[iwar] [fc:Analysts:.Insiders.may.pose.security.threat:.Employees.with.access.to.IT]

From: Fred Cohen (fc@all.net)
Date: 2001-10-17 21:34:01

Next message: Fred Cohen: "[iwar] [fc:Russian.military.suspected.as.source.of.anthrax]"
Previous message: Fred Cohen: "[iwar] [fc:Suddenly,.Small.Gaps.In.Nuclear.Security.Are.Starting.To.Look.More.Like.Chasms]"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Message-Id: <200110180434.VAA07248@big.all.net>
To: iwar@onelist.com (Information Warfare Mailing List)
Organization: I'm not allowed to say
From: Fred Cohen <fc@all.net>
Mailing-List: list iwar@yahoogroups.com; contact iwar-owner@yahoogroups.com
Precedence: bulk
Date: Wed, 17 Oct 2001 21:34:01 -0700 (PDT)
Reply-To: iwar@yahoogroups.com
Subject: [iwar] [fc:Analysts:.Insiders.may.pose.security.threat:.Employees.with.access.to.IT]
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit

Analysts: Insiders may pose security threat: Employees with access to IT
systems may have opportunity to create havoc 
By Dan Verton, ComputerWorld, 10/17/2001
<a href="http://www.computerworld.com/storyba/0,4125,NAV47_STO64774,00.html?OpenDocument&~f">http://www.computerworld.com/storyba/0,4125,NAV47_STO64774,00.html?OpenDocument&~f>

As intelligence and security officials sift through mountains of
intelligence data about new terrorist threats in the wake of U.S.
retaliatory strikes against terrorist targets in Afghanistan,
cybersecurity experts are urging companies to change the way they think
about enterprise security. 
The Sept. 11 attacks on the U.S. had little impact on critical
government and business networks. But any future attacks against U.S.
companies, which own and operate most of the nation's critical
infrastructure systems, may be different. And company insiders -
employees with access to IT systems - pose a particular threat, security
experts warn. 
"Everyone's security policies will have to be re-examined in light of
Sept. 11," said Steven Aftergood, a defense and intelligence analyst at
the Federation of American Scientists in Washington. 
"Scenarios that might have seemed improbable and far-fetched will need
to be reconsidered," he said. "Background investigations of key
personnel may be a part of the response." 
As U.S. retaliatory actions continue, the government is worried about a
wide range of possible future threats to private infrastructure from
individuals who may already be in this country legally, said Vince
Cannistraro, former chief of counterintelligence at the CIA. 
"The FBI believes there is a significant threat to infrastructure in the
U.S., especially since they have been unsuccessful in identifying and
locating presumed members of at least two five-person cells that remain
at large," he said. 
The government's concern stems from the lack of information on the
number of terrorist support cells and sympathizers who may have entered
the U.S. during the past five years. Over the course of its
investigation, the FBI has detained 614 people and recently narrowed its
focus to 220 of them. But terrorism experts claim that there may be many
others who aren't on anyone's radar screen. 
A Blind Eye 
Winn Schwartau, an information warfare specialist and president of
Interpact Inc. in Seminole, Fla., said companies and government
agencies, particularly the U.S. Department of Defense (DOD), have in the
past turned a blind eye toward the number of foreign nationals who have
been granted administrative access to sensitive networks without a
proper background investigation. 
Schwartau has briefed corporate CEOs and senior generals at the Pentagon
about the problem, but most have been unwilling to tackle the issue
because of political sensitivities, he said. 
The problem in government has been compounded by software glitches in
the system used by the Defense Investigative Service to manage security
clearance investigations. The software problems last year caused a
logjam of 600,000 pending investigations. 
The number of pending cases as of Oct. 5 was 262,000, involving both
civilian and military personnel, a DOD spokesman said last week. The
department expects to eliminate the backlog by next September, he said. 
Nonetheless, security experts agreed that the internal threat is real.
Disgruntled employees and other insiders with legitimate access to
critical business networks accounted for more than 80% of the
cyberattacks against companies last year, according to a survey
conducted by the FBI and the San Francisco-based Computer Security
Institute. 
Jim Williams, director of security solutions at Solutionary Inc., a
managed security services firm in Omaha, said that it's important that
companies train and educate their employees about the rules governing
network access. 
Since Sept. 11, awareness has increased, as have efforts to beef up
building security, said Williams, who has also served as a member of the
FBI's San Francisco Computer Crime Squad. 
"There's a realization under way that you can't have network security
without physical security," said Williams. You have to know that the
people coming into your company are supposed to be there and are
authorized to be on your network, he said.

------------------
http://all.net/ 

Your use of Yahoo! Groups is subject to http://docs.yahoo.com/info/terms/

Next message: Fred Cohen: "[iwar] [fc:Russian.military.suspected.as.source.of.anthrax]"
Previous message: Fred Cohen: "[iwar] [fc:Suddenly,.Small.Gaps.In.Nuclear.Security.Are.Starting.To.Look.More.Like.Chasms]"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

This archive was generated by hypermail 2.1.2 : 2001-12-31 20:59:55 PST