Slashdot Mirror
Nine Ways to Stop Industrial Espionage
An anonymous reader writes "IT staff are in the unique position that if they are nosy, immoral, greedy or corrupt that can get at what they want within their company at the touch of a button. The corporate crown jewels are usually left open and exposed to the IT guys. So how do you protect your corporate crown jewels from staff that can so easily be bribed to steal them and hand them over to a competitor?" I can't imagine having to be paranoid about employees. That seems to me to be a bigger problem than hardware.
Backed up data is especially vulnerable. In many environments, while lot of work is done on network security, secure management of backup data is not given due concern. Since backup data has sometimes all of the important information at a single place, it is a juicy target for espionage. Data should be encrypted while moving to a backup sever (especially while using a online backup service over the internet) and definitely encrypted while it is stored on the backup media (tape, CDs etc.).
Amanda: Open Source Backup Software
A company is worthles without it's employees. Select good people, pay them well and treat them fairly. Next question... How do you remove paranoid executives from positions of power and stop them from inflating operating costs through needless and morale busting authoritarian technology.
"Don't you know you're going to shock the monkey?"- Peter Gabriel
It also says to completely seperate the outside and inside network, which means that employees have no email, no google, no internet access at all.
It mentions nothing about compartmentalized access rights to various databases, with a different division of admins having responsability and access to only their systems.
In fact, all it does talk about is transmission interception (which is much less common than those problems mentioned above), and data security.
People try to make everything a technical problem, which is really the wrong approach. This ain't something you're gonna fix with fancy access control and slick hardware. No matter what you do (separation of duties, cryptography, trusted operating systems), all you'll succeed in doing is making life more annoying for your regular users, and demonstrate a huge lack of trust of your employees.
If you really want a solution, it's got to be as much policy as it is technology. I'd start with, oh, making your employees sign an NDA, and making sure they're aware of what is a company secret (most companies like Apple, Sun, IBM, etc, have classifications just like the government, e.g. "Apple Secret", "Sun Top Secret"). Make sure they know what those secrets mean, e.g. "Our documents labelled Top Secret will probably cause us to lose our dominant position in the market if leaked." Then, you implement auditing on your data storage. If your IT guys start reading company business strategy memos off the file server, you probably won't catch them when it happens. But if it becomes obvious that those memos were leaked, you can go back through the audit logs and see if anyone read them that shouldn't have, and act appropriately (though don't just assume that that person leaked the info).
Bear in mind that the technical part of this 'solution' will probably fail. What you're trying to do is paradoxical. You're saying, "I ultimately trust these guys with the security of all of my information, but I don't completely trust them with the security of all of my information."
The Right Reverend K. Reid Wightman,
Putting locks on the doors is not paranoia - indeed it prevents paranoia.
Putting locks on doors is a reasonable preventative measure that keeps honest people from opening them. It does not "stop industrial espionage."
TFA is Slashdotted, but the impression I get from the summary is that it's written from the mentality of trying to have a workplace that's protected against *dishonest* employees. Completely protecting against them is impossible. Making it extremely difficult for them to commit industrial espionage is possible, but the result is a workplace that isn't very fun - I know someone who used to work at the NSA, which obviously has similar protection concerns, and I'd never be able to put up with the level of surveillance and security they have.
I'm with CmdrTaco - hire people you think you can trust. If you're proven wrong, fire them. Don't give people access to sensitive data until they've proven that they're trustworthy, and if you have something that can't leak outside the company no matter what, don't put it somewhere that anyone else can get to it.
"...always new atoms but always doing the same dance, remembering what the dance was yesterday." -Richard Feynman
Espionage is a real concern. But the solutions in this article are worse than the problem. THe real solutions include:
1) Mandatory Access Controls (for example SELinux) on systems that hold confidential information.
2) Data encryption for confidential information using public/private key encryption. AES is NOT an answer here though you can use it for session encryption with Diffie-Hellman, etc. if necessary.
3) Training and loyalty of employees is critical.
4) Separation of duties, powers, and responsibilities.
But I guess this is harder than just throwing technology at such a problem.
LedgerSMB: Open source Accounting/ERP
Studies have shown the most effective deterrent to theft is moral/ethical. If an employee has a good relationship with the company and their managers then they are unlikely to steal from the company, even if they know they won't be caught. If you treat your employees well, are understanding about their problems, and cultivate your relationship you have little to worry about. Talk to them and learn what their goals are and help them achieve it. Do they want to move up into management? Do they want to go to night school and become a programmer or a public relations person? Help them do it. If your employee has money problems, you should be the first person they come to, confident that you will help them work it out either with financial counseling, a pay raise, saving them money by letting them telecommute, or even loaning them the money they need and repaying it from their wages. You employees should not live in fear of being fired or laid off. If they aren't working out they should know you will talk to them and come up with either a new position for them in the company or help them find work elsewhere, while keeping them on in the mean time. Employees should know they are trusted, for breaking that trust is a deterrent. Employees should have a stake in the company, either stock or a bonus plan so they feel their hard work and good behavior means something.
If all of the above is taken care of, you employees will be a lot less likely to steal or do anything else to put the company out (like quit without notice). There is always the rare anti-social personality disorder, but that is a pretty rare case. If, however, you develop a "strictly business" relationship with your staff that is mercenary and impersonal you may have problems. When people don't care about their employer or dislike their employer and feel that they are in danger of being fired at any time, or their job outsourced, they will respond in kind. If the only reason you pay them is because it makes you more money in the long run, why shouldn't they sell the customer database or source code? If you hire mercenaries and treat them like mercenaries, don't be surprised when they act in their own best monetary interest.
If you decide to treat your employees like you are at war with them and need to be defended against them, you're likely to have more problems than any technical solutions you implement will benefit you. There are products that will build a relational model of your network and log all traffic and access to resources based upon DHCP IDs and the like. Between such a system and a good set of untouchable logs for your access controls you can develop an independent group to monitor your staff. If you really need it though, your company is already pretty doomed as your employees probably don't care anyway and are just doing the minimum necessary to get paid.
Hire honest staff and treat them like human beings so they're not inclined to rip you off. If you catch someone ripping you off, press charges.
You can also create audit trails logging to multiple machines, each controlled by a different employee so that a conspiracy would be needed to avoid being caught. Reading and understanding those logs is, however, very expensive. Its also the kind of mind-numbing job that could leave an otherwise honest IT employee open to committing theft.
Moderating "-1, Disagree" is simple censorship. Have the guts to post your opinion.
But back in reality land, sometimes things go wrong. People are not always what they appear to be, and a good employee can sometimes become embittered. Assuming otherwise is naive, and perhaps a little arrogant. Are you such a good judge of character that you can pick out the sociopaths from the crowd? Might I suggest you aren't.
And apart from malfeasance, sometimes people make mistakes. Sometimes they type "rm -r *" when they are not in the directory they think they are in.
I'm not suggesting massive security measures, but reasonable steps can go a long way. Even moderate security is worthwhile and, I think, appreciated by the employees.
P.S.: CD stands for CmdrDaco (apparently). Apologies to CT.
Well, one way would be to not treat them like crap. Sorry to say, the IT people shoulder the brunt of user frustration. And maybe that's part of the job. But between being bitched at by morons who are probably the cause of the initial problem, being on-call whenever, wherever, and living with the constant fear of contractual replacement (as is the case in many support positions) or just plain old outsourcing. . . look. Businesses don't want to deal with the fact that their employees are people. You can't put that on a quarterly report, and it's not really something that most company policies I've come across takes into account. But the ONLY way you're ever going to keep that sort of information secure is to make sure that your IT people wouldn't even dream of stealing it, tampering with it, or auctioning it off to the highest bidder. You have to make sure they don't want to do that kind of thing. And when you're trying to build loyalty and trust, the carrot goes a lot farther than the stick.