4 ms·

With the active recruitment of low level support/engineering insiders as saboteurs what is the right way forward? More security or a better work environment?

notadev 5y ago
Maybe auditing. When I was a wee lad on American Online in the 90s, our biggest desire was to steal the most 31337 screen names. One way of doing this was learning of people who worked at the call centers you’d call for account problems. Once you were friendly enough, you could sometimes convince them to pull an account’s information for you. Then you’d call the call center from a pay phone and, using the stolen information, reset the password. This allowed you to get on the account for a while to brag. In some cases, you could permanently steal the AOL Instant Messenger (AIM) version of the screen name unbeknownst to the original account owner. Anyway, AOL recognized this insider threat and audited and reviewed any access to their internal account systems (called CRIS or Merlin IIRC), which pretty much killed the method of using insiders since they were caught and fired pretty quickly.
wildrhythms 5y ago
A lot of engineers will hyper-focus on building some labyrinthine security system to try and thwart employees leaking credentials, but understanding WHY an employee will willingly compromise their credentials is the true starting point. Phishing attempts may seem obvious to the tech-literate, but the average office or call center worker is probably more focused on pleasing their manager or not hurting their customer feedback rating than focusing on security. Maybe employees don't know about where to direct security concerns? Maybe they've had a negative interaction with the IT/security team at some point in the past? At a previous employer the security team would periodically send out a wave of phishing attempts to employees to see how they would react.

notadev 5y ago

Maybe auditing. When I was a wee lad on American Online in the 90s, our biggest desire was to steal the most 31337 screen names. One way of doing this was learning of people who worked at the call centers you’d call for account problems. Once you were friendly enough, you could sometimes convince them to pull an account’s information for you. Then you’d call the call center from a pay phone and, using the stolen information, reset the password. This allowed you to get on the account for a while to brag. In some cases, you could permanently steal the AOL Instant Messenger (AIM) version of the screen name unbeknownst to the original account owner. Anyway, AOL recognized this insider threat and audited and reviewed any access to their internal account systems (called CRIS or Merlin IIRC), which pretty much killed the method of using insiders since they were caught and fired pretty quickly.

wildrhythms 5y ago

A lot of engineers will hyper-focus on building some labyrinthine security system to try and thwart employees leaking credentials, but understanding WHY an employee will willingly compromise their credentials is the true starting point. Phishing attempts may seem obvious to the tech-literate, but the average office or call center worker is probably more focused on pleasing their manager or not hurting their customer feedback rating than focusing on security. Maybe employees don't know about where to direct security concerns? Maybe they've had a negative interaction with the IT/security team at some point in the past? At a previous employer the security team would periodically send out a wave of phishing attempts to employees to see how they would react.