Computerworld - During the past year and a half, I've written about many of the ups and downs of being an information security manager. I've been open about most issues, but I've never mentioned one big event because—until recently—we hadn't resolved it.
About a year ago, we detected unauthorized access to an internal system. The attack could have been carried out only by an insider or by an external attacker who had working internal credentials.
It started one morning when a sales staff member came in to find that her desktop had changed overnight. She'd left her machine locked using a password-protected screen saver, but when she returned in the morning, her e-mail client was open and her browser had been taken to AltaVista Co.'s Web site.
At first, we didn't believe her. We receive a small but regular number of alerts from staffers who think that the slightest unusual machine behavior proves that an evil hacker has taken over their machines. We have a physical access-control system that requires magnetic swipe cards at all doors in our building, so it's unlikely that an unauthorized person could have gained physical access to the user's system.
Our initial hypothesis was that the user had left her screen unlocked or had opened the applications herself before she left.
Because all Web access goes through our proxy server, we can trace activity back to a user and a desktop and extract the time of access from our logs. We use a proprietary screen saver that downloads news items from the Web and displays them on locked screens.
THISWEEK'SGLOSSARY
MD5 hashes: RSA Security Inc. in Bedford, Mass., created the MD5 algorithm as a means to secure encrypted communications. The National Drug Intelligence Center (NDIC) in Johnstown, Pa., uses the HashKeeper forensic database to establish a unique 128-bit identifier that creates a signature for specific, known files.
LINKS:
Is it an inside job? In the San Francisco-based Computer Security Institute’s “Computer Crime and Security Survey,” 70% of 538 respondents cited their Internet connections as a frequent point of attack - but 31% also cited attacks coming from their internal systems.
The NDIC’s HashKeeper Web site has established a Microsoft Access database of unique identifiers, or “hash values,” of known files for forensic use. Unfortunately, the database is available only to law enforcement authorities.
Christchurch, New Zealand-based KeyGhost Ltd.’s keyboard sniffer records keyboard activity. It would have been useful in my investigation, but it works only with keyboards using a PS/2 connector, not the USB device attached to our Compaq systems.
Security is not an option. This KnowledgeVault Series offers professional advice how to be proactive in the fight against cybercrimes and multi-layered security threats; how to adopt a holistic approach to protecting and managing data; and how to hire a qualified security assessor. Make security your Number 1 priority.
New IP-based communications systems are being deployed by small and midsized businesses at a rapid rate. Learn how these organizations are enabling faster responsiveness, creating better customer experiences, speeding office or mobile interactions, and dramatically reducing existing communications costs.
GroupLogic's new activEcho is the industry's only secure Enterprise File Sharing and Synching solution that balances the need for simplicity for the end...
Enterprises and IT departments need to address several critical security issues when considering file sharing and syncing products. Many of today's solutions do...
Cloud security considerations span protecting hardware and platform technologies in the data center to enabling regulatory compliance and defending cloud access through different...
The presentation provides an overview of BlackBerry PlayBook OS 2.0 security capabilities and features, including: BlackBerry® Balance™ technology, BlackBerry® Bridge, data-at-rest protection, and...
The presentation on NFC security will provide an overview of the security protections built into the BlackBerry platform to protect users, application developers...
When it comes to disaster recovery, rapidly growing data volumes, distributed computing models, and new technologies all combine to present an ever-changing playing...
Free Insider Guide