Skip the navigation

Security Team Practices Theft by Delusion

A key modem disappears from a high-security area. A case of BlackBerry devices disappears in transit. These tales of apparent theft take an unexpected twist.

By Vince Tuesday
May 24, 2004 12:00 PM ET

Computerworld - We've been robbed!" That a modem had been stolen right from under our noses seemed unlikely at first, but as the IT security team and I frantically searched for it, I declared that it could be the only possible explanation. The annual audit was only days away, and we had to double-check all of the modem phone numbers before the auditors descended upon us. We needed to document the numbers to keep them satisfied.
Specifically, we were about to be audited on our perimeter network security. The audit team would be checking our firewalls, proxy servers and, most importantly, dial-up security.
The risk of an unsecured modem is still high for my company. In the past, the risk came from users wanting to bypass corporate controls and get unfettered Internet access by dialing in from home. Now most employees have broadband and no longer try to do this. On the other hand, more and more systems come with dial-up connections to allow vendors to manage them remotely. Vendors have been driven by increasingly stringent service-level agreements for performance and a desire to help customers without the expense of sending an engineer on-site. These days, it's rare for any of our large disk storage arrays or Unix systems not to have a trailing phone line behind the box.
We regularly call every number on our exchange and check what answers and how difficult it is to guess a working password. We hadn't done a scan in a while, and in the last few days before the audit kicked off, we wanted to run a quick test before the auditors did.
But we needed a modem, and ours wasn't to be found. The IT security department is supposed to be a high-security area, but many other staffers have access. We wondered if one of them had made off with our modem. Rather than waste time asking everyone with access to our area about this, we decided to view the closed-circuit television footage of our work area.
So my team went down to the physical security office and asked to view the tapes. There was an enormous collection, so it took about 10 minutes for each tape to be pulled from the archive and loaded. We started with tapes from a few weeks back. The modem was clearly visible, sitting neatly on top of one staff member's computer. Then we pulled a tape from a week ago. Although a few papers had collected in front of the modem, it was still clearly visible.
We continued to pull tapes, steadily



Our Commenting Policies
Internet of Things: Get the latest!
Internet of Things

Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!