Disinfect your Information Environment
Since information technology relies heavily on analogies (as does lot of other „cyber“ things), we have a question for you. What do an intercepted phone call, infectious diseases and nuclear waste spilling into the environment have in common? Faulty containment. The Naked Security blog explains in an article how Anonymous was able to record the FBI phone call whose audio file was published in January 2012. Apparently „an Irish Garda police officer who was invited to attend the conference call about ongoing hacking investigations forwarded the message to a personal email account“. This personal e-mail account was compromised, and the information about the conference call was used to participate and to record the audio stream. This teaches a couple of lessons.
- Conference calls can be attended by having the correct string of characters (i.e. a code or link in an e-mail).
- Interception boils down to getting the correct string of characters and to use it at the right time (so please adjust your mental images regarding the word interception, few use wires or antennas for this now).
- A string of characters was taken out of its containment and got exposed to the environment.
A lot of security researchers talk incessantly about containment in the shape of multiple barriers and defence in depth. That’s the theory. In practice convenience, mistakes, purpose and a whole of of other makes us take short-cuts from time to time. This is a combination of human nature, habit and underestimating the value of information. Packing work-related data on USB sticks or forwarding it to external accounts is wide-spread. Working from home or from being on the road has become a lifestyle. It has proven to be effective in eroding the containment security administrators have tried to set up. Unless your security staff can defend itself to this siege, your containment will always be broken. You may be lucky, but once a „satellite“ account is broken, the attackers can use the leaked information against you.
Of course this is a simplified view, but it is a good analogy which can be put to use. If habits are the problem, you probably won’t solve the problem by technological gadgets alone. Keep your reactor core tightly shut, mind the containment, deal with the waste, stay clear of outbreaks, disinfect and always remember that „everybody lies“. (Source International Movie Database and the news ☻)