4 ms·

Taking classified data away from the organization in question may not be trivial. Email is probably monitored, using USB storage is probably not allowed, printe

Taking classified data away from the organization in question may not be trivial. Email is probably monitored, using USB storage is probably not allowed, printers are probably monitored as well, CDR drives might not be readily available, internet access is probably quite limited and monitored.

jlgreco 13y ago
On the other hand, he was apparently a system administrator of some sort so perhaps he had ways of getting data out of their system that other employees would not have had available to them.
- JonFish85 13y ago
  If he was a systems admin, there were undoubtedly other system admins around to keep an eye on each other. If he got data out, he likely walked out with it physically in some way, or there was a severe breakdown in the network security.
  - jlgreco 13y ago
    > If he was a systems admin, there were undoubtedly other system admins around to keep an eye on each other. Of course. The question is are sys-admins as effective at watching other sys-admins as they are at watching regular users? It seems reasonable that they are not, if only because sys-admins are more skilled than other users. Sys-admins likely also implicitly trust other sys-admins more than other users, not intentionally of course, but enough to bias their ability to see things.
    - Someone 13y ago
      That's why you frequently deploy moles who try to get away with something (e.g, with writing a password on a post-it), and seriously reprimand persons who do not report that. All your personnel must be paranoid; you cannot get there with only the real break-in/data theft attempts, as those are too rare. Also, you regularly shift the roles, turning an operator into a watcher and vice versa. Finally, you cannot have someone teamed up with the same person for weeks, because they might befriend each other and start to let things slip.

jlgreco 13y ago

On the other hand, he was apparently a system administrator of some sort so perhaps he had ways of getting data out of their system that other employees would not have had available to them.

JonFish85 13y ago
If he was a systems admin, there were undoubtedly other system admins around to keep an eye on each other. If he got data out, he likely walked out with it physically in some way, or there was a severe breakdown in the network security.
- jlgreco 13y ago
  > If he was a systems admin, there were undoubtedly other system admins around to keep an eye on each other. Of course. The question is are sys-admins as effective at watching other sys-admins as they are at watching regular users? It seems reasonable that they are not, if only because sys-admins are more skilled than other users. Sys-admins likely also implicitly trust other sys-admins more than other users, not intentionally of course, but enough to bias their ability to see things.
  - Someone 13y ago
    That's why you frequently deploy moles who try to get away with something (e.g, with writing a password on a post-it), and seriously reprimand persons who do not report that. All your personnel must be paranoid; you cannot get there with only the real break-in/data theft attempts, as those are too rare. Also, you regularly shift the roles, turning an operator into a watcher and vice versa. Finally, you cannot have someone teamed up with the same person for weeks, because they might befriend each other and start to let things slip.