Chapter 9. Personnel Security
Consider
a few personnel incidents that made the news in the last few years:
Nick Leeson, an investment trader at the Barings Bank office in
Singapore, and Toshihide Iguchi of the Daiwa Bank office in New York
City, each made risky investments and lost substantial amounts of
their bank's funds. Rather than admit to the losses,
each of them altered computer records and effectively gambled more
money to recoup the losses. Eventually, both were discovered after
each bank lost more than one billion dollars. As a result, Barings
was forced into insolvency, and Daiwa may not be allowed to operate
in the United States in the future. In the U.S., agents and other individuals with high-security
clearances at the CIA, the FBI and the Armed Forces (Aldrich Ames,
Jonathon Pollard, Robert Hanson, and Robert Walker, to name a few)
were discovered to have been passing classified information to Russia
and to Israel. Despite several special controls for security, these
individuals were able to commit damaging acts of espionage—in
some cases, for more than a decade. John Deutch, the director of the CIA under President Clinton, was
found to have taken classified government information from the Agency
to his house, where the information was stored on classified
computers configured for unclassified use and appropriately marked as
"unclassified." While the
classified information was resident, these same computers were used
to access pornographic web sites—web sites that could have
launched attacks against the computers using both public and
undisclosed security vulnerabilities. Yet despite the fact that
numerous policies and laws were broken, no administrative action was
taken against Deutch, and Deutch was issued a presidential pardon by
Clinton on Clinton's last day in office.
If you examine these cases and the vast number of computer security
violations committed over the past few decades, you will find one
common characteristic: 100% of them were caused by people. Break-ins
were caused by people. Computer viruses were written by people.
Passwords were stolen by people.
Clearly, without people, we wouldn't have computer
security problems! However, because we continue to have people
involved with computers, we need to be concerned with personnel
security.
"Personnel security" is everything
involving employees: hiring them, training them, monitoring their
behavior, and, sometimes, handling their departure. Statistics show
that the most common perpetrators of significant computer crime in
some contexts are those people who have legitimate access now, or who
have recently had access; some studies show that over 80% of
incidents are caused by these individuals. Thus, managing personnel
with privileged access is an important part of a good security plan.
People are involved in computer security problems in two ways. Some
people unwittingly aid in the commission of security incidents by
failing to follow proper procedures, by forgetting security
considerations, and by not understanding what they are doing. Other
people knowingly violate controls and procedures to cause or aid an
incident. As we have noted earlier, the people who knowingly
contribute to your security problems are most often your own users
(or recent users): they are the ones who know the controls, and know
what information of value may be present.
You are likely to encounter both kinds of individuals in the course
of administering a Unix system. The controls and mechanisms involved
in personnel security are many and varied. Discussions of all of them
could fill an entire book, so we'll simply summarize
some of the major considerations.
|
