Enemy At The Water Cooler 148
Trent Lucier writes "On most networks diagrams I've seen, the internet looks like a cloud. Sometimes it's a fluffy white cloud. Other times it's a dark ominous cloud. Regardless of the artistic style, the depiction usually conveys the mystery and danger of putting your company's network on a global information grid next to a billion users, kind of like those old maps with dragons drawn at strategic places in the ocean. Not surprisingly, corporations spend much time and energy protecting themselves from The Outside World. In Enemy at the Water Cooler, Brian Contos argues that just as many resources should be spent on defending against insider threats. Will this book help you detect the enemies at your water cooler?" Read below for the rest of Trent's review.
| Enemy at the Water Cooler: True Stories of Insider Threats and Enterprise Security Management | |
| author | Brian T. Contos |
| pages | 302 |
| publisher | Syngress Publishing |
| rating | 8 |
| reviewer | Trent Lucier |
| ISBN | 1597491292 |
| summary | A thorough introduction to insider threats and the countermeasures that can be used against them |
Contos, a Chief Security Officer himself, has written a primer on insider threats and the counter-measures that can be deployed against them. The book is written for a wide audience, so don't expect low-level details about encryption algorithms and security protocols. However, if you have to deal with a large company's IT infrastructure, you may benefit from Contos' descriptions of enterprise security concepts and anecdotes.
According to the book's terminology, an insider is someone who has more privileges than the common person and uses those privileges to abuse the system. It's important to understand the full scope of the term "privileges". In addition to computer privileges, Contos is also talking about physical access to hardware, paperwork, and even other employees that can be exploited in social engineering attacks. Even if a piece of information is useless to the insider, it may be something that a competitor would be willing to buy for the right price.
The early chapters provide background on all the standard attacks that are in the news these days: phishing, denial of service, keylogging, etc... What makes these sections interesting are the statistics that are sprinkled throughout the text. In a survey conducted by CERT examining known attacks, 49% were committed by insiders that were married. This goes against the profile of the insider being someone who has less personal risk (such as a family) at stake. In fact, the prevailing image of the last 30 years depicting a computer criminal as a socially awkward young male has started to become less accurate as organized crime has turned into the biggest threat.
Enemy At The Water Cooler does a great job of putting statistics in context. The book is always careful to mention that the crime statistics represent only the known incidents. Contos often explains why certain numbers matter. Near a chart showing that 59% of discovered crimes were committed by former employees, the author explains that recently fired employees can be highly motivated to commit revenge and still have access to accounts and passwords, which is a dangerous combination.
How does the book propose that businesses deal with threats? At the end of Part I, Contos introduces a technology called Enterprise Security Management (ESM). This is a blanket term used to describe a collection of enterprise-level tools that can perform information analysis, display event feeds, manage policies, and do everything else in the world besides make toast. The remainder of the book constantly mentions this technology, so if you are not interested in learning about ESM, this book may not be for you.
At this point, it should be noted that Brian Contos is the Chief Security Officer of a company that sells ESM products. The book is neutral on which product you should use, although some screenshots show Contos' program for illustrative purposes. I did not feel that the book was biased or trying to sell me something. Regardless of who the author works for, he makes a compelling argument that ESM systems are necessary for big companies that need to manage their IT security.
Case studies comprise Part II of the book. This is the entertaining stuff, and probably the type of thing most people want to read when they pick up a book called Enemy At The Water Cooler. There are 8 main case studies, each running about 5 pages in length. Contos puts the "study" in "case study" as he illustrates how tools (ESM) and training could prevent many of the scenarios he describes. Those expecting light reading in the form of amusing anecdotes about IT security will be disappointed. However, if you're looking for a detailed analysis of insider crime, these chapters provide it.
Many times, greed and hubris are the ultimate undoing of the insider. In one example, a company discovered that their servers were hosting pirated software. Little did the company know that the employee that was asked to clean up the server was actually the one who put the software there to begin with. The insider would have gotten away with it if only he hadn't bragged to a co-worker about how dim-witted his company was.
In other situations, employees can be blackmailed into committing crimes. In the case of a Spanish company, an employee was forced into planting a wireless access point in one of the development labs. The employee had lied about his educational background on his resume, and criminals threatened to expose him if he didn't cooperate by planting the device.
The final portion of the book discusses further capabilities of ESM. The main point is that ESMs should be able to monitor everything. Contos explains a scenario where an employee pulls financial information from a proprietary system and then uploads it to a P2P network. Most companies do not have the technology to detect such an action. Not that Contos claims technology is the only answer. It is just a tool, and it is useless when not supported by trained employees and policies. At the end of the book, the reader gets information about "soft skill" topics like incident management, hiring processes, and some legal case history regarding insiders.
The book's viewpoint is very top-down with regards to the corporate hierarchy. Executives will no doubt love all the capabilities that Contos claims can be at their fingertips, but individual employees might feel it is slightly Orwellian. Can all this information that the ESM vacuums up be used for evil? The book's implicit answer seems to be "yes", since it is repeatedly made clear that no one can be trusted. But there is never any explicit information given on how the ESM itself can be protected from abuse.
Enemy at the Water Cooler provides a thorough introduction to insider threats and the countermeasures that can be used against them. If you are just interested in stories about insider security crimes, then you may want to pass. (The section on case studies is only about a third of the book's content). However, if you are interested in learning about technology that can help defend against these threats, then this book provides a comprehensive overview.
Trent Lucier is a software engineer. His latest experiment is localhost80.com"
You can purchase Enemy at the Water Cooler: True Stories of Insider Threats and Enterprise Security Management from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.
YOU TOOK THE LAST GLASS OF WATER (Score:5, Funny)
Re: (Score:2, Interesting)
It is job security, having management know I have cart-blanch full access to the whole company system, with no big brother security monitoring of my system and internet activities.
Make it harder for any of the CEO/CFO to let me go because they drove the business into a downturn, I make to much salarie
Re: (Score:3, Insightful)
re:YOU TOOK THE LAST BIT OF DIGNITY (Score:5, Insightful)
My father, three of his brothers and their father all worked for the same company for all their working life. They were well taken care of and they returned that loyalty several times over in the course of their careers.
Today, companies are more concerned with cutting another 10,000 employees so their stock price will jump a few cents for a couple of weeks than creating a relationship of trust and security with their employees. Benefits are cut, unions are fought, jobs shipped overseas and life is generally made as miserable as possible for the people who sweat blood on the shop floor. Meanwhile, the differential between what the CEO makes compared to the average employee has gone from 20 to 1 to 20,000 to 1.
I'm not surprised that corporations find themselves loathed by their employees and having to exert effort and money trying to protect themselves from their own people. What surprises me is that we don't see more all-out sabotage by disgruntled employees.
It's not coincidental that the period of enormous growth and prosperity of the few decades after World War II happened to also be a period of improving conditions, organization and influence for the workers. A period when labor unions were considered a crucial part of the economic system. Those unions were the only reason the US had such a strong and deep middle class from 1950 until their demise began at the hands of that doddering tool of the Right-Wing Rich, Ronald Reagan, who, if God is just, is burning in Hell.
different goals (Score:5, Insightful)
Also, CEO pay has skyrocketed in comparison to worker pay, and no company that pays hundreds of millions of dollars to departing executives can also afford to be loyal and supportive to the workers. In the corporate culture of today, executives are seen as the movers and shakers, the visionaries who create the value, while the workers are seen as expenses.
Re: (Score:2)
Re: (Score:2)
Maybe it's about more than money.
I understand that's a concept around which some people have a hard time wrapping their heads.
And we'll tell you when you're being "intellectually honest".
Re:YOU TOOK THE LAST BIT OF DIGNITY (Score:4, Informative)
it happens all the time... but i'll bet it doesn't often make the papers.
the word sabotage comes from the french word "sabot" which is a kind of wooden shoe or clog. during the industrial revolution, angry workers would kick the machines they worked on or throw the shoes into them, resulting in a "clog" in the output.
in the intelligence community, disgruntled soldiers and public servants make some if the best moles or double agents. in government, many whistleblowers act not out of a sense of duty or responsability but as a means of exacting revenge.
Re: (Score:2)
Why should an employer have any more loyalty to his employees than a shopper does to the stores he shops at? You should owe your employer nothing more than your labour; your employer should owe you nothing more than your wages. If someone else can provide the same labour for fewer wages (or more labour for the same wages), your employer should contract
Re:YOU TOOK THE LAST GLASS OF WATER (Score:5, Insightful)
Your career is heavily dependent on your reputation. If you have a reputation as a rogue who will hold the system hostage in order to make yourself indispensable, you will not be hired elsewhere.
In any job, your goal should be to make yourself valuable, not indispensable. Indispensable people make management nervous. If you are truly indispensable, then management's primary goal becomes to make you dispensable as soon as possible, even if they like you. It's the old "What if Person X got hit by a bus tomorrow?" dilemma: nobody wants their entire business to be dependent on any one person.
Beyond that, being indispensable in your current position makes it impossible for you to move up in the company. No one will promote you, because your current position can't be backfilled, since you're the only one who can do it. This is bad for your career.
Re: (Score:2)
It's pretty hard to work in IT from prison. What you honestly think you'd just be fired?
Re: (Score:2)
Re: (Score:2)
Most employers won't volunteer information about a past employee's performance, as they can be held liable if future employment is refused due to their testimony -- especially if they can't prove their assertions.
Now by no means am I trying to imply carte blanche. There are plenty of moral, ethical, and legal reaso
Re: (Score:2)
Re: (Score:3, Insightful)
Re: (Score:2)
"We cannot provide a reference for this person" speaks quite enough.
Re: (Score:2)
Really you can't put much faith in what either the previous employer or the perspective employee are telling you; you just have to evaluate based on the merits of the employee -- education, experience, and the interview.
Re: (Score:2)
That's interesting. I had one former employee ("downsized") who asked if he could use me as a reference. I said I had no problem with that, but I would only tell the truth about their performance from the perspective of his former lead. That includes both his positive attitude, and his negative productivity (he had medical issues that seemed to interfere with getting his work done, and was not on a medical leave when he was laid off - I don't know the legalities, but neither was I his actual manager who
Re: (Score:2)
Re: (Score:2)
Should have said:
You have a surprise coming to you if you think any of that gives you job security.
Oblig (Score:1, Funny)
All your base are belong to the water cooler!!
Re: (Score:3, Funny)
NOT Oblig (Score:1)
Slashdot posts do not watch you, we do not need to welcome our slashdot overlords, our base do not belong to anyone, there is plenty to see here, and so on.
Stop trying to justify your re-use of an old joke by saying it is obligatory. It isn't. Come up with something new, or just don't post.
Re: (Score:1)
Re: (Score:2, Funny)
No more (Score:5, Funny)
Re:No more (Score:4, Funny)
Re: (Score:2)
Re: (Score:2)
Only if your employees are vampires.
Re:No more (Score:4, Funny)
Re: (Score:2, Funny)
Re: (Score:3, Funny)
Uh oh, I think that joke may have gotten me on a terrorist watch list.
WAIT!!! (Score:5, Funny)
Re: (Score:2)
Visio (Score:5, Funny)
Update on the link (Score:4, Informative)
Re: (Score:3, Informative)
Speaking of links, please do not include links in your reviews to online bookstores. Slashdot has an linking arrangement with Barnes & Noble; that's why when bn.com carries a particular book, you'll see a link to it at the bottom of the review.
Re: (Score:3, Insightful)
Slashdot used to link to Amazon for books, but they took a lot of criticism for it because Amazon had patented the "one-click". Now they link to Barnes & Noble and people criticise them for not linking to Amazon any more. I guess if you're Slashdot you just can't win.
Problems. (Score:5, Interesting)
Re: (Score:2)
Re:Problems. (Score:5, Insightful)
I would also caution against restricting the individuals PC desktop too much. This can very quickly lead to employees looking for ways to circumvent your security, and create threats that you don't know about. Sometimes this even means making sure the employees computers properly play CDs, and can access entertainments sites on the internet. The best and the brightest often look for the most enjoyable work environment. Being able to listen to their music while working, or taking a short break to see if there will be a new episode of BSG this week could mean the difference between getting someone that is adequate at their job, and getting someone that is great. It could also mean the difference between an employee that dreads coming to work, and someone that looks forward to it.
Re: (Score:2)
This pretty much describes my workplace. Users had fairly high levels of control over their PCs and unrestricted internet access. Someone quit and decided to steal some files and the lockdown began. CD drives disabled, background applications that monitor USB storage transfers LIVE and alerts IT of any traffic and a ridiculously restrictive internet filter. at least 1 out of every 4 site that come up when I'm searching for code snippets or examples gets blocked because it's someones "person
Re: (Score:2)
snitch networks? (Score:2)
Pissed off people (and assholes) will always remain so.
Re:snitch networks? (Score:5, Funny)
I was waiting for this to get mentioned (Score:3, Interesting)
Employees like to feel trusted. The kinds of security measures that will really protect your information are the kinds of security measures that will create a semi-oppressive environment.
I guess that's something that has to be balanced: the effects of your security implementation on morale/productivity vs the cost of a possible breach
Re:I was waiting for THIS to get mentioned (Score:2)
Insiders only 20% of threat (Score:5, Interesting)
http://www.cert.org/ [cert.org]
Therefore, implying that the insider threat looms as large as others is highly divisive and misleading. Further, you can take concrete steps to reduce the risk of an insider threat, while you cannot have that level of impact in threat reduction (vulnerability and asset risk reduction, yes, but not threat) for the rest of the world.
- musides
Re: (Score:2, Insightful)
Re: (Score:2)
...I fell over laughing while reading this [cert.org]. (Go to slide 31)
Re: (Score:2)
-WS
jumping ship (Score:1, Interesting)
Windows Vista Forum [vistahelpforum.com]
Re: (Score:2, Funny)
Re:jumping ship (Score:4, Informative)
Re: (Score:2)
Re: (Score:2)
PHP is not a webserver, it is a scripting language. You can use PHP with IIS, I've done it, I don't recommend it but not because there are problems with such a combo, just because IIS sucks.
Re: (Score:2)
Wine (Score:3, Funny)
Re: (Score:2)
I've got some friends... (Score:2)
Re: (Score:2, Informative)
List of countries by GDP (PPP) per capita per hour [wikipedia.org]
Nice Review (Score:2, Insightful)
Who talks at the water cooler anyway? (Score:2)
Can we end the "talking around the water cooler" cliche? Very few people stand around the water cooler. They walk up to it, fill their cup or bottle, and walk away.
If someone wanted to have a good chat with their workmates, they'd wander off to a nearby cafe, where their conversation isn't going to be seen or heard by their managers.
More spinoffs of the terrorist threat (Score:2, Insightful)
My assertion is that looking behind you all the time and treating everyone as a potential threat causes more damage than the problems it supposedly avoids. If the patriot act is the cure, I'd rather have the disease, thank-you. The same goes in the office.
Re: (Score:3, Insightful)
If you've dealt with a company that had an inside bad guy ship out a dumped database containing all of that company's customer's credit card numbers and personal data, you'd probably feel a little differently. Just like you'd probably feel differently if a family member had been on one of those trains in Madrid, or in a nightclub in Bali, or in one of those embassies in Africa, or in the WTC, or taking a flight that ended i
Re: (Score:2, Interesting)
It's truly ironic that here in Canada, where far fewer personal freedoms are directly enshrined in our constitution, I today enjoy more personal liberty and freedom from state interferance than those in the United Stat
Re: (Score:2)
I'm always a little perplexed by this sentiment. In a large operation with sensitive data involved, everyone who works there should be acutely aware of how important it is to keep things bolted down. Everyone's jobs depend on that being done properly. In a suitably large organization, everyone involved is also going to be aware that not every person out of a given thousand is going to be personally stable, financiall
About that cloud (Score:4, Insightful)
Re: (Score:2)
Re: (Score:2)
Man, I've got mod points but if I mod you up my original goes and it all get confusing. Will you take a rain check?
Re: (Score:1)
Re: (Score:1, Funny)
Re: (Score:2)
Go off the grid (Score:2, Interesting)
What if your company's network weren't connected to the internet at all? Naturally, a lot of companies "need" this, but I'm sure there are other companies that can operate fine without the internet at all. Not only does it save the company from worrying about "outside" threats, but I imagine it also helps to deter inside threats. For example, look at the employee that hosted pirated software on company machines. Without the 'net, how is he going to host it?
Re: (Score:2)
Yes, but without the Internet, what will management do all day? Internet connections are like playpens for management to keep them from meddling with the people who do actual work.
Self-Generating Problem (Score:3, Interesting)
Yes, companies should take prudent steps to oversee the security of their networks and systems. But I suspect they need to do more to enlist the aid of the allies at the water-cooler and in creating a positive work environment than in draconian control measures.
Re: (Score:2)
Each of the dev rooms had web cams trained on all the engineers, which the owner would actually watch (no joke, he'd pull you in at the end of the day and tell you "I see around 3:20 you wer
Re: (Score:2)
Very true. Sure, take reasonable security measures... But if you start snooping on everything your employees do, start filtering out Internet sites, start sifting through email...your employees start feeling oppressed and resentful. Get enough resentment going and they'll start looking for ways to get back at you. Usually it's something minor...bringing a pencil home from work to get back at the man or something s
big fluffy white clouds are nice, but . . . (Score:1)
Danger! Danger Will Robinson!! (Score:1, Offtopic)
What is it with people today who act like working in an office in corporate America is filled with intrigue and tales of espionage? Read this now: CORPORATE AMERICAN OFFICES ARE DULL AS HELL. There are no real secrets because the monkeys who work in these glorified cages have no real power of any kind. They have no knowledge of any value. They are basically button pushers who want to feel important after watching fantasies like Fox television's 24 series. Trust me, I've
Re: (Score:3, Funny)
Every Few Months (Score:5, Insightful)
Every few months someone writes and article or publishes something talking about how insider threats are the largest avenue for security breaches. Usually, they are trying to sell some new "spy on your employees" device. My company even makes a device that tracks employee internet usage and finds abnormalities. We have one deployed internally and anyone can look at it to see what other people have been doing. Sometimes we'll make fun of someone for being the most frequent visitor to Slashdot this month, or some-such. That said, we have deployed an incredibly effective system for stopping insider threats. Such a system used to be commonplace in many companies, but has since fallen into disuse due to modern business strategies and short-term money saving concerns. This fabulous system is called, "beer in the fridge."
By spending a small amount of money to keep the kitchen fridge stocked with free beer for all employees, the company has cheaply bought all our loyalty. Sure we could perform extensive audits and spend time spying on potential insider threats and implement physical security to stop people from bringing in portable drives they could use to steal our customer databases, but really the beer is a lot cheaper. It has added benefits too. If an employee is gets a job offer elsewhere they often ask about the free beer situation. I think it is worth about 20K of salary in most people's comparisons. If people are moving on, they stay in touch with people here and recommend us to work for and to buy products and services from. People give lots of notice and will stay on to finish a project or train someone else. People are a lot more likely to stay late or come in on the weekends to work on something because of the free beer.
Yes, the fabulous "beer in the fridge" system has many advantages.
Treat employees well, like people instead of mercenaries. Be their friend as well as their boss. If they can't come in some day because they have something come up, or an old friend comes into town, let them take a day off. Make sure people don't fear they will be fired because management needs better numbers for the year. Make sure they know they are valued as employees and people. Take them out to lunch now and again or order a pizza, or get free donuts. Well treated people almost never betray their employer and tend to treat their boss well in return. This isn't rocket science.
Re: (Score:1)
BTW, I have the pleasure of working for a beer in the fridge workplace...
Re: (Score:1)
Re: (Score:2)
We have a policy of paying for cabs, rather than risking someone driving home. Besides, people will maybe have a beer at lunch, or one after work, then grab some dinner and head home. Anyone likely to get drunk probably went to a bar after work anyway.
Re: (Score:2)
I'm sorry, but this is all wrong.
First, mercenaries, like soylent green, are people. A certain kind of people: people whose loyalty can be bought with money. And like Machiavelli says, mercs will go to the highest bidder. Much better to use family, or loyal subjects... neither of which are really solid business models these days.
And honestly? I didn't join the company to make friends, thanks. I joined the company to do business. I treat my boss a
Re: (Score:2)
First, mercenaries, like soylent green, are people. A certain kind of people: people whose loyalty can be bought with money.
True, but if you hire that type of people you need to be aware that more money (such as an offer from a competitor or which they can make by stealing the customer database and reselling it) is likely to change their loyalties. A good manager wants to avoid ever putting their workers into the mindset that it is all a cold business calculation because in reality, employees can make mo
Re: (Score:2)
The last sentence - "Money is not happiness" - relates to why tomorrow I'm giving notice at my current workplace. Happiness has been replaced by constant stress and I'm at the point of no longer caring what I do. I love the people I work with, but have stopped liking my work, or finding it interesting. I'm ready to trade stress and money for happiness and less money. Or at least a better ba
Re: (Score:2)
I get paid to do whatever work they feel like paying me for. If they want to pay me to jump through hoops, fine with me. I honestly couldn't care less what kinds of policies it takes to run a company these days.
Again, my life is not my job, and my job is not my life.
Seriously, the corporation is a big, impersonal machine. I don't take it personally when the machine acts impersonal towards me. I just don't need the grief that comes from being disgruntled.
Re: (Score:2)
Re: (Score:2)
Maybe "The Beer in the Fridge" should be the sequel to "The Enemy at the Watercooler"...
--Rob
I have 17 humidifiers running non stop (Score:1)
My internet cloud in my house is really fast now.
does anyone know how to stop all the water from dripping everywhere ?
An acquaintance of mine (Score:2)
Why even think about technological solutions? (Score:5, Insightful)
Banks have also gone out of business due to the insider threat people seem afraid to discuss. There's an old saying, "The best way to rob a bank is to own one". Crooked senior management stole one Sagan (billions and billions) of dollars during the 1980s US savings and loan disaster. Sometimes the thefts are even considered legal, as when a CEO walks away from a ruined company with a hundred million in "performance bonuses". How is ESM going to protect against Ken Lay, who did more damage than any random thousand "disgruntled former employees"? (*)
Banking procedures, such as requiring people to take vacations, have the other advantage that they don't risk violating privacy laws. In some countries you may not be allowed to spy on your workers to the extent you can in others.
(*) Who disgruntled them, anyway?
My name is Milton Waddams (Score:5, Funny)
No. I will have to find out myself who took my red stapler.
*walks off muttering*
THe only enemies at our watercooler are... (Score:2)
Re: (Score:2)
How else could we get time to read slashdot?
Client firewalls wide open from the inside out (Score:2)
The cost/benefit of paranoia? (Score:2)
what protects the ESM .. (Score:2)
Ah, So
"In one example, a company discovered that their servers were hosting pirated software"
Does the book tell us the names of the companies and the individuals involved.
"In the case of a Spanish company, an employee was forced into planting a wireless access point in one of the development labs. The employee had lied about his educational background on his resume, and c