Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Ask Slashdot: Preventing Snowden-Style Security Breaches?

samzenpus posted about a year ago | from the protect-ya-neck dept.

Security 381

Nerval's Lobster writes "The topic of dealing with insider threats has entered the spotlight in a big way recently thanks to Edward Snowden. A former contractor who worked as an IT administrator for the National Security Agency via Booz Allen Hamilton, Snowden rocked the public with his controversial (and unauthorized) disclosure of top secret documents describing the NSA's telecommunications and Internet surveillance programs to The Guardian. Achieving a layer of solid protection from insiders is a complex issue; when it comes to protecting a business's data, organizations more often focus on threats from the outside. But when a trusted employee or contractor uses privileged access to take company data, the aftermath can be as catastrophic to the business or organization as an outside attack. An administrator can block removal of sensitive data via removable media (Snowden apparently lifted sensitive NSA data using a USB device) by disabling USB slots or controlling them via access or profile, or relying on DLP (which has its own issues). They can install software that monitors systems and does its best to detect unusual employee behavior, but many offerings in this category don't go quite far enough. They can track data as it moves through the network. But all of these security practices come with vulnerabilities. What do you think the best way is to lock down a system against malicious insiders?"

Sorry! There are no comments related to the filter you selected.

simple (5, Insightful)

greenfruitsalad (2008354) | about a year ago | (#44219419)

Simple. Do good, make people working for you feel they're doing something good for the world.

Re:simple (4, Insightful)

MightyMartian (840721) | about a year ago | (#44219445)

Yes, well, perhaps in La-la Land. Here, in reality, no matter how good your organization may be (for whatever definition of "good" you choose to use), you may still end up with bad employees. The question of securing your data shouldn't be about good or evil, or any particular moral judgment, but simply about how to make sure you're critical and confidential data doesn't end up being ripped off.

Re:simple (3, Insightful)

kthreadd (1558445) | about a year ago | (#44219599)

Let's say that the PRISM program managed to stop X number of terrorist attacks. As an NSA employee you might very well consider your work to be of good. Otherwise you would probably not work there. And this is probably true for many types of jobs. Good is a relative term, it depends on the viewer.

Re:simple (4, Insightful)

CanHasDIY (1672858) | about a year ago | (#44219841)

Let's say that the PRISM program managed to stop X number of terrorist attacks. As an NSA employee you might very well consider your work to be of good. Otherwise you would probably not work there. And this is probably true for many types of jobs. Good is a relative term, it depends on the viewer.

You seem to be under the impression that most people have the job they have because they want to "do good."

That is incorrect; the actual reason most people have a job at all is because it's damn-near-if-not impossible to survive today without some form of monetary income.

I'm guessing the dicks at the NSA (yea, that's right, I called you all dicks. Prove me wrong.) do what they do because the paycheck is quite fat; on the other hand, I guess some people would sell their own mother to the slavers for a pack of smokes and a lighter...

Re:simple (4, Insightful)

peragrin (659227) | about a year ago | (#44219843)

The trick with that is what was the ratio of attacks stopped versus the number of people "looked" at?

In the UK their is a current debate on random stop and search used by police. The noticeable point is that it is 9% effective in finding someone doing something wrong.

So if the police stop and search 100 cars they find 9 people who are breaking the law.

Prism is spying on tens of millions, to find a couple dozen.

that is why it should be stopped. They should turn that kind of data mining loose not on the outside world but their own internal agencies. If the NSA data mines, searches emails, databases, etc they could get far better results.

It would single handily merge the agencies that don't want to cooperate and produce far better results.

Re:simple (1)

rwa2 (4391) | about a year ago | (#44219939)

Heh, I sort of posed a similar question to my kids...

Say you've collected a group of N=10 people out of a population of P=100, and you know X=1 of them is a serial killer. How many of those people should you execute (or otherwise remove from society) to keep the rest of the population safe? Or should you let them all go to protect the innocent ones, knowing that the serial killer will go on unpunished to cause 10x more murders? How many can you execute before you're worse than the serial killer?

Now just substitute "kill" for "steal" or "spy" or "otherwise impede the real or imagined rights of", and grab some popcorn.

There's no order like social order. But it's a fun exercise when you realize there are different answers when you play with the ratios of X to N and P, and varying the severity of the crime/injustice.

Re:simple (1)

davydagger (2566757) | about a year ago | (#44220041)

employees of buerocracy don't measure success in how well the buerocracy performs its job relative to society.

They measure personal success in how well the buerocracy does relivant to itself, and how well they do invidually inside the buerocracy.

I'd gander most people get into that work, because they see it as "recession proof", with retirement, good pay, and stability. They also probably recruit a good deal of ex-military who have a hard time finding work elsewhere. Given the fact the army is downsizing, it would be really easy to recruit them. No, extremely easy to recruit them, considering that its a government job, you get to move your pension over.

They are already used to working for the government.

Re:simple (-1)

Anonymous Coward | about a year ago | (#44219651)

Snowden reported crimes. If you don't want "Snowden-style" security breaches, as this is the asked question, then do not commit crimes.

The OP is right and you are too bigoted to see why. This IS about good and wrong. He didn't simply stole credit card information for profit, he did what any moral human being is taught to do since childhood; Be a upstanding citizen and report crimes.

TLDR; Fuck off.

Re:simple (5, Insightful)

Dahamma (304068) | about a year ago | (#44219799)

No, the general question TFA asks about security breaches really has nothing to do with right and wrong or morality, it was simply about protection of data from insiders in any organization. What if Snowden's motivation had instead been monetary (which is much more common in security breaches than whistleblowing)? Or industrial espionage instead of government?

Protecting data from internal leaks is a complex issue, and pretending "if you are good it won't happen" is idiotic.

Re:simple (1)

CanHasDIY (1672858) | about a year ago | (#44219887)

Protecting data from internal leaks is a complex issue, and pretending "if you are good it won't happen" is idiotic.

I think you're missing the point of those posts; we, collectively, know "do good and you have nothing to hide" is a bullshit rationale, but we find it appropriate in this circumstance considering how the corporate-owned government tells us the same thing every time they want to fuck us out of a couple more civil liberties.

FWIW, asking a crowd like this a question like that at a time like now... a straight answer is probably the last thing most of us are thinking about responding with.

Re:simple (0, Insightful)

Anonymous Coward | about a year ago | (#44219893)

No, TFA asks about Snowden style security breaches - and his reason for doing it has to be included, otherwise the question wouldn't include his name.

Re:simple (5, Insightful)

rtfa-troll (1340807) | about a year ago | (#44219661)

The question of securing your data shouldn't be about good or evil, or any particular moral judgment, but simply about how to make sure you're critical and confidential data doesn't end up being ripped off.

There's a certain level that you can go that way. However, in the end, to be useful data has to be loaded into people's heads. People can then unload part of it elsewhere. A very important part of securing the data is making sure that those people who could do that choose not to because they see the value of your mission. Those people who surround them also see the value and put social pressure not to reveal secrets. When the US loses it's moral authority by doing things identical to acts it has previously criticised this is obviously going to increase the risk of a leak.

Re:simple (2, Insightful)

TheCarp (96830) | about a year ago | (#44219721)

> you may still end up with bad employees. The question of securing your data shouldn't be about
> good or evil, or any particular moral judgment, but simply about how to make sure you're critical and
> confidential data doesn't end up being ripped off.

Don't let your employees access any data that you don't want them to release. Period.

If you are really that worried, then you can't give them access. If someone has access to the data, and feels it should be released, they will release it, they will find a way, and nothing you do is going to be able to prevent it.

Any measure you take can be defeated, short of not allowing access at all. Store the data on systems that are connected to nothing and require physical access in a secure and monitored location. Make them work under the eye of cameras. Stand over their shoulder while they work.

Seriously, short of that, you are hosed. In the end, don't do things that people will want to release, and you solve the vast majority of the problem. The more controversial your secrets (that is, the more people who see you as evil) the more control you need to prevent it.

So.... don't deserve a Snowden and the chances that you will have one are seriously reduced.

Re:simple (1)

MightyMartian (840721) | about a year ago | (#44220049)

I can't quite sort out why I have been modded troll. The issue of data leaks is a big issue, even for organizations that do good (again, however you define that. I agree that Snowden was morally right to do what he did, but try to imagine a situation in which an employee nicking your data is doing it to blackmail you or sell to a competitor?

Not every person stealing your data is some glorious warrior of freedom. Most are, well, to put it bluntly, just plain criminals, and as with any kind of theft, frequently those best placed to steal your data for nefarious ends are your own employees.

Re:simple (1)

dgatwood (11270) | about a year ago | (#44219455)

Exactly. If an employer is doing nothing wrong, then at least long-term, it has nothing to hide. :-D

Re:simple (4, Insightful)

fuzzyfuzzyfungus (1223518) | about a year ago | (#44219547)

Exactly. If an employer is doing nothing wrong, then at least long-term, it has nothing to hide. :-D

There are still merely-self-interested insiders: It's practically a tradition for Mr. Sleazy McSales to abscond with all the customer data when he accepts a position with the competition, and his engineering counterparts to lift design docs and the like for the same purpose.

Doing good does have the advantage of reducing disillusionment among your otherwise-least-corruptable people, and helps prevent economically-irrational leaking; but you still have to worry about the merely mercenary.

Re:simple (0)

Anonymous Coward | about a year ago | (#44219949)

We have a lot of medical data, should that be released to the general public?

Re:simple (1)

techsoldaten (309296) | about a year ago | (#44220077)

Someone could be selling insider information about farm subsidies, which is not illegal but can affect markets.

'Leakers' are only one category of people who disclose information. It doesn't have to be illegal to be private and worth protecting.

Re:simple (4, Insightful)

Jeremiah Cornelius (137) | about a year ago | (#44219517)

Hark! Do I hear the approach of the Freedom Drone?

Stop launching Hellfires on babies, and stop treating the Citizens of your Republic like suspects in your dragnet.

Re:simple (0)

Anonymous Coward | about a year ago | (#44219527)

Simple. Do good, make people working for you feel they're doing something good for the world.

Exactly, because all the most altruistically great companies had no data they would like to keep from the public and their competitors.

Slashdot is really fucked up lately.

Re:simple (2)

TheCarp (96830) | about a year ago | (#44219861)

> Exactly, because all the most altruistically great companies had no data they would like to
> keep from the public and their competitors.

Who said that? The point is that, as a technological problem there is no serious solution set. You can either deny access entirely, or put onorus productivity and morale killing restrictions on access. However, anything you can think up, likely can be somehow defeated.... unless you think you can get away with asking people to strip naked upon their arrival to work and work in the nude while you stand over their shoulder watching and video recording them.... but even then someone will, given enough time and with enough motivation, find a way to trick you.

However, not making your employees feel that they should do it goes a long way to making sure it doesn't happen. I have seen many disgruntled employees, but vanishingly few of them actually turn to releasing secrets or stealing lots of data. (of course, few companies really have much all that worth stealing, despite what they may think.... lots of people think their own pile of shit is solid gold.

Honestly, I think most companies get this right by not spending too much time or resource on it, and instead, focusing on getting the job done. If you really don't want it to happen, your absolute best bet is to cultivate happy employees who feel the company is good to them.

Then, just be sure if you do anything so illegal or so morally objectionable that even good, happy, otherwise loyal employees want to blow the whistle, you keep that really really quiet and away from their eyes.

And if you really have any secrets that are so valuable someone will seriously pay money to steal them, then maybe you want to think of some amount of access control, keeping things on machines off the network, that sort of.... you know...all the normal suggestions that everybody, very smartly, ignores 99.999% of the time.

Re:simple (0)

Anonymous Coward | about a year ago | (#44219863)

The internet libertarians found us.

Re:simple (1)

jovius (974690) | about a year ago | (#44219551)

Ultimately free individuals can never be contained.

Therefore complete transparency should be applied. The nationalist paradigms and constructs are futile. Ideals and methods can be implanted, but they are not what you are.

Re:simple (0)

Nemesisghost (1720424) | about a year ago | (#44219697)

Yeah, as if "doing bad things" was the only reason people stole from their employers. There are a myriad of reasons why someone would "leak" or "steal" confidential information from their employers, and most of them having nothing to do with the how their employer does business. There are such things as "bad" people, and they will do "evil" things no matter what.

Even if you believe that people are all good, and only break the rules to necessitate a greater good, that still has no bearing on how an entity conducts itself. Take for example Mitt Romney using TurboTax(or some other self filing service) to do his taxes. If TurboTax had an employee who was a Left Wing Nut Job and thought that Obama was going to rid the world of all its evils, and he decided to steal & leak Romney's tax returns, does that mean that TurboTax was an evil company? No, not in the least. Especially when they were following the laws that others thought were a good idea(data security anyone?). It does mean they hired a Left Wing Nut Job.

Re:simple (4, Insightful)

gweihir (88907) | about a year ago | (#44219717)

Indeed. Loyalty is the only thing that works. DLP is basically a scam to make tons of money, but cannot prevent leakage. As long as people work with data, they can steal that data. Get used to it.

You can to a bit of personality screening. For example if you are the NSA, you want to screen out anybody with a shred of personal ethics or honor. Then make sure you bribe these people in staying loyal too you and keep the bribes up. Sure, you only get psychos that way, but nothing else is going to work.

If, on the other hand, your organization is actually contributing something positive, then make sure your employees have ethics and honor, believe in the cause and address grievances before they become a problem.

Loyalty is the key, and how to get it depends on what your organization does. Nothing besides loyalty will help against anybody determined.

Re:simple (0)

Anonymous Coward | about a year ago | (#44219855)

You mean like a hospital with medical records. Or what about a large genetics project with genetic and medical data. Espionage doesn't only involve signals intelligence.

Re:simple (1)

GeoSanDiego (703197) | about a year ago | (#44219963)

NO SIMPLER: No one person should have so much knowledge and access to secret data.

Re:simple (2)

erroneus (253617) | about a year ago | (#44220111)

I would have said it differently. "Stop breaking the fucking law!!"

Bing it on! (-1)

Anonymous Coward | about a year ago | (#44219427)

Wherever you go, you'll find that 99% of the population are rabid, frothing Bingers (just like me)! Why is this? What is this Bingomena? Bing's search results are always 100% accurate and comprehensive. If you tried Bing, you'd be worshiping its servers in no time.

Don't believe me? Bing it on! []

Nice try NSA (5, Funny)

Anonymous Coward | about a year ago | (#44219429)

We won't help you cover your asses for the future. It's time to clean house.

Re:Nice try NSA (1)

crafty.munchkin (1220528) | about a year ago | (#44219605)


You Can't (0)

Anonymous Coward | about a year ago | (#44219433)

As soon as you involve people everything has a chance to go south. You can try to spot it, test for it, etc, etc ... but you can't stop it. People can and will fuck up anything they touch. It's just a fact of life.

Nice try NSA (5, Insightful)

stewsters (1406737) | about a year ago | (#44219435)

How about try not to do anything you would be embarrassed by if it leaked? Not ignoring the 4th Amendment is a good start.

Re:Nice try NSA (5, Insightful)

intermodal (534361) | about a year ago | (#44219653)

That was certainly an issue. If we're talking Snowden-style, the best deterrent is to actually conduct your operations within the law and within the boundaries of ethical behaviour. Snowden wouldn't have had anything to leak if the government were operating within the legitimate bounds of the constitution.

Re:Nice try NSA (0)

Anonymous Coward | about a year ago | (#44219967)

Contrary to popular belief these leaks didn't expose anything illegal. These programs are operating within the bounds of the laws as written and voted upon by congress. People have a right to be angry with the program but they should be equally angry that their congressional representatives have voted to keep these laws in place that validate these lawful programs.

Re:Nice try NSA (4, Informative)

MozeeToby (1163751) | about a year ago | (#44219957)

The NSA doesn't need help, all they would have had to do is follow their own procedures and the leak would have been greatly reduced. There's no excuse for having active USB ports on a machine that is handling top secret documents. Nor is there any excuse for giving someone access to more classified documents than they need to do their jobs, a system admin needs approximately zero access to the actual contents of the actual documents.

Simple: (1)

Anonymous Coward | about a year ago | (#44219439)

Don't do anything your employees would want to blow a whistle on, e.g. fly-tipping, holding personal information insecurely, wholesale wiretapping of a nation, that sort of thing.

Don't do anything illegal (1)

Anonymous Coward | about a year ago | (#44219447)

And you won't have to worry about insiders sharing your private data with the media.

Be sure to choose the lowest bidder (4, Funny)

attemptedgoalie (634133) | about a year ago | (#44219449)

That always ensures quality.

Does it matter if there's only one bid (3, Insightful)

rsborg (111459) | about a year ago | (#44219593)

That always ensures quality.

With our recent innovation of no-bid contracts (well, there's one bid - from the crony that's been hand-selected by the corrupt government department), you get all the benefits of outsourced work along with the quality of a supplier with a monopoly for your project(s).

Lesson Number One..... (5, Insightful)

segedunum (883035) | about a year ago | (#44219465)

Don't piss off the sys admin.

Re:Lesson Number One..... (0)

Anonymous Coward | about a year ago | (#44220025)

You can make the circle of people smaller but you can't do without at least one or two persons who can get around all the security measures. That is the whole point of having administrators. You protect your self from both intended and unintended misbehaviour. But in the end you still need someone who can get around the whole security system when the system isn't working. And believe me. It _will_ do so at some embarrasing point if you don't have anyone.

Have *any* sort of security whatsoever (1)

Anonymous Coward | about a year ago | (#44219469)

He has said himself that he didn't have any sort of security clearance. Why in the world were files of *any* importance available, unencrypted, for him to see?

What a joke, seriously.

Re:Have *any* sort of security whatsoever (0)

Anonymous Coward | about a year ago | (#44219925)

If what you say is true, he had no security clearance of any kind, and he actually got access to classified information, then SOMEBODY ELSE (or a group of folks) with a clearance are ultimately responsible for this leak. But I thought he had a clearance....

If he ever had a clearance (or even applied for one and was turned down) then he's going to be rotting in jail if the US ever gets him back onto US soil. There are Five things they will get him for.

1. Not reporting that he had access to classified information he was not authorized to access.

2. Not protecting the classified information from further disclosure.

3. Not reporting that somebody was asking him to disclose classified information.

4. Not reporting disclosure of classified information to unauthorized recipients.

5. Finally, actually disclosing the information.

BigData (0)

Anonymous Coward | about a year ago | (#44219471)

Figure a way to convince your boss that BigData is the solution. Tell them to invest $5 million in hardware and specialists. Spend 4 years crunching data, charging $1000 per hour of your precious time. By the time they figure out you are just calculating MD5 hashes and selling the DB to malware writers you should have netted a small fortune.

Don't be dicks, you'll get less whistleblowers (5, Insightful)

Anonymous Coward | about a year ago | (#44219475)

Obeying your country's constitution and not operating for the sole benefit of oligarchs and barons of commerce would go a long way towards limiting whistleblowing activity.

If you want to go the opposite direction, I guess you could lock up your employees in a bunker and hold their families hostage.

He shouldn't have been able to access the data (2)

rollingcalf (605357) | about a year ago | (#44219481)

Access to secret data and documents should be on a need-to-know basis, or a practical approximation of it. It's clear that he had access far beyond what he needed to know. If he can't get at the sensitive documents in the first place he can't copy them to USB or use his cellphone to take pictures of them or upload them to his Wikileaks partners.

Re:He shouldn't have been able to access the data (0)

Anonymous Coward | about a year ago | (#44219569)

The point is, somebody has access to it, so there is always a potential leak of any information.

But isn't the real question..... (1)

3seas (184403) | about a year ago | (#44219487)

.... do you really want to?

Nice Try (5, Funny)

Anonymous Coward | about a year ago | (#44219491)

Nice try, NSA.

Limit access (5, Insightful)

Xargle (165143) | about a year ago | (#44219493)

Have separation between levels of security and have fewer & fewer admins working on them as you go up the chain. Use the old established and trusted guys at the top. Don't have thousands of people (particularly contractors) crawling all over the most sensitive data. Seems obvious really. Look at the amount of data *Private* Bradley Manning got his hands on. It's like NSA & Govt just leave the barn doors open and hope the fear of prosecution will prevent the bad thing from happening.

easy (0)

Anonymous Coward | about a year ago | (#44219505)

"don't be evil"

Avoid issue to begin with. (0)

Anonymous Coward | about a year ago | (#44219507)

Hire people you trust. Avoid dodgy unethical / illegal activities. If you treat your employees with respect, on top of those first two, you will seal the deal.

Mainstream Media Propaganda (0)

Anonymous Coward | about a year ago | (#44219509)

Last week /. was calling Snowden a hero. Now he's a "malicious insider."

Re:Mainstream Media Propaganda (1)

seepho (1959226) | about a year ago | (#44219889)

The two aren't mutually exclusive.

Te usual (0)

Anonymous Coward | about a year ago | (#44219511)

Staff need to be vetted before given priviledged access. Staff should have no access to any data other than they need to do there job. Staff should not be able save anything externally in a top-secret. I think the issue with Snowden was that he wasn't properly vetted first.

One other comment is that is would be nice if read-only access meant read-only and not, read and take a copy.

Boom, problem solved. (2)

Sperbels (1008585) | about a year ago | (#44219521)

Explosive collars.

Re:Boom, problem solved. (1)

techsoldaten (309296) | about a year ago | (#44220101)

Chip sysadmins with GPS and use drones as your last line of defense.

Best prevention is brainwashing (1)

Anonymous Coward | about a year ago | (#44219523)

To prevent Snowden-style leaks you're going to have to turn into North Korea. I am sure the DPRK has a manual on this.

Re:Best prevention is brainwashing (1)

Sperbels (1008585) | about a year ago | (#44219793)

Yes, but their manual was written by the CIA.

finance also failed in this area (0)

Anonymous Coward | about a year ago | (#44219541)

We understand tracking dollars way more than information. And the world's biggest breach was by an analyst who was in the business of risk management who transferred to the trading floor. (See Jerome Kerviel:

When in an "old field" like finance with a lot simpler commodity (euro's) the only solution seems to be ethical behaviour from individuals, there is no way we in technology can come up with a better solution.

Stay legal? (4, Insightful)

mike449 (238450) | about a year ago | (#44219545)

How about not doing illegal things in the first place?
A lot of motivation for insiders to disclose the "sensitive" information would go away.

Re:Stay legal? (0)

Anonymous Coward | about a year ago | (#44219669)

How about not doing illegal things in the first place?

You don't seem to have noticed that this is the NSA's raison d'être...

A Big, Scary Federal Government To Hunt You Down (0)

Anonymous Coward | about a year ago | (#44219557)

No explanation, really. The threat of having your life taken away from you is enough to keep most toeing the line.

NSA, is that you? (0)

Anonymous Coward | about a year ago | (#44219581)

So who needs advice doing their job?

Conceptually, it is quite simple. Implementing it, is less so. As with all security (and ACL, hint, hint, hint), the administration is the complex bit.

Kill Chips (1)

Anonymous Coward | about a year ago | (#44219595)

Kill chips. If you sign a contract for security clearance, you're implanted with a kill chip so that you can be remotely disabled.

Its a Sysphian Task (0)

Anonymous Coward | about a year ago | (#44219601)

It is almost impossible to foil a motivated intruder. The best option is always to maintain an operational state where you are invulnerable to intrusion and/or confiscation of property because a) you don't have anything that you can not replace and b) you don't have anything that needs to be stolen by someone else in order for them to use it.

Beyond that, you can gnash your teeth all you want about the "reality" that you percieve and the "need" for secret this-and-that, but you will be locked in a constant and losing battle to keep what is "yours" away from "them".

Breaches (1)

Anonymous Coward | about a year ago | (#44219613)

Flood the network with false information.
Limit job duration.
Use the buddy system.

It is ridiculous to think that you will be aware of most breaches.

Definitions (0)

Anonymous Coward | about a year ago | (#44219637)

In security terms, a trusted agent is one who can damage the system.

Advertorial (1)

David Gerard (12369) | about a year ago | (#44219655)

That's not an "ask Slashdot", that's internal advertising for your article.

The meat of which is advertorial for people paying you to mention them.

Fucking grow a spine.

Don't have secrets (1)

Anonymous Coward | about a year ago | (#44219667)

If you want to prevent leaks, the first step is to minimize the number (and importance) of secrets. Second it so minimize the number of people who know them (hundreds of contractors from the lowest bidders is not ideal). Third is to reduce the incentives for leaking said secrets (make leaking them be bad, not good).

If these programs were effective, they should be been public knowledge. if they were ineffective, they should have not happened (and not been funded!). The logic that programs to protect us from criminals need to be secret is bullshit. The police aren't top secret, nor are trials, jails or courts and they still can do their jobs. I don't see why special "terrorism" criminals need secret spy agencies with secret warrants and monitoring from secret courts. We have an existing non-secret publicly accepted legal system. Use it! If its broken, fix it; don't make a secret version of it.

As usual, convenience is the enemy! (1)

fuzzyfuzzyfungus (1223518) | about a year ago | (#44219671)

The trouble with protecting yourself against insiders is that you are trying to protect yourself against people who need access to do whatever it is you pay them to do. Protecting yourself against external attackers is a massive matter of practical difficulty; but at least it's a coherent objective: keep people who shouldn't have access away from access. Against insiders, virtually everything you do either reduces productivity(so you disabled USB, good thing that there are never any legitimate applications for sneakernet, right?), erodes the warm-and-fuzzy primate emotions that help keep your non-sociopaths from even wanting to hurt you(As a member of the FooCorp family, keep in mind that we log absolutely everything you do because we don't trust you at all, and those logs are just sitting in the IT office should your vindictive manager ever want to hold the five minutes you spent on personal email about your sick kid against you!) or, if you are really good at screwing it up, actually end up concentrating power among certain insiders, or creating incentives among the clueless to learn more about circumvention(Do you know how to get an entire class full of high schoolers to stop shoving geeks into lockers and start begging them for help? Block facebook.)

This isn't to say that it is impossible; but it consists of making a lot of unpleasant choices about how much pain you want to inflict on the mostly innocent in order to scare and/or catch the guilty, who may or may not exist, depending on the time and circumstances.

Re:As usual, convenience is the enemy! (0)

Anonymous Coward | about a year ago | (#44220105)

but it consists of making a lot of unpleasant choices about how much pain you want to inflict on the mostly innocent in order to scare and/or catch the guilty, who may or may not exist

And we've come full circle

Not happening (2)

Khyber (864651) | about a year ago | (#44219681)

Man can make it, man can break it, it's that simple.

No one solution to this... (4, Informative)

mlts (1038732) | about a year ago | (#44219687)

This is an age old problem. It partially requires people skills, and it requires technology. A couple ideas:

1: First thing is compartmentalize. One person shouldn't have access to all the goodies.

2: USB devices are easy to control. I can push a GPO on Windows that blocks writing to any USB flash drive, or just locks out access completely so someone can't hook up their iPod Touch, run iTunes and copy files that way. Third party programs can offer this functionality as well. Of course, there are always BIOS locks. If one doesn't care about reselling machines, snipping wires and epoxy blobs in the USB ports will finish the job.

There are other devices and ports too. Firewire, Thunderbolt, and even PCIe cards can be hazardous. Don't forget the humble old CD-ROM burner in most machines.

3: Watch data and its access. If a Windows admin suddenly is slurping down everything in the accounting directory, and it isn't a backup utility doing this, then someone should be notified.

4: I normally dislike DRM, but I have used an IRM/RMS server in house for protecting files. That way, if someone slurps off a Word document, it works fine if running on my machine, but unless they saved it to another format, it will be encrypted on their end. I've used Microsoft's RMS for about ten years now for personal items, and it does a decent job as a secondary layer, especially when coupled with some other encryption.

5: Get a solution that can make heads/tails over audit logs. Splunk is nice (though expensive.)

6: Add documents that are normally not accessed, but if they are, they immediately trigger an alert from the solution mentioned in #5. That way, if someone is doing a mass copy of files, someone knows. Most likely it is part of the job, but it is wise to have a couple tripwires.

7: Spend your time and do background checks that work. Checking for felonies, yes. Demanding usernames/passwords to Facebook for ongoing monitoring 24/7, no.

8: Finally, morale. A company that always threatens its developers with offshoring, and has low morale will have far more security issues than one that at least knows how to treat people with some modicum of respect.

Re:No one solution to this... (1)

grasshoppa (657393) | about a year ago | (#44219783)

Wow, you missed a big #1: Hiring. IT needs to take control of the hiring process AND someone in IT needs to be trained to recognize personality types. IT, more than just about any other department I can think of, is a well of liability. Both in the data they have access to, and in the proper execution of their job responsibilities. If your hiring process doesn't reflect this reality, then nothing else you do will mean squat in minimizing your liability.

Re:No one solution to this... (1)

tftp (111690) | about a year ago | (#44219907)

3: Watch data and its access. If a Windows admin suddenly is slurping down everything in the accounting directory, and it isn't a backup utility doing this, then someone should be notified.

What is there to stop the admin from restoring the backup onto a separate, local drive and then doing his thing with the databases? Admins are supposed to restore backups now and then, just to test if they work.

7: Spend your time and do background checks that work. Checking for felonies, yes. Demanding usernames/passwords to Facebook for ongoing monitoring 24/7, no.

Snowden had no felonies.

Finally, morale. A company that always threatens its developers with offshoring, and has low morale will have far more security issues than one that at least knows how to treat people with some modicum of respect.

Only if the employees return that respect. Not all of them will. One could be a spy, for example - either sent in ahead of time, or a long term worker who was offered an amazingly good deal for a pile of worthless bits that nobody would even know that they were copied. A company may be good to the employee, but not to the tune of paying off his mortgage or sending his kids to college. Most spies work for less, especially if they are convinced by a trained psychologist that they do the right thing and they are saving the world. (Sometimes this is even true.)

What?! Seriously? (1)

ZarathustraDK (1291688) | about a year ago | (#44219693)

Did the OP get his question rejected from the "Ask Dr. Evil anything"-morning show?

Don't conduct shady business in the first place, how friggin' hard is it? Can you look at a barbed wire-roll for more than five seconds without dreaming about extra-judiciary internment camps? Can you walk past a plank lying on an incline without imagining someone lying upside down on it while being drowned with a wet sock?

I don't care how some people think that doing sh't towards other countries is "part of the game", it's wrong and you friggin' know it! There is no excuse.

I hear privacy is dead. (0)

Anonymous Coward | about a year ago | (#44219735)

So is data security.

Simple - don't be evil. (0)

Anonymous Coward | about a year ago | (#44219741)

If you're worried about whistleblowers you're doing something terribly wrong - and your average tech isn't stupid enough to try and help you out with stopping that.

Easy - Don't Do Anything Wrong (2)

CanHasDIY (1672858) | about a year ago | (#44219743)

Thus, you'll have nothing to hide.

Otherwise, it's a moot point; to paraphrase Mr. Universe, you can't stop the signal, bitch.

From the technical standpoint (3, Informative)

Natales (182136) | about a year ago | (#44219763)

I'm with most of the posts so far regarding the despicable acts of the NSA, but taking the question more down to the technical realm, it seems obvious to me that security breaches coming from the inside of any organization can be mitigated by a more robust defense in depth methodology like this:

1. Access to information in a need-to-know basis only using strong enforcement via MAC. Nobody has ALL the information on a specific subject.

2. All applications are used via virtual desktops accessed from secured, fully managed devices. No access is allowed from unmanaged endpoints of any kind.

3. If some information is as sensitive as described, then physical security enforcement need to be in place (isolated terminal room for example).

4. No printing, no emailing, no networking outside the proper security perimeter.

5. Regular audits and interviews to personnel with access to specific pieces of data.

You'll have to sacrifice convenience for security in environments that require that.

todolist (1)

Korruptionen (2647747) | about a year ago | (#44219767)

What we should probably do is build data centers that take a catch all approach to data... that way, we can fear would be whistleblow... ahem... I mean, terrorists into being so careful online that they don't misbehave.




Oh wait

Self Defeating (1)

Anonymous Coward | about a year ago | (#44219779)

I now work for a company that attempts to do this. It makes me so angry every time stupid arbitrary IT road blocks stop me doing work. Made all the worse because they DON'T WORK.

I have deafeated most of the safe gaurds and now use the internet exclusively through an encrypted tunnel which completely removes all of their nice protections and creates a potential avenue for attack.

These sorts of measures stop 50% of your employees from doing work, and get the other 50% angry, causing them to ruin your security measures anyway.

We don't want to prevent them, duh. (1)

hazeii (5702) | about a year ago | (#44219781)

Some of us don't see Snowden as a malicious insider, some of us don't see people like him as something to be guarded against.

Indeed, some of us see people who expose criminal behaviour as people to be celebrated, to fight for, and to protect.

Ok, the well-connected people don't see it that way (being guided by their pocket). And let's face it, the law is on their side (well, according to their interpretation anyway.).

I wonder what they're going to do, in their gated communities, when the tech who needs to tweak the settings on their artificial hearts decides not to turn up?

Same Problem as DRM (4, Insightful)

Jah-Wren Ryel (80510) | about a year ago | (#44219797)

While all the "don't be evil" responses are cathartic and fun, the real issue here is that you can't simultaneously give someone access to data and prevent them from having access to the data. You can make it more difficult to access the data but the price is that it is more difficult to access the data. You can't read minds so intent is not something you can reliably build into the system.

Its simple really. (3, Insightful)

Nadaka (224565) | about a year ago | (#44219801)

Don't have morally repugnant and illegal secrets.

Re:Its simple really. (1)

znrt (2424692) | about a year ago | (#44219867)

Don't have morally repugnant and illegal secrets.

plus: don't have the ethically repugnant guts to call the public disclosure of illegal activities a "security breach". what a bunch of repugnant unethical morons was this propaganda intended for again? oh wait ...

Good way to prevent leaks ( 100% guaranteed ) (1)

Sla$hPot (1189603) | about a year ago | (#44219807)

Stop recording!
At some point, recording becomes a bigger liability than not recording.
Surveillance is also very exploitable and therefore inherently dangerous.
It might be used for good today, but who knows what it will be used for tomorrow and by whom?
Every time it is misused the "terrorists" wins a small victory.

Focus on insiders first (3, Interesting)

swillden (191260) | about a year ago | (#44219811)

Not really an answer to the question, but good security design should focus on identifying all of the relevant threats (aka a "threat model") and mitigating all of them to the degree that makes sense -- and any good threat model will inevitably identify insider threats as the highest risks most at need of mitigation, because, by definition, insiders have greater opportunities to conduct attacks, and they have roughly the same motives as external attackers.

If you find that your organization doesn't spend 95+% of its security time, money and effort on foiling insider attacks, it's almost certainly not doing a good job. If it is adequately hardened against insiders it'll be darned near impossible for outsiders.

My impression of the NSA has always been one of an extremely high degree of competence, so the Snowden leaks surprised me. You can't stop insiders from gaining access to the data they need to do their jobs, of course (though you can often segment job responsibilities to minimize it), but you can and should make it a lot harder for them to get access to other sensitive data, and Snowden was apparently able to get a lot of stuff that wasn't relevant to his responsibilities.

Best way to stop bleeding? (0)

Anonymous Coward | about a year ago | (#44219813)

Don't get cut.

Simple: (3, Interesting)

gerardrj (207690) | about a year ago | (#44219897)

Stop doing things that seem illegal or immoral to your employees. Stop lying. Stop cheating. Stop cowering behind secret courts.

As people say about the data collected by the NSA: if you haven't done anything wrong then you have nothing to hide. The NSA was hiding this program because they knew it was wrong.

Next time you're trying to get help here (1)

Dirk Becher (1061828) | about a year ago | (#44219921)

don't mention the name "Snowden"in the title. Instead, he should have passed himself as a south-american business agency fearing CIA moles. In the best case, he will get a very efficient document streaming service.

The answer is literally decades old. (1)

geekmux (1040042) | about a year ago | (#44219929)

I'm curious, has anyone in government intel circles ever heard of compartmentalization before? I'm pretty sure based on the TS/SCI clearances they issue to those working with (what should have been) compartmentalized data would know of this rather obvious concept.

Bottom line is they know the importance of data compartmentalization. This has been a standard practice for decades now, even keeping those at the highest levels in the dark with the additional "need to know" addendum.

I can't help it if utter stupidity and ignorance stepped in, and chose to simply dismiss good protocol and practice to subscribe to sensationalist ideals such as "anti-terrorist interoperability" across all intelligence organizations via shared databases and intel streams. You want access to all of the data at a moments notice? Then you should know damn well what the ultimate cost of that is. Don't bitch about a lack of eggs when someone steals the whole damn basket.

Nothing can be done... Nothing (3, Interesting)

mendax (114116) | about a year ago | (#44219973)

No matter how deep a background check goes, no matter how thorough the inquiry is into a person's character, no matter how many interviews are made of friends and family, and no matter how many polygraph tests are performed, if a person is given a position that requires some trust there is always going to be a chance that this person is going to abuse the trust. Psychopaths and sociopaths the the scariest of these people because they have no problem with lying, are good at it because they are usually good at being manipulative, are often very well liked by family and friends, and can lie without end like a baby-kissing politician running for re-election and still pass a polygraph test.

Perhaps the problem is in the kind of people being sought for these jobs that require great trust. While a person needs to be squeaky clean to get security clearance, perhaps the squeaky clean requirement is causing the government to choose some from the wrong pool of candidates. My experience has been that you will have a better chance of finding an honest man (or woman) by looking at those who have messed up in his or her life, is genuinely repentent, and has demonstrated through years of clean and honest living that he or she is worthy of such great trust. The gratitude that comes from being given this second chance is an incredible motivator in steering a straight and narrow course through life.

Oh DLP..... (1)

Anonymous Coward | about a year ago | (#44219983)

AC for obvious reasons....

I work directly with the CISO for a big corporation and have inherited a DLP System that I now 'own'. We've seen some very crazy incidents and it's already shown it's value a few times. I know of 1 termination and multiple HR disciplinary incidents stemming from our system. Yet the signal to noise ratio is abhorrent and this is with almost 2 years of testing and tuning policies. Besides, you can never stop the bad guy taking screenshots (with a real camera!) or using steganography, or just making hard copies of the PCI/PII/etc we're trying to protect. No DLP (or any other solution) is going to give you both 100% coverage and 100% visibility. Hell, find a savant with great Eidetic memory and they could just read everything and walk out with it in their head.

Drake, Binney, Snowden (0)

Anonymous Coward | about a year ago | (#44219993)

Only a "portent of things to come" since you pull shit @ your "masters"' (Jew-Nited States of AMERIKA) request that are ABOVE YOUR CHARTERS' STATION (which is not continental U.S. citizenry), and thus YOU are breaking the laws here if anyone has. You're going to see a LOT MORE OF THOSE GUYS in my subject-line because of the reprehensible shit you have pulled, and will continue to be exposed in: Mark my words boys - You guys really F'd up! Being caught worst of all. Incompetence right there, but the point is, you got caught outright LYING to the congress/house/senate too. Is anyone is jail for it yet? Hell NO! There ought to be, and it's not Mr. Snowden in that case either. Funny part is, you all have "dirt" on one another. Rats, always do. This is why nobody's being taken down in your 'company', and you know it, we know it. I know it. I know your kind. Weaselish SCUM! I can see that now "If Nino Brown's goin' down, y'all are going down". Rats in a burning house, or rather rats trapped in a ship, no food left. Rats being eating one another. The entire house of cards goes down then, all the way to the top (way past you NSA guys), and you know that too. "Deny, deny, deny!!!" isn't helping now guys. You fail. The more you keep "reacting" as you do going after the guy who showed us you're fucking SPYING ON US, YOUR OWN PEOPLE, the more you give the game away. Go FUCK yourselves. You sold your souls to the "controllers" who run the Eisenhower Military Industrial Complex a long time ago, and we all know it.

Don't do anti-social anti-democratic things! (2)

davydagger (2566757) | about a year ago | (#44219999)

Its as simple as halting creepy anti-social, anti-democratic, and anti-freedom police state activities, lying about them, and justifying it with how much you hate/think lowly of the general population, and how you'll easily get away with it.

Then mabey the people who work for you won't question your blatant lack of morals.

full body cavity search (1)

Joe_Dragon (2206452) | about a year ago | (#44220047)

and having data in a vault with armed guards on the out side 24/7.

Deterrent (1)

hessian (467078) | about a year ago | (#44220095)

Assassinate Snowden.

(Probably not the answer anyone wants to face, but ask your inner Machiavellian.)

Load More Comments
Slashdot Login

Need an Account?

Forgot your password?