Security Team Practices Theft by Delusion
A key modem disappears from a high-security area. A case of BlackBerry devices disappears in transit. These tales of apparent theft take an unexpected twist.
Computerworld - We've been robbed!" That a modem had been stolen right from under our noses seemed unlikely at first, but as the IT security team and I frantically searched for it, I declared that it could be the only possible explanation. The annual audit was only days away, and we had to double-check all of the modem phone numbers before the auditors descended upon us. We needed to document the numbers to keep them satisfied.
Specifically, we were about to be audited on our perimeter network security. The audit team would be checking our firewalls, proxy servers and, most importantly, dial-up security.
The risk of an unsecured modem is still high for my company. In the past, the risk came from users wanting to bypass corporate controls and get unfettered Internet access by dialing in from home. Now most employees have broadband and no longer try to do this. On the other hand, more and more systems come with dial-up connections to allow vendors to manage them remotely. Vendors have been driven by increasingly stringent service-level agreements for performance and a desire to help customers without the expense of sending an engineer on-site. These days, it's rare for any of our large disk storage arrays or Unix systems not to have a trailing phone line behind the box.
We regularly call every number on our exchange and check what answers and how difficult it is to guess a working password. We hadn't done a scan in a while, and in the last few days before the audit kicked off, we wanted to run a quick test before the auditors did.
But we needed a modem, and ours wasn't to be found. The IT security department is supposed to be a high-security area, but many other staffers have access. We wondered if one of them had made off with our modem. Rather than waste time asking everyone with access to our area about this, we decided to view the closed-circuit television footage of our work area.
So my team went down to the physical security office and asked to view the tapes. There was an enormous collection, so it took about 10 minutes for each tape to be pulled from the archive and loaded. We started with tapes from a few weeks back. The modem was clearly visible, sitting neatly on top of one staff member's computer. Then we pulled a tape from a week ago. Although a few papers had collected in front of the modem, it was still clearly visible.
We continued to pull tapes, steadily
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The 12 PCI DSS 3.0 requirements addressed by Peer 1 Hosting This handy quick reference outlines the 12 PCI DSS 3.0 requirements, who needs to be compliant and how Alert Logic solutions address the...
- Defense Throughout the Vulnerability Life Cycle This whitepaper provides insight into how to leverage threat and log management technologies to protect your IT assets throughout their vulnerability life cycle.
- Mobile Policy Checklist Here's what to consider when putting together a mobile policy designed to support a highly productive workforce.
- Securing BYOD Mobile computing is becoming so ubiquitous that people no longer bat an eye seeing someone working two devices simultaneously. Individuals and organizations are...
- Live Webcast On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy...
- Live Webcast Endpoint Backup & Restore: Protect Everyone, Everywhere Arek Sokol from the bleeding-edge IT team at Genentech/Roche explains how he leverages cross-platform enterprise endpoint backup in the public cloud as part...
- Streamline Software Asset Management, Compose a software Management Symphony Keeping track of your organization's software is easy with effective software management solutions from CDW. View the videos in our software solutions channel
- Druva inSync: Endpoint Data Protection & Governance CLICK HERE to watch this video about protecting corporate data on laptops and mobile devices, sponsored by Druva. All Security White Papers | Webcasts