The Plural of Anecdote is Boring

Dark Reading has an article on identifying the insider threat, although it seems to be more focused on how to spot a bad employee. The article, which seems to be anecdote-based information from Rob Enderle and RSnake, lists the top ten warning signs that you may have a bad employee, or, as they term it, an "insider."

Sure, the insider threat may be a subset of the bad employee, but these ten warning signs don't seem to indicate anything else. The IP thief is not the same as the disgruntled vandal is not the same as the black market carder. The article conflates all these threats, and winds up with recommendations so broad as to be meaningless. For example:

• Excessive absences

Well, this is bad employee behavior. But an employee who is about to leave is no less damaging a threat than an employee who has an ongoing scheme that requires constant maintenance. The classic anti-fraud control of requiring an employee to take vacation seems to run counter to the cited behavior. Is the dude taking extra sick days as dangerous as the dude who routinely funnels dozens of credit card numbers or SSNs to his buddy on CarderPlanet but keeps a low profile?

• Unusual behavior / Office romance gone bad

Bad stuff, but is there really a high enough incident rate to justify it as a "red flag" for a potential bad guy? If not, this advice seems to confuse as much as clarify.

• Employee is terminated / Employee resigns

I believe the employee would be participating in the "outsider threat" at that point.

The real meaty threats and red flags associated with them are a bit more nuanced, and have been hashed out in the fraud investigation field for years. Computer crime is just crime. Vandals are vandals. The computer security industry seems to be genuinely befuddled when encountering a threat that doesn't have a 8P8C modular connector jack.

Image from oronzo.

Bystanders and Heroes

From the Chronicle of Higher Ed comes this link to The Banality of Heroism. It's worth reading, as are a couple other articles that are part of the Greater Good, which I was heretofore unaware.

Some basic questions in the article (co-authored by one of the researchers behind the Stanford Prison Experiment) can be applied to the corporate realm.

This article on the bystander syndrome is also worth reading. If resistance to the bystander syndrome can be learned, it should be part of training for every auditor.

Privacy raised to level of Terrorism, Drugs

This bit from my hometown paper, written by ace real estate appraiser David Lewis, uses privacy, identity theft and terrorism to support his objection to a law requiring disclosure of the amount of real estate transactions. In some ways,

The proposed law is also dangerous. This is the era of terrorism and identity theft. Even the individual investors who make a $1 million or less on a property sale can become targets.

When these sales prices are reported, the information won't become dusty trivia hidden away in the basement of a rural courthouse. The prices will be on the Internet, easily accessible from anywhere in the world. Texans will be exposed. Should the elderly widow have her real estate wealth advertised to crooks and con artists? If we lift the veil on real estate sales prices, we will open the door of opportunity to the criminal element who will misuse this information. These incidences may be rare, but even one tragic case is too many.

According to Mr. Lewis' byline, he was a founding board member of the Harris County Appraisal District. Check out the website. I remember when they used to have sketches of the houses, they aren't there anymore. According to the website disclaimer:

Texas law prevents us from displaying residential sketches on our website. You can see the sketch or get a copy at HCAD's information center at 13013 NW Freeway.

Although hoisting his argument on the image of an elderly Texas widow being robbed of her ranch then being bombed by terrorists is naked fear mongering, there is some point to be made here. As Texas law has acknowledged, there is different level of privacy between public records available on the Internet, and public records you can only get by waltzing into an office and get face to face with a human, J. J. Gittes style.

I don't give a damn about my bad reputation

No. No. Not me.

I was meditating on reputation risk the other day, and behold, the Daily Dave belches forth the documents I sought. (I remembered something on Emergent Chaos on this topic, but hadn't dug deep enough into their archives.)
The study I remembered and cited by Adam Shostack was "Is There a Cost to Privacy Breachs? An Event Study."


The salient quote:

"[Privacy breach] impact is statistically significant and negative, although it is
short-lived."

Which is supported by anecdote (check out the TJX stock price).

So how do you convince your management to follow privacy principles? Appeal to the better angels of their nature? Start eavesdropping and pretexting them and see how they like it? (HP probably did as much good as the CDT, EFF or ACLU as far as advancing the privacy agenda in Congress).

I'm guessing the shift, as a result of the "privacy fatigue" and the "identity theft fatigue" should be to the high risk transactions, that expose the data's subject to verifiable risks, not just the lost computer tape or missing laptop. But I need data to support that, dagnabit. Else:

An' everyone can say what they wanna say, it never gets better anyway.

Stupid, powerless, uneducated.

Infoworld on a session at RSA: The Cybercrime Blame Game.
Although a conference center ballroom may not be conducive to rational discourse (see: US Political Party Conventions), this discussion appears a bit over the top:

• More people complaining about identity theft does not necessarily mean there is more identity theft. I'm sure there was a dramatic increase in complaints about anthrax without a corresponding increase in anthrax attacks. (See the corresponding stat later in the article citing an 11.5% decrease in dollar losses due to identity theft.)
  

• FTC Gorman is right: Calling people stupid doesn't solve anything. I've never been a fan of Winkler's ideas nor his rhetorical method.
  

• The job of an ISP is to move packets, not to sit in loco parentis for everyone with a broadband connection. (Why was this applauded? Were all the NANOG guys still in Toronto?)

• What makes an empowered consumer is not education, but power. Give the consumer the right and responsibility to take care of their own data. Not the credit bureau, federal law enforcement, the ISPs or Wal-Mart. The consumer. Build an infrastructure around that idea. The consumer isn't stupid, he just doesn't care and when he does care, he has no standing. Maybe the empowered consumer idea is just too European.

Safe Internet Day

I find few concepts as boring as "Safe Internet Day." Except maybe "Is Open Source as Secure as Closed Source?" I mean good grief. If it weren't for my incredibly uncomfortable shoes digging trenches into my Achilles tendon, I would have fallen asleep just thinking about writing the above sentence.

How about a pretty chart and a map with like scans and stuff on it?

Still pretty boring.

To hold off the stultification, I've decided to rename the blog. Also, there are other blogs out there about being alone, or cheese, or being alone with cheese, that I feel would dilute my burgeoning brand. And maybe not everyone gets the Omar reference.

So the new name will be:

"Another Set of Teeth" - from "Teeth" by the Mekons

What, no, not another set of teeth
each crisis bites, but not so deep.
What, no, not another set of teeth
And through the shadows we always creep.

I think "through the shadows we always creep" is part of the CISSP Code of Ethics, but I'd have to look it up.

Testing the User or Phunk'd

The Harvard/MIT study of Bank of America's web site security, including SiteKey system and SSL certificate verification (see New York Times and Slashdot), tackles the problem of real users using real websites to see how they respond to the authentication protocols. The security, for the most part, failed the users, with the researchers citing difficulties in testing the usability of these controls.

Slashdot comments, as expected, complain about the intractability of the Trainables in their charge, diminishing the argument to "Users == Lusers."

I couldn't find a fleshy threat model in the study's methodology. The subjects (recruited from Harvard Yard) were asked to log on to the bank's legitimate website on a university computer under the guise of testing usability. Meanwhile, the researchers played pranks on their browsers, causing it to display incorrect information regarding SiteKey and SSL certificates. It seems to me that the researchers were solving for a very narrow set of threats, primarily a man-in-the-middle or a DNS spoofing attack. My understanding of published incidents is that phishing generally originates with a convincingly deceptive e-mail containing a link to a phony banking site, or through a keystroke logger. A more interesting question for me would be "Would the users pay more attention to the security clues if they were following an e-mail link?" The common credential collection trojan appears to be outside the scope of the research.

Since Harvard students should probably pride themselves on not being representative of the populace as a whole, I can't see that there's a tremendous amount that can be taken from this research. The approach seems more like an episode of "Punk'd" (even though I've never watched it) or "Candid Camera" (which I have) or the Jim Coyle/Mel Sharpe stuff (which I love, but no link! I'm shocked!). Is there a difference between a drawing a valid audit (or research) conclusion and just giving a Muntz-esque "Ha Ha" followed by a "Stop hitting yourself"?