No matter what you might think about the environment in which
your systems are running, you cannot take security for granted.
Even standalone systems not connected to the Internet may be at
risk (although obviously the risks will be different from a system
that has connections to the outside world).
Therefore, it is extremely important to consider the security
implications of everything you do. The following list illustrates
the different kinds of issues you should consider:
While you are thinking about security, do not make the mistake
of assuming that possible intruders will only attack your systems
from outside of your company. Many times the perpetrator is someone
within the company. So the next time you walk around the office,
look at the people around you and ask yourself this question:
While most system administrators' first reactions when they
think about security is to concentrate on the technological
aspects, it is important to maintain perspective. Quite often,
security breaches do not have their origins in technology, but in
human nature.
People interested in breaching security often use human nature
to entirely bypass technological access controls. This is known as
social engineering. Here is an
example:
The second shift operator receives an outside phone call. The
caller claims to be your organization's CFO (the CFO's name and
background information was obtained from your organization's
website, on the "Management Team" page).
The caller claims to be calling from some place halfway around
the world (maybe this part of the story is a complete fabrication,
or perhaps your organization's website has a recent press release
that makes mention of the CFO attending a tradeshow).
The caller tells a tale of woe; his laptop was stolen at the
airport, and he is with an important customer and needs access to
the corporate intranet to check on the customer's account status.
Would the operator be so kind as to give him the necessary access
information?
Do you know what would your operator do? Unless your operator
has guidance (in the form of policies and procedures), you very
likely do not know for sure.
Like traffic lights, the goal of policies and procedures is to
provide unambiguous guidance as to what is and is not appropriate
behavior. However, just as with traffic lights, policies and
procedures only work if everyone follows them. And there is the
crux of the problem — it is unlikely that everyone will
adhere to your policies and procedures. In fact, depending on the
nature of your organization, it is possible that you do not even
have sufficient authority to define policies, much less enforce
them. What then?
Unfortunately, there are no easy answers. User education can
help; do everything you can to help make your user community aware
of security and social engineering. Give lunchtime presentations
about security. Post pointers to security-related news articles on
your organization's mailing lists. Make yourself available as a
sounding board for users' questions about things that do not seem
quite right.
In short, get the message out to your users any way you can.
