Social Engineering

I think possibly the equal first security threat facing all business today is that of Social engineering. I say equal first, because a lot of insider threats would probably fall under this banner. The employee, lets say his name is John calls up the helpdesk, he tells them his name is Sam, and that he has forgotten his password. You of course see where I am going with this, the helpdesk happily resets Sam's password, John knows Sam is out to a long lunch and has access to files he doesn't. He logs in as Sam, gets the files he needs and then logs out, maybe even leaving a post-it on Sams screen saying the helpdesk had to reset his password to blah, so the helpdesk doesn't get another call and get suspicious.
John know has all the files on his cheap USB disk, or in hard copy and does with them whatever it is nefarious people do with data to make a buck.
I have seen mitigation techniques for the one I mentioned above, all users have a password reset word, something they wouldn't have as a password and stored in plain-text for the helpdesk to see. This will mitigate it, unless John says he forgot it and to send someone down, the helpdesk guy may not know John or Sam, and as long as John is in Sam's office still acting like he owns the place he will probably get away with it.
Social Engineering is scary for another reason in that even non-technical users can do it. I remember I had a client once who had a relitively new employee call up asking for some permissions to files he needed for work. I knew his role was to do with those files and I knew his voice over the phone (as funnily enough he had moved from one client to another). Still I decided to call his manager to get the ok. She didn't give it, and was a bit distrubed that he had asked for the access. Horray one for the good guys.
Have a look here at how easily some guys doing a sprite commercial pulled off some non-harmful social engineering.
Here is a very thourough article on the subject.
And here is my first shirt design on cafepress, totally on topic.
Really though combine some social engineering with technical knowledge the smarts to think of the good-guys mitigation techniques and the connections to make money off your exploits and you have a major foe to be reaconed with.
I think in future we will need to audit our people as much as we do our security systems. Having someone who won't suffer the repricussions of the law come in randomly and do spot checks would keep people on their toes, but it also comes down to having the personal touch, knowing people by name, by their voice, by their face. Maybe the solution is smaller decentralised IT departments, say one for each department and at least one at each site, this lessens the body of knowledge but increases the likelyhood of the staff member knowing the other. I don't know, someone will come up with a solution eventually.

Lets get Physical

On the way back from a very interesting an informative Microsoft Security Summit the other day and I noticed something that caught my eye.
Too many people concentrate on the hardware and software, and leave gaps. Gaps in the physical security, or gaps in the training of staff.
This photo shows off both.

Seems a cleaner at the train station near me had left the door open to the area that she kept her cleaning supplies, the same area that had a rack with server, fibre switch, ethernet switch, patchpanel and other miscelania. Whats that you spy, yep the rack door is unlocked too. Click click and a bad guy is on the network, just plug in a wireless router and see what traffic you can capture, doesn't matter if this network is firewalled the best in the world, or even airgapped, game over.
Back on the security conference I attended it was very interesting, it was all covered under an NDA, except the bit at the end which I already talked about. I am starting a security group in Sydney, sponsored by Microsoft. So Jeff Alexander let everyone know, I had a heap of business cards handed over for people that wanted to be kept in the loop, it is very exciting that we have this much interest already.
Well Peace out all, and please lock your racks and don't put them in a room with a sink for the cleaner to use.

Sydney IT Security Group

So I had a chat with Jeff about starting up a Security group in Sydney similar to counterparts in Canberra,Melbourne, and Brisbane.
It is really a great opportunity and I have been looking for a security group in Sydney for years now, making do with going to security topics at other groups. I don't think it will detract from these other groups just expand on the security theme, going places other groups may not want to go as they are too focussed.
I'd like to get some comments here on what people would like to see and what night etc, but people rarely comment on my blog. So I will setup a site for the group shortly and we can duke it out there.
Peace out all.