Printable View
I am a network admin looking for articles or text files stressing the extreme importance of security. I am running into a huge problem people over me not caring about network or system security. I would truly appreciate it if anyone would give me an article that would scare the living daylights out of them.
I am so confused....do you or don't you care?Quote:
I am running into a huge problem people over me not caring about network or system security
I'll go with you do care, in which case you have a few choices.
1. Do nothing, wait until the network gets taken to its knees, then run around, stick your toungue out, and saying "neener, neener, I told you so"
2. Take down the network yourself, just to prove a point, then run around saying "neener, neener, I told you so" just to throw them off. Before you do this, make sure you have another job, just in case they don't fall for it.
3. Go to Symantec, or any virus tracking site, and show them the amount of viruses that crop up every month. Google for statistics concerning actual losses due to downtime and restoration.
Well...ehrm...you know what really really scares the living daylights out of them?
Having a virus run rampant on their network (just make sure YOU didn't introduce it ;) )
After a few days of failing services you can be sure they'll start listening.
I am sorry, it is they that dont care about network security.
There are tons of papers out there. It just depends on what and how technical you want the articles/papers to be.
Have a look at the Symantec Internet Security Threat Report here .
You may want to do some looking around at www.securityfocus.com and www.sans.org
They both have some great articles/papers there.
thank you phishphreek80, i appreciate it. I found what I am looking for.
Having a network shut down is the best wake up call possible! :) Or you can always have fun creating them strange behavior like unplugging the server ethernet cable for a hours or two and watch them run around! :)
The first time I ran spybot and spyhunter on the CEO and CIO systems the results scared the hell out of them. I guess I got their attention. They thought a firewall was enough. They don't think that any more.
I see they dont like adware or malware! O.K., now that you've got their attention, here's what you do. Get their permission to perform a complete security audit of the system. Get a couple of old boxes out and load them up similar to a production system or server and put them on an isolated subnet. Now it's time to think from the other side of the fence!
Attack the systems from both outside and inside the firewall. Try common attacks like BO or NetBus, then repackage and encapsulate them and try again. Attempt a DoS attack. Play with your ports. Attempt to brute force the firewall itself. Also, download a product like Webtrends Security Analyzer and scan the entire network for vulnerabilities.
See how they find out first...from another admin showing them the firewall logs, or from you showing them the lack of security. See how many times your antivirus doesn't alarm.
It's great fun...just don't attack your production servers (downtime sucks- so does job hunting.)
Also, make sure that no one is using any P2P software on your LAN. If they are, good idea to show them how insecure P2P is too.
Hack your own network first, before a hacker does. That way, you know where the vulnerabilities are in your system and are better prepared to counter and minimize the damage. Know your Enemy!
When you're done, make sure all your activities are clearly documented and show them exactly how vulnerable they are. Then install an IDS system, syslog servers, scanners, and apply countermeasures where you are vulnerable.
I cannot believe what I am reading in these replies. Many of these "solutions" will most likely result in instant termination of your employment and a huge hole in your resume if not land you in jail outright. Additionally the forfeiture of any CISSP/CISA type certifications you may hold.
If your company lacks a risk management department and you are really seeking extra work, develop your own risk analysis and mitigation report. What you'll need:
An index of asset values (AV) and an index of threats. Using these you'll need to determine the exposure factor (EF, what percentage of an asset will be lost as a result of the realization of a threat) and the annual rate of occurrence. (ARO, how frequently a threat will be realized)
This should leave you with several figures, your Single Loss Expectancy (SLE) which is equal to EF * AV can be calculated. The SLE * ARO = your annualized loss expectancy (ALE) or how much money you should expect to lose from a particular threat in a given year.
Now that you know how much money the risk is costing the company to a particular asset you need to determine an acceptable risk. Frequently this figure is the lowest you can get by combining the costs of counter measures and the ARO after the counter measure are in place. For example, if you have an ALE of $10,000 and you can spend $1,000 annually on counter measures (CM) to lower your ALE to $5,000 the CM are a good investment as your total risk costs is now $6,000 (CM + ALE). One the other hand if you spend $9,000 annually on CM and end up with an ALE of $2,000, your total risk cost is $11,000 which is clearly a worse investment than doing nothing.
Using this document you should be able to demonstrate to your Sr. Management that you can effectively reduce their risk costs, and Sr. Management people tend to like to save money. If this doesn't work then there is not much else you can expect, either they don't care about money or they've already had an assessement done and feel they are managing their risks correctly.
catch
Good post catch, That is something I will definately file away for future reference. The only problem I have is that it assumes the company even cares. All sarcasm aside (in case you missed it ;) ), I find that more often companies adopt the "needle-in-a-haystack" theory, and in that case you can do nothing except voice your concerns.
The company I work for regularly transmits unencrypted databases with very sensitive information. I found the problem and suggested several fixes.... that was some months ago. I even explained how burning a haystack helps you find the needle in no time, but the analogy was lost on them. There is no system of patching, or updating, or monitoring of usage.. and when spit hits the fan, I will say nothing.
I would be interested in how you compile your threat index, and how you weigh the values of each in order to plug them in to your formula. Maybe if I present it to them in that manner, it may get their attention. I'm not sure how to put a value on ID theft though.
Cheers
Companies don't care about security, they do care about money. Don't talk about security, talk about money as I stated. :)
Check out "Information Security Risk Analysis" by Thomas Peltier, it focuses mostly on qualitative analysis and Business Impact Anylysis (BIA), but it is quite comprehensive and even features work sheets to get you started.
I wront a tutorial on "Insecure Government Computers" (or something like that) for this site that I think will be handy to you. It also discusses on selecting attacks and threats to concern yourself with. :)
catch
Very True Catch,
To a majority of Companies (especially small to midsized) IT and Computer Jobs are a very complicated area for them to spend any type of money on. Most IT Jobs, pay more than the average employee in the company, and IT does not produce any type of Monetary gain or profit. All they see is, money going out for payroll, and servers, and cabling, and equipment, and blah blah blah... and nothing back.
Show them that this could in turn make their investment and money more secure...
Try showing a positive side to something if possible, like if you are trying to get a new or better firewall, maybe if VPN has not been done, show them the possibilities of like a Cisco Pix with VPN software, then they are getting security, you get your firewall, and now people can work from home.
You can make presentations, graphs, print thousands of files about security to try to scare them, but until they see it first hand, they will not open there eyes. It took the last company that i worked for until someone was hosting porn on the servers before they did anything.....
Hope some of this helps.
Good discussion and info posted here...
One selling point for security that I have been using that has been quite effective is that one aspect of security is about "keeping the systems up and online" re DOWNTIME. Ask them how much it would cost them if a security incident (re.; virus/trojan, disgruntled employee, etc) took down a whole department such as product development or sales? Or even worse if it partially crippled many departments reducing their productivity?
Then what I've done is actually show them some calculations on how much it would cost them in lost employee hours which of course is only part of the picture (ie.; does not include lost sales opportunities,etc). I will use actual incidents inside the company which disabled an employee(s) from being able to do their job(s).
I've framed the justification in the same context as UPS's to keep the servers running, building environmental controls/facilities to keep workers comfortable/content, etc etc etc. Ya know, supplying some of the bottom rung of Maslow's Triangle (re.; climate controlled space, roof over head, restroom facilities, access to water & food) so they dont focus on that and instead focus on their job.
It's been an eye opener for some of the executives and so far has been very effective.
Good luck and if you pick up any new approach not mentioned in this thread let us know - it's a constant uphill battle, never over!
Excellent reply Catch! I was not very comfortable with what I was reading too. As a newbie and a female I kept quiet about the attitude of wielding power over your company as a threat. I feel that is why I was hired as a technical resource. They trust that I have not only the technical skills but the maturity and communications skills to act positively in protecting the company and changing bad policy with tact and skill. I may be new at network administration but I find that managers will listen if you take the time to learn how to communicate to them logically and technically. My demonstration I posted earlier was a scheduled training time to justify some of my IT department budget requests. It made the point and I did not treat them like idiots. I see a lot of excellent skill posted here on antionline but I also see a lot of male ego and testosterone making some very dangerous suggestions on “teaching a business a lesson.” Thank you Catch for the willingness to point this out.
As a female I'd think you'd have an easier time speaking up. A lot of guys on this site have never even seen a real woman outside of their mom delivering them tang in their basement. ;) Seems like they'd just drool and fall over everything you say.
Seriously though, you do bring up a good point about the need for actually justifying your requested expenses. most people just try to scare sr. management or attempt to talk over their head about why they need money, and clearly this approach is a poor one. Risk analysis is good, training sessions are good. Pen testing by itself is not good, all it shows is that holes exist... well duh! Who cares that wholes exist, what is it going to cost to have one of those holes exploited? What is the likelihood if that? What is the cost of reducing those odds to a safe level? These are questions they care about. Until they are answered sr. management will and should turn a deaf ear toward you.
As far as teaching your company a lesson, just keep in mind that if it is ever realized you have done such a thing, good luck ever getting hired to work infosec ever again if you don't end up in jail, which is really where such back-stabbing individuals belong.
catch
Thank you, for you the compliment. I may be a little old fashioned but I prefer to listen before I speak. I don’t mind the drooling though, how else would we know that we females were interesting to males? :p Most guys speak gobly gook and it hard to catch the intentions of the conversation. So I quietly interpret the antics and go from there. :rolleyes:
On the serious side I will be taking your advise for my IT budget requirements presentation due soon.
I think I may have been mis-understood. Under no circumstances attempt to attack or penetrate a production network, or attempt to use any tool that you don't know how to use. I am not advocating the hacking of a production corporate network. A test network should be built to accomodate this, as any system that you attack is basically a sacrificial lamb, and should be completely re-loaded after a low-level or other data distructive disk formatting after testing is complete.
I have been a network security administrator for almost 10 years, both in the corporate and military sectors, and I have forund that the best way to find holes in your security is to actually attempt to penetrate it using the tools that the blackhats use. Keep in mind that this is not something that one should take lightly, as Catch has pointed out. If you do not know how tho use the tools and how they work, then please don't use them. You will most likely make additional problems. Also do not attempt this on anything but an isolated network (not physically attached to anything but the internet)
Provided that you know the tools, get permission from a higher authority to use them against your network, and expliain in detail to your boss(es) the risks involved, what you plan to do, etc., then you should be O.K. Notice in my post that I recommend that you set up a seperate subnet. You want to mirror your exsisting network in miniture and attempt to penetrate this isolated subnet. As stated in my last post, DO NOT USE THE TOOLS ON YOUR EXSISTING NETWORK OR PRODUCTION SERVERS. Use some old computers and servers, and just use a copy of some old backup tapes or images for data. Don't put any actual sensitive information on these systems, as we plan to hack them, and others may attempt the same and gain access to it.
As long as you do this, you will be OK legally, as it is not a crime to attack your own systems for educational purposes, as long as you have permission. Also, you will not lose your job for helping secure your network infrastructure. Just don't actually attack your production network or servers. There is a danger or leaving back doors and other holes associated with attacking a live network.
If you can't get their permission to test the waters, then there is not much you can do, unless you have a few computers you can use to simulate the network at home. Then you can do your penetration testing there, without fear of damaging any IT assets.
And for the record, I do not advocate holding power over the bosses heads by bringing the network to it's knees or using it as your technoslave! That was not my intention.
I was simply trying to say that the best way to find chinks in armor is to tesr the armor yourself using the weapons that your enemy will use in battle. It is better for you to do it than someone with less than honorable intentions.
Knowledge is power, but that power should be shared. I don't recommend hiding anything. The whole thing should be completely documented in explicit detail and filed.
“know thy enemy and know thyself; in a hundred battles you will never
be in peril. When you are ignorant of the enemy but know yourself, your
chances of winning or losing are equal. If ignorant both of your enemy
and of yourself, you are certain in every battle to be in peril.”
-- The Art of War. Sun Tzu
The point "576869746568617" was trying to make is that these are the exact same methods the blackhats will use to penetrate your system, and also the same methods most security audit firms, such as Foundstone, will use as well.
Their site, by the way, has a lot of great information, http://www.foundstone.com/
They are also authors of great books on security such as Hacking Exposed now in its fourth edition, as well as Hacking Linux Exposed , Hacking Windows 2000 Exposed , and most reciently Hacking Windows 2003 Exposed . These are a must read for any serious security admin. They go into detain on how a hack is performed, showing the actuall code, etc. as well as how to implement countermeasures to prevent or limit the damage.
Am I the only one that noticed that "576869746568617" is hex for "whitehat". It's missing a few digits on the end, assumably because the number of caharacters exceeded the max.
This thread has been refreshing.....
Although when I first strated reading I was wondering why it had not been left to die a quiet death.
The business case is always a good one to take to the managementand & catch has demonstrated an excellent way to make that case.
But there is another case worth considering as well - The statuatory obligaiton. There may exist a legal obligation to protect information held by your company. A similar caluclaion can be used resulting in anual probability of the CIO/CEO being sent to gaol based on your risk assesment.
The test that will be made legally (in the UK anyway) is whether you can demonstrate that you have taken reasonable care to protect the systems your company is responsible for.
Now this is not being stated due some peak testosterone levels just to frighten the management, but as a professional in the IT industry, my CV & reputation will be ruined if my CEO gets imprisoned because of lack of relevant investment and I haven't made them aware of the risk. Remeber, file that all important memo ;)
Steve
Coming from a similar backround (DARPA, DoD,etc.) Catch, I figured that you would know what I was getting at. Maybe it was the way I came across (like a 14 year old punk drooling at the Cult of the Dead Cow website or something). I'm just worried that you guys may think that I'm saying to just hack, hack, hack your systems, gain root, and use the power for evil. That's far from my intention. Sorry if I came across like a punk that just wanted to get someone fired. I just think that if one wants to be a great security admin, they should be able to think from the other side of the fence.
Also, I have read your paper in the past. It is a great informational resource and should definately be added to any admin's library.
Good obervation, aegis.
Here are some informational resources for you guys. There are links to "tools" as well, investigate these at your own risk. Some of them are tools of the blackhat, so I wouldn't download these onto any system that you do not own.
Hope it helps, and please, use responsably, as you will be responsable for anything you break!
Here it is. It's a .zip archive.
Also, If anyone feels the need to attempt anyhing in my posts, please read this first. Your job (and possible criminal record or lack thereof) may depend on it.
http://www.cs.berkeley.edu/~bh/hackers.html
For those who may still feel that therecommendations in my first post were irresponsible, please read the following.
Any time a trusted, secure system is accessed, a login banner should be displayed. This is common practice, especially on DoD systems. Take a look at this excerpt from the ACERT (United States Army Computer Emergency Response Team) logon Banner:
"DoD computer systems may be monitored for all lawful purposes, including to ensure that their use is authorized, for management of the system, to facilitate protection against unauthorized access, and to verify security procedures, survivability, and operational security. Monitoring includes active attacks by authorized DoD entities to test or verify the security of this system."
That is exactly what I was talking about. A responsable use of hacking, not a malacious attempt to wrest control.
Hope that clears things up.
P.S. just learned that I could Edit...Guess i should have read the F.A.Q. a little closer. Anyhow, the point that you have made, Steve, is the same one I was trying to make, just in a different, (and possibly wrong) way. Your point is well taken, and I appreciate the constructive criticism. (I guess I did, considering my lack of explination in the first post, and my repeated posts, lol.) I do appreciate the comments from Catch as well...nothing beats hard numbers.