Slashdot Mirror
Employees the Next (Continuing) Big Security Risk?
surely_you_cant_be_serious writes "A nationwide survey finds that most companies consider their systems vulnerable to attack. Historically, crime rates increase during recessions — and some believe that cybercrime may well follow suit, especially given massive layoffs and the dim prospects many laid-off employees face in finding a new job. 'One thing companies can start doing is monitoring their networks on an ongoing basis so that they understand the normal pattern of data flow and usage, Brill said. In many cases, companies may not have the internal capability to do this, but outsourcing options are available. Kroll Ontrack, for instance, will be rolling out a 24/7 monitoring service for its global clients manned from a US location by professionals in early 2009.'"
Summary of story:
1.) Crime goes up when the economy goes into the tank and people start losing their jobs. Shocking, I know.
2.) There are plenty of security companies willing to scare your pants off in order to sell you expensive monitoring services. They will gladly use the statistic above to those ends.
Oh yah, and we'll throw a "cyber" prefix in front of "crime" to make this look like something new and different.
when employees think their employer is treating them like criminals with little more than dubious and extremely general statistics for proof.
Its amazing how fast people will start breaking the rules if you start on the premise that they already are, and treat them accordingly.
A learning experience is one of those things that say, 'You know that thing you just did? Don't do that.' - D. Adams
Move along, people. Nothing remotely new here.
Now if you want to actually do something to improve security performance, how about establishing some security metrics as a point of reference?
Parity: What to do when the weekend comes.
People have been around long before computers, and have always been the biggest risk to business.
Computers have just made it easier for employee's to do more damage, either through malicious intent or just plain negligence.
Having many SMB clients where cost is always placed over security, its scary just how vulnerable many businesses are to their employee's, from even ignoring the most basic security steps like using ACL's to secure files and basic auditing of file access, or even implementing basic password policies like "Do not give your password, to anyone, ever!"
Did anybody else read "Kroll Ontrack" in the summary as "Troll OnKrack"? Seems to describe the people who would buy that crap as well as the users who necessitate it.
Kroll Ontrack, for instance, will be rolling out a 24/7 monitoring service for its global clients manned from a US location by professionals in early 2009.
It's a good thing that Knoll Ontrack's employees are all totally uncorruptable, unlike the felons that must work for their clients...
So, let me get this straight -- Let's say Super Important Data Stuffs (SIDS) is in a database and as a company you want to protect it. But over 300 employees access that data every day. Evil Bad Hacker comes in and drops a trojan on one of those systems. A few days later, Evil Bad Hacker does a SELECT * FROM... fill in the blank... and in a few minutes it's compressed and uploaded. Super Important Data Stuffs was only 2 GB in size. How does your solution, or any solution, stop this while it's happening? Short answer: It doesn't. But you'll have a fine audit trail to give to the apathetic FBI, who will assure you everything will be done... Before promptly putting it into the circular filing cabinet.
You want your data to be less vulnerable? Stop having your servers practice unsafe hex with everyone who happens to be in the building. -_-
#fuckbeta #iamslashdot #dicemustdie
You're concerned that your employees or former employees will attempt to exploit their insider status to commit crimes against you. The most natural and obvious answer is to hire an entirely separate company, with a whole additional set of employees, and give them insider access to your network.
Most companies do have inadequate security, and many pay dearly for neglecting something so essential--they just cover it up so you don't hear about it.
But using data flows to catch insiders? A doubtful proposition. Insiders would likely steal/sabotage the data they work with daily, so it would be expected to see flows to those people.
A slashdotter who didn't build his own computer is like a Jedi who didn't build his own lightsaber.
Hire a bunch more people outside your business to snoop your network...
Wouldn,t that result in MORE people potentially tampering with your data, not less?
I don't know the meaning of the word 'don't' - J
Worried that people with access to your data might steal it and cost you money? Pay us to have access to your network! Don't worry a bit, our office is staffed by American Professionals(tm) just like the ones you are laying off and worrying about! And never mind the fact that, when the marketing hits the fan, a dead-end schlub earning jack-all to do boring work counts as a Professional(tm) if he is wearing a tie with two or fewer stains!
Seriously. Ok, employees are obviously a potential security risk, they are the ones who have legitimate access to the gates and the keys, of course there is a risk. And, in some cases, you'll get genuinely bad apples, sociopaths, paranoics with bizarre persecution complexes, fred in accounting with the gambling problem, etc. In most cases, though, you are basically just dealing with people. And people will be a lot happier, more productive, and less dangerous if you spend less money on orwellian surveillance consultants and more on them. Does anybody seriously think that an office full of bitter, resentful employees, even under the all-seeing-eye of your consultants is less of a security risk than an office full of more or less satisfied people, with standard, basic, procedures in place(particularly given that, in a lot of cases, somebody with basically no assets can do damage that cannot be repaired and costs more than they could ever repay, even if the lawsuit goes well)?
Just spy on your employees 24/7, and their friends, families.. datamine every movement they make and can them if they even think about looking sideways..
---- Booth was a patriot ----
(1) view employees purely as resources (about on level with the printers and the staples)
(2) use every possible means to make their job manageable for the Human Resources department (which is shorthand "define all tasks in such a way that every individual instantly plug-replaceable by (a) your average worker in the job market with his job title and (b) any of his colleagues, actively remove any individuality, and rather waste someone's talents than allow him to enrich his job")
(3) use HRM to "Dynamically contribute to optimization of enterprise processes and results" (translation: hire people when they are marginally qualified for their job and let their colleagues educate them, fire 'em the instant they become overqualified and aren't immediately placeable in a higher function, or if they show signs of become tired, bored, jaded, cynical, or if they catch on to what Human Resource Management really means for them)
(4) use an elaborate system of "who reports to whom", physical access checks and "security" guards, to ensure that people are total strangers in the company they work for with the sole exception of the department they work (this enhances "security")
(5) determine scientifically that your employees may spontaneously become disgruntled and hostile towards the company they work for (or after being fired)
(6) determine that the company urgently needs to protect itself from the consequences of its employees becoming disgruntled and hostile
(7) further plan employees jobs and tighten "security" so that the amount of damage any disgruntled individual below the rank of executive can do is reduced to an acceptable minimum.
The final step (8) is to spend good money to outsource security and workflow monitoring to establish tight restrictions on what employees can mess up before being physically apprehended. Outside firms have nice glossy brochures that provide your board with plenty of reasons why employees should be treated as detainees rather than as collaborators. Recommending specialized outside firms to cover specific areas of employee containment definitively establishes you as a savvy and professional manager (and keeps you in line for that end-year performance bonus).
On the other hand, the suggestion of actually treating employees as if they were collaborators confuses simple PR slogans meant for glossy company brochures with actual management. Expecting people to behave civilly when treated like people is naive in the extreme and something no manager with an ounce of professionalism should sully himself with.
Recognize this mindset? I foresee that work-flow monitoring will become a growth industry.
During the time of the big viruses hit. Oddly enough it was when outsourcing became popular for IT staff. A lot of pissed off IT unemployed IT Guys and a lot of location without people local to fix the problems. Create prime virus spreading.
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
This reads like something written by someone trying to justify even higher pay for CEOs and Execs who are already too highly paid.
Seriously, your risk factor decreases the less pay you give your senior staff and the more employees think they are valued as contributing to the company, instead of wage serfs that work for the Pharoah (oops, CEO).
I've had senior execs ask me to destroy data that shouldn't be destroyed - and I've made sure it got copied. A lawyer would say I stole the data - a smart tech would realize I was trying to keep it safe from management incompetence.
-- Tigger warning: This post may contain tiggers! --
about companies that offshore. These people have the possibility of make LOTS of money by selling what ever they can get a hold of. Verizon Business actually allowed Indians to touch several networks systems including a new one for the federal gov (it is suppose to be off limits, but managers were allowing Indians to come to America for a time and have full access to production systems). That network contains DOD and other groups on it. These foreigners are not stupid. Verizon has horrible internal network security. All that was required was to put in back doors and then access it later via remote means. Verizon, like ATT, Sprint, Qwest, etc. are in a hurry to offshore. It will be easy for China to pay these guys to access our system.
I figured out some time ago to add cameras to all offices. Then match the camera recordings with logs and suspicious activity. What I found is a lot less suspicious activity. Just the thought that they are being watched, was typically sufficient to reduce the number of people even messing around. It also seems to cut down in the screw around time, if you check browsing activity against the cameras. I also make it well known that that is what is going on. No hiding anything.
Much cheaper than sticking another boss in the room with employees.
the weakest link in any computer security are human beings.
I remember reading how some AOL employee took 26 CD-R disks, each one filled with a letter of the alphabet of data tables of AOL customers with phone numbers, addresses, bank accounts, and credit card numbers and passwords. He tried to sell it for millions but got busted by the FBI.
When I worked for a law firm, there was a department called Litigation Support that changed its name to Technology Services and competed with Information Systems. I was the main developer on a lot of software programs. My machine kept blue screening and crashing, and I installed Black Ice because it looked like someone was sending me the ping of death and ping floods. Black Ice traced the attacks to Technology Services PC systems. When I reported the fact to my boss, he told me to take Black Ice off my system. Then it started crashing again. Eventually it stopped, but I had missed a few deadlines because my computer would crash or freeze up or lose the network connection, and it wasted my time trying to develop programs. Later on I got a bad performance review, but my boss refused to listen to me about hacker type attacks from TS directed at my IP address, despite the proof I had from Black Ice logs. Apparently I think my boss was in on the sabotage because I earned too much money and they wanted an excuse to get rid of me. It really stressed me out, and I had to go on short-term disability and had to suffer from emotional and psychological abuse from coworkers and managers. I developed schizoaffective disorder, and once I came back to work, two weeks later I was fired for being sick on the job. But it all started with denial of service attacks on my IP address.
Remember, Slashdot does not have a -1 disagree moderation, and no, troll, flamebait, and overrated are not substitutes.
As has been demonstrated recently, the board of the company is the biggest threat to the continued survival of the company. Not only are many incompetent, they are often woefully out of touch and prone to making decisions to protect their bonuses rather than the health of the company (excuse me while I take the corporate jet to beg for a loan so I can continue to pay my 'bonus').
What's needed is for an application that looks over the shoulder of each board member and reports back their actions to the shareholders. THAT would be a good place for an external, outsourced company. Monitor the board 24 hours a day and analyse the data flows.
Protection from the "insider threat" was a selling point for the last two companies I worked at. BTW, I'm looking for work. Hey, if they can slashvertise, why can't I?
For all intensive purposes, "whom" is no longer a word. That begs the question, "who cares"?
From the original post:
"One thing companies can start doing is monitoring their networks on an ongoing basis so that they understand the normal pattern of data flow and usage".
The important point is not to snoop on each and every employee. Rather it is to "understand the normal pattern of data flow and usage". Which seems like a really reasonable thing to do. How can you detect an anomaly on your network when you don't know what normal is. So Joe is accessing the finance database at 10:00 on a Friday night. Is this normal? Yes if Joe works in accounting and has a history of accessing the database late at night when he works from home. No if Joe has a strict history of working 9 to 5. No if Joe works in sales and should not be accessing the finance database. How do you tell if you have no history of what "normal" is.
Now how you do something intelligent with this information is a separate matter. With the problem being that in most organizations there is a lot of legitimate non-normal traffic. If you raise an alarm every time something un-expected happens, your security group will go crazy.
I remember Marcus Ranum once saying in a talk that his biggest problem with installing intrusion detection software was that the customer would turn off the alarms. When he was called back and asked why the intrusion depiction software did not catch the intrusion, he would check the logs, find the alarm event, and discover the alarms turned off. When the customer was asked why the alarms were turned off, the would say "There were so many alarms ..."
It is hard work tuning the intrusion dejection software. When an alarm happens, someone needs to look at it. If it is allowed access, then a rule needs to be defined that characterizes the access and allows it so that an alarm will not go off the next time the event happens.
This is one sure fire way to drive yourself insane, as clearly the parent has.
Also, nice sig, loser. I am e-famous!
The dangers of knowledge trigger emotional distress in human beings.
Hey, here's a novel concept: Don't treat your employees like crap, and they're less likely to treat you that way. (not a common idea in American Big Business, I know...)