Directory passwords, much less notify the user their PW has expired and "please change it:"), email and file server access would just stop with no warning, and they'd flood help-desk with calls.

    Typical conversation went something like:

    "...and what would you us to change your new password to?"
    "Harry123"
    "Is that family member's name?"
    "Yes, my husband's."
    "Please pick something else."

    This would go on and on. Some of the passwords people wanted consisted of their username plus "123", their first name plus two numbers, etc. Even worse, their initial password was based off their hire date, and most people never bothered to change theirs- so access to any other employee's email for at least the first 90 days was Dumb Shit Easy.

    It's so incredibly stupid- force password changes every 90 days, but no standards for setting passwords...predictable passwords for new employees...no password auditing(ie runs with John the Ripper or similar)...nothing. Just "make all the passwords expire every 90 days." Brilliant. Why couldn't stricter password rules be enforced? Top management decided it would "aggrivate" employees too much, and I was actually told not to stop employees from picking bad passwords.

    --
    Please help metamoderate.
  18. Re:Con-man gains fame at others expense... by Anonymous Coward · · Score: 5, Informative


    You should do a little research grashopper. E.g. Mitnick demonstrated that sequence number attacks were possible with TCP/IP. NOT a small thing.

  19. Re:Con-man gains fame at others expense... by Candiri · · Score: 5, Interesting

    You should read up on the guy. His talent lay more with the social engineering aspect of security. He could talk his way into or out of just about anything. His book on social engineering is a good read, McPaper-sized examples, but still very eye-opening. I'm a network admin, 18 years running, and I wound up with a large security laundry list to discuss with my boss the following Monday.

    The other thing is his *years* of jail time were spent before he was ever convicted, i.e. pleaded guilty to some of the charges to cut short his lack-of-a-speedy trial. He's done his time. He can talk as long as people will pay him.

    Besides, ignorance is not unexpected. Many novices probably couldn't tell you who Philo Farnsworth was, even though they've been looking at his invention all their lives.

  20. It's at least as much a software problem by jesterzog · · Score: 4, Insightful

    Kevin Mitnick is looking at it from companies' points of view right now, but I think the whole problem is really created by some fundamental flaws in software architecture patterns and how most software these days interacts with the users. (Arguably it's as much a fault with the operating systems as everything else.)

    I don't think that there should be that much of a burden put on the user to be responsible for saying yes or no all the time. So much software that's out there today directly bombards the user with so many questions about things that they don't understand, care about, or have time to deal with, that it's not practical for most people to spend so much time caring about what they're being asked.

    Passwords, which Kevin Mitnick also talks about, are an equally bad design. They're there for the convenience of the machine -- not the person using it. Most people aren't mentally capable of remembering and matching lots of different passwords for different services, certainly not if they're supposed to (or forced to) change them every few months. It's no surprise that in order to get their actual work done, people are simply going to resort to predictible patterns or writing down secret information.

    I can set aside the time for dealing with these sorts of things, and I'm sure that many people here can... but then I have more than a passing interest in computers and what's going on inside mine. For many more users out there, a computer is just a tool that's used towards something that's much more interesting to them, and dealing with the tool is one of the last things they want to care about.

    Teaching people to "say no" is certainly part of the equation, but it won't work beyond a certain point. I don't know what the answer is, whether it's reducing the number of options over all software, trying to make more intelligent decisions without asking the user, arranging things so that people's software is generally configured entirely by an administrator who understands the issues, or something else. I think it's important to realise, though, that research about reducing social engineering in software is at least as important to security as researching technical security holes. It's as much of an HCI problem as a security problem.

  21. Um, they have no freaking problem saying "no". by Caspian · · Score: 4, Interesting

    It's just that they don't know when to say "no" versus when not to say "no".

    Any dealing with any large, bureaucratic organization (a government bureau of any stripe, any telco, any cable company, any other sort of "utility", eBay/PayPal, Microsoft, IBM, etc.) will demonstrate quite aptly that no, they have no bloody problem saying "no". You can make a reasonable request and they'll quite cheerfully say "no" since it isn't part of their "script" to say "yes". (Then they'll tell you they're "sorry" they couldn't say yes. They aren't.) Meanwhile, the "bad guys" probably know how to work the system anyhow, and can get them to say "yes" by understanding said "script".

    Simple example: I do business under my initials, and PayPal wouldn't let me change the name on my account to my initials for "security reasons". Even after I provided proof that both of my bank accounts had already been changed (to my initials). Even after I went back and forth with them at least half a dozen times. I finally had to go in the "back way" via talking to an ex-PayPal employee, who talked to a current PayPal employee, etc. etc...

    They wouldn't change my name to my initials despite indisputable (and verifiable) proof from two established brick-and-mortar banks, yet they have absolutely no problems letting you set a crappy-ass password on your account... You see? Their priorities are backwards. They love saying "no", but they have no clue when to do it and when not to. The end result is that they suffer not only from security risks, but from bad PR.

    --
    With spending like this, exactly what are "conservatives" conserving?
  22. Re:Con-man gains fame at others expense... by flyingsquid · · Score: 5, Insightful
    The insurgency in Iraq is a good case of how effective the human element is. The guys apparently know pretty much everything that's going on because they have moles and informers in the government, and because they can blackmail and threaten people for information. They just managed to take out a couple of the people in the Hussein trial. Meanwhile, for all their high-tech satellites, unmanned aerial vehicles and NSA technology, the U.S. still can't figure out where the hell Zarqawi is.

    Likewise, the U.S. was able to get intelligence on the Soviets by sending a sub to tap an underwater cable in the Sea of Okhotsk. This cost tens of millions of dollars. For a couple million, the USSR bought off Aldrich Ames and got whatever intel they wanted. All in all, being able to manipulate people is probably a lot more useful and dangerous skill than being able to manipulate technology.

  23. FREE MARTHA! by sulli · · Score: 5, Funny

    oh wait .. never mind...

    --

    sulli
    RTFJ.
  24. ** _ by Nailer · · Score: 4, Funny

    offer is only valid with purchase of Kevin of equal or lesser size

  25. To the anti-Keven crowd by chadpnet · · Score: 4, Informative

    As I clicked on the comments link and expected to find a decent collection of Kevin flames, I knew I'd have to throw my two cents in.

    To the ones that claim that this is old news, or that Kevin isn't as "leet" as many think; I advise to take your comments with a grain of salt. Anyone who has actually read his book, The Art of Deception, will appreciate Kevin's viewpoints. The truly great hackers use a good mix of social and technical engineered tactics to comprise security. I give you the advice is outdated and isn't news, but his advice will always outlast ever-changing technology. As a bonus he gives you open-sourced ;) policy suggestions that would be a nightmare for admins to write themselves.

  26. FREE TIBET! by Hektor_Troy · · Score: 4, Funny

    Limit: One per customer.

    --
    We do not live in the 21st century. We live in the 20 second century.