The stereotype of the malicious hacker is a pale-skinned young man, hunched over a keyboard in a darkened room, who prefers the company of computers to that of people. But the most successful attackers are garrulous types who can talk their way into, and out of, almost any situation. In the words of Mr Schneier, the security guru, “Amateurs hack systems, professionals hack people.”
Kevin Mitnick, perhaps the most notorious hacker of recent years, relied heavily on human vulnerabilities to get into the computer systems of American government agencies and technology companies including Fujitsu, Motorola and Sun Microsystems. Testifying before a Senate panel on government computer security in 2000, after spending nearly five years in jail, Mr Mitnick explained that: “When I would try to get into these systems, the first line of attack would be what I call a social engineering attack, which really means trying to manipulate somebody over the phone through deception. I was so successful in that line of attack that I rarely had to go towards a technical attack. The human side of computer security is easily exploited and constantly overlooked. Companies spend millions of dollars on firewalls, encryption and secure access devices, and it’s money wasted, because none of these measures address the weakest link in the security chain.”
Human failings, in other words, can undermine even the cleverest security measures. In one survey, carried out by PentaSafe Security, two-thirds of commuters at London’s Victoria Station were happy to reveal their computer password in return for a ballpoint pen. Another survey found that nearly half of British office workers used their own name, the name of a family member or that of a pet as their password. Other common failings include writing passwords down on sticky notes attached to the computer’s monitor, or on whiteboards nearby; leaving machines logged on while out at lunch; and leaving laptop computers containing confidential information unsecured in public places.
Unless they avoid such elementary mistakes, a firm’s own employees may pose the largest single risk to security. Not even technical staff who should know better are immune to social engineering. According to Meta Group, the most common way for intruders to gain access to company systems is not technical, but simply involves finding out the full name and username of an employee (easily deduced from an e-mail message), calling the help desk posing as that employee, and pretending to have forgotten the password.
Simple measures, such as encouraging employees to log out during lunch hours and to choose sensible passwords, can dramatically enhance security at very little cost. Passwords should be at least six and ideally eight characters long, and contain a mixture of numbers, letters and punctuation marks. Dictionary words and personal information should not be used as passwords. Users should have a different password on each system, and they should never reveal their passwords to anyone, including systems managers.
Yet a seminal paper published as long ago as 1979 by Ken Thomson and Robert Morris found that nearly a fifth of users chose passwords consisting of no more than three characters, and that a third used dictionary words. (Robert Morris, the chief scientist at America’s National Computer Security Centre, was subsequently upstaged by his son, also called Robert, who released the first Internet worm in 1988 and crashed thousands of computers. Ironically, the worm exploited badly chosen passwords.) But back in 1979, only a small fraction of a typical company’s workforce used computers on a daily basis. Now that almost everybody uses them, the potential for trouble is much greater.
A few precautions also go a long way when it comes to stopping the spread of viruses. Many viruses travel inside e-mail messages, but require the user to double-click them in order to start propagating. So they pose as games, utilities, anti-virus updates or even as nude photographs of well-known tennis players. The curious user double-clicks, nothing seems to happen, and the user thinks no more about it, but the virus has started to spread. Educating users not to double-click on dubious attachments is a simple but effective counter-measure against viruses.
If correctly handled, a management-based, rather than a solely technology-based, approach to security can be highly cost-effective. The danger, says Peter Horst of TruSecure, is that: “People buy a hunk of shining technology, wipe their brow and say, ‘Great, I’ve taken care of it,’ when they might have been better off saving money and doing something simple in terms of policy and process.” Probably the best example of how expensive, glamorous security technology can easily be undermined by poor procedures is biometric systems.
A sensible and balanced approach, then, involves not only security technology but also a well-defined set of security policies which users understand and keep to. This approach is promoted by the Human Firewall Council, a group which argues that users themselves have an important role to play in maintaining security. Steve Kahan, its president, draws an analogy with neighbourhood-watch schemes. The idea, he says, is “to make security everyone’s business”, and to have a clear security policy that governs what is and is not allowed. That policy should then be implemented both by guiding the behaviour of users and by the appropriate configuration of firewalls, anti-virus software and so forth, in much the same way that a combination of neighbourly vigilance, alarms and door locks is used to combat burglars in the real world. But, says Mr Kahan, surveys show that half of all office workers never receive any security training at all.
One way to disseminate and enforce security policy is to add yet another layer of security software, as demonstrated by PentaSafe Security, one of the backers of the Human Firewall Council. Its software can ensure that users are familiar with a company’s security policy by popping messages and quiz-like questions up on the screen when they log on. According to PentaSafe’s figures, 73% of companies never require employees to re-read security policies after they begin their employment, and two-thirds of companies do not track whether their employees have read the policy in the first place.
David Spinks, European director of security at EDS, a computer-services firm, says all EDS employees have to take a regular on-screen test to ensure they understand the company’s policy on passwords, viruses and network security. Choice of technology, he says, matters far less than managing both technology and users properly: “The key to having a firewall isn’t the firewall, but how the policies are set, monitored, managed and kept up to date.” Two companies can use exactly the same product, he notes, and one can be secure while the other is insecure. It is effective management that makes the difference.
The Dismal Science of Security
But there are other, more subtle ways in which management and security interact. “More than anything else, information security is about work flow,” says Ross Anderson of Cambridge University’s Computer Laboratory. The way to improve security, he says, is to think about people and processes rather than to buy a shiny new box. Mr Anderson is one of a growing number of computer scientists who are applying ideas from economic theory to information security. Insecurity, he says, “is often due to perverse incentives, rather than to the lack of suitable technical protection mechanisms.” The person or company best placed to protect a system may, for example, be insufficiently motivated to do so, because the costs of failure fall on others. Such problems, Mr Anderson argues, are best examined using economic concepts, such as externalities, asymmetric information, adverse selection and moral hazard.
A classic example is that of fraud involving cash dispensers (automated teller machines). Mr Anderson investigated a number of cases of “phantom withdrawals”, which customers said they never made, at British banks. He concluded that almost every time the security technology was working correctly, and that misconfiguration or mismanagement of the machines by the banks was to blame for the error. In Britain, it is customers, not banks, that are liable when phantom withdrawals are made, so the banks had little incentive to improve matters. In America, by contrast, it is the banks that are liable, so they have more of an incentive to train staff properly and install additional anti-fraud measures, such as cameras.
Similar examples abound on the Internet. Suppose an attacker breaks into company A’s computers and uses them to overload company B’s computers with bogus traffic, thus keeping out legitimate users. Company B has suffered, in part, because of the insecurity of company A’s systems. But short of a lawsuit from company B, company A has no incentive to fix the problem. Some examples of this sort of thing have already started to appear. In one case, a Texas judge issued a restraining order against three companies whose computers were being used by intruders to attack another firm’s systems. The three companies were forced to disconnect from the Internet until they could demonstrate that the vulnerabilities exploited by the attackers had been fixed.
Economic and legal measures will, predicts Mr Schneier, play an increasing role in compensating for perverse incentives that foster insecurity. Just as chief financial officers are legally required to sign statements declaring that company accounts are accurate, he speculates that, at least in certain industries, chief security officers might eventually have to sign security declarations. Similarly, product-liability lawsuits against software companies whose products are insecure would almost certainly discourage software makers from cutting corners on security.
The Enemy Within
Incompetence and indifference are one thing; misconduct is another. Although external attacks get more attention in the media, notes a recent report from Vista Research, a consultancy, “the bulk of computer-security-related crime remains internal.” Mr Anderson puts it a different way: the threat of hackers, he says, is “something that the security manager waves in your face to get the budget to deal with internal fraud.” Vista estimates that 70% of security breaches that involve losses above $100,000 are perpetrated internally, often by disgruntled employees.
Attacks by insiders are potentially far costlier than external ones. The CSI/FBI survey, albeit using a small sample size, found that an insider attack against a large company caused an average of $2.7m-worth of damage, whereas the average external attack cost $57,000. A survey carried out by Oracle found that British companies believe malicious attacks by insiders pose more of a threat than external ones.
Defences against external attacks may not be much use against insiders. For a start, such people are likely to be inside the firewall (although companies are increasingly using internal firewalls between departments). And to an intrusion-detection system, an insider attack looks very different from an external one; by one estimate, an IDS has less than a 40% chance of distinguishing an insider attack from legitimate use of the network. One option is to use an analysis and visualisation tool, such as that made by SilentRunner. It represents network activity graphically to help security staff spot unusual behaviour — perhaps a large number of file transfers in a department where lay-offs have just been announced.
An alternative approach when fraud is suspected is to use “honeypots” — decoy servers that lure attackers and collect evidence so that people who are up to no good can be identified. In one case cited by Recourse Technologies, a security firm that is now part of Symantec, a large financial firm discovered that its payroll systems had been compromised. Two dozen honeypots were set up, with names such as “payroll server”, which caught the company’s chief operating officer as he was trying to manipulate another executive’s payroll record. He confessed to attempted fraud and resigned.
But the difficulty of combating insider attacks with technical means demonstrates that security is mainly a people problem. Indeed, the root cause of an insider attack may be poor management. An employee may resent being demoted or passed over for promotion, or feel underpaid or undervalued. Better management is a far more promising way to deal with these kinds of problems than technology.
The best way to prevent criminal activity by insiders is to make it difficult. “One of the key things you need is a separation of duties, so that no one individual runs everything,” says Mr Spinks. Another simple measure is to ensure that all employees go on holiday at some point, to prevent them from maintaining tainted systems or procedures. Access privileges to company systems need to match employees’ job descriptions so that, for example, only people in the personnel department can access employee records. When employees leave the company or their roles change, their access privileges must be revoked or altered immediately. And clear rules are needed to make sure that security staff know what to do if they detect abuse by senior managers. Better internal security procedures to deal with malicious insiders should also help to protect against external attacks, says Bill Murray of TruSecure.
One of the biggest threats to security, however, may be technological progress itself, as organisations embrace new technologies without taking the associated risks into account. To maintain and improve security, you need more than just the right blend of technology, policy and procedure. You also need to keep your eye on the ball as new technologies and new threats emerge.