Slashdot Mirror
Porn-Surfing Execs Infecting Corporate Networks With Malware
wiredmikey writes "According to a recent survey of malware analysts at U.S. enterprises, 40% of the time a device used by a member the senior leadership team became infected with malware was due to executives visiting a pornographic website. The study, from ThreatTrack Security, also found that nearly six in 10 of the malware analysts have investigated or addressed a data breach that was never disclosed by their company. When asked to identify the most difficult aspects of defending their companies' networks from advanced malware, 67% said the complexity of malware is a chief factor; 67% said the volume of malware attacks; and 58% cited the ineffectiveness of anti-malware solutions."
It doesn't even include any of the URLs to go to!
-- Mel Brooks, "History of the World pt 1"
Laughter is the Spackle of the Soul.
and 58% cited the ineffectiveness of anti-malware solutions."
So the majority of experts agree the existing solutions are ineffective. And yet the solution remains the same: Buy more of it.
#fuckbeta #iamslashdot #dicemustdie
executives must be in to weirder stuff than most mouth breathers
The top threats listed in TFA are all common-sense things to avoid with work machines. (Visiting porn sites, letting family members use equipment, installing malicious mobile apps, and falling for phishing emails.) There is a reason us IT folks tell people not to do these things at work.
And there's a reason why the executive suite doesn't listen:
"You're not the boss of me!"
(Supported by "If anything does happen, it's your fault anyway.")
Welcome to the Panopticon. Used to be a prison, now it's your home.
I was the execs personal IT support (not my job, but hey) in the last company I worked for.
One day the CEO brought his "wife's" laptop for me to fix because it was really slow.
I had never seen so much and so varied porn on one persons computer before. I learned so much back then...
So, none of this mentions the lack of a proper security design in the Operating System. When someone says run a program, it let it use this much ram, this much cpu, and this folder.... that should be it.
But no existing commodity OS lets you do that, does it? Until capability based security becomes the norm, this will never be fixed, and information security jobs will flourish.
I've never understood why people do stuff like this. Years ago I recovered data from a CFO's laptop, only to find the thing filled with porn. Senior managers generally make enough money to have personal devices to look at porn on -- why do they risk the embarrassment of being discovered misusing company resources? I guess now that I think of it, the CFO in question wasn't fired (or even really disciplined) for this, as far as I can tell, so maybe senior managers just think that they're important enough that rules and common sense don't matter. If the laptop had belonged to a lower-level employee, he or she probably would have been disciplined.
Facts have a liberal bias.
I shudder to think of how this'll impact the BYOD policy...
Do not look into laser with remaining eye.
If employees were bypassing security, and getting their machines and the network infected en-mass via porn. One of two or both would happen:
A. A very stern email would go out to all employees regarding the issue.
B. A whole lot of employees would get canned.
Since it's executives, there will be no scolding or even talk of it. Not to mention their security for no good reason is low, so they access anything they want on the internet. It will just keeping going on. After all, this is hardly news. It's well known (at least in support) that executives have been infecting their machines and the network by the sackful for ages. When I did internal corporate IT support, I personally saw it. Over and over and over. The standard course of action? Remote into their machine, silently remark at the sheer number of porn related icons on their desktop, start removing things (toolbars too), climb around in the registry fixing all the damage the porn did, patch anything I had to, and then disconnect - walking away from the whole matter without a word. Also, these events were never properly documented to protect the executive, and therefor my job. The funny thing is, a lot of the higher ups would watch me while I was remoted into their machine, seeing everything they had been up to - they truly didn't give a shit due to their level of authority. I sometimes wondered if they got off on it. No shame at all.
Brought to you by Carl's Junior.
http://yourbrainonporn.com/
All that needs to be said...
You don't think executives don't NEED those super important "power bars", do you?
And of course execs have admin privs on their PC. They don't know what to do with it, they don't know why they got it, but don't you dare even suggesting taking it from him!
Even as the CISO you get shouted down at the management meeting when you suggest something outrageous like that. What cheek! Those dumb techdroids having higher privileges on his PC than the CEO!
Yeah, we had a good laugh.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
I am more afraid of the sexual harassment problems looming over our heads with the BYOD crap.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
They don't get fired for it.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
I work in a major Bank and the support staff tell me the senior execs are all kept in a separate isolated LAN, not because of the security of the documents they work on but because they access so much porn and torrents etc that their bit of network is riddled with crap that needs daily cleaning up. And some of the porn is very much in the jail time category.
I want a list of atrocities done in your name - Recoil
These porn-surfing execs are just taking a more "hands-on" approach to management and want to make sure they have a firm grasp on their critical infrastructure.
It gives new meaning to The Peter Principle.
You are welcome on my lawn.
Pretty much this.
One of the core reasons this problem exists in the first place is that execs insist that the rules don't apply to them. Oh sure, we have insanely tight corporate rules concerning computer usage... but of course not for C-Levels, certainly not. And their secretaries (who are collectively ignorant enough to be a security crisis all by themselves) have to be exempt, too. And while we're at it, we not only need to bypass the firewall entirely but we also need administrative privileges on our machines.
Trying to explain to them that it is a security nightmare what they're asking for doesn't help at all. This isn't about rational, logical reasons. It's purely about entitlement. Rules only apply to the plebs beneath me, but never to me. And when (not if, when) the crap backfires eventually, we'll certainly find some scapegoat to sacrifice.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Is executives trying to claim sovereign immunity to IT regulations.
Perhaps.... but this is one of the reasons IT security cannot be built from the bottom up.
IT security inherently requires management buy-in, and management has to be made to understand about leadership by example. They must be sold on it. If they themselves can't adhere to it, then they sure aren't sold on it! How could they expect their hired help to be sold on it, if they don't even agree with it?
If the manager or their family don't follow the same rules, then they are teaching other people not to follow the rules either.
Just like the family grocery store, that lets the owner's wife do her shopping, and take the goods out the back door without having to pay retail price.
The cost to the store is much higher than the price of the goods; it includes the opportunity cost, lost chances to make up for the cost, lost profit.
Customers will see it. Employees will see it. It will lead to more losses.
It will instill in the manager, their family, and those around them, an attitude that will destroy the business.
Well, if you're googling for such perverted stuff, it's your own damn fault!
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
For the pron, get a linux box please!
There is a spark in every single flame bait point.
Most CEOs don't even have all the keys to the factories and plants, and when they need access for whatever reason, they go in with someone who knows what they are doing- just in case they screw something up - press the wrong button etc.
But when it comes to IT - they just love logging in with an account with full domain admin privileges (you could create a different account for them to use if they ever need it - which could be rarely, but no, it has to be their main account).
You jest but the threat is real. We have a slew of android users who had their phone done over.
It used to be that we would tell users "don't click that link. " where now web sites like yieldmanager throw apk files at them.. which download automatically .. they install... and we have to clean their phone and explain that their phone is a small pc. Sigh. The 90's all over again.
Those who do not learn from the past.