Study notes link between IT sabotage, work behavior
Workers who sabotage corporate systems are almost always IT workers who exhibit specific negative office behavior according to recent research.
That is the conclusion of the U.S. military in conjunction with Carnegie Mellon University's Software Engineering Institute Computer Emergency Response Team (CERT) program, which together analyzed insider cybercrimes across a variety of critical industry sectors.
The research suggests that potential troublemakers should be easy to spot. Nearly all the cases of cybercrime investigated were carried out by people who were "disgruntled, paranoid, generally show up late, argue with colleagues, and generally perform poorly."
According to the research, 86 percent of those who committed cybercrimes held technical positions and 90 percent had system administrator or privileged system access. Almost half -- 41 percent -- of those who sabotaged IT systems were employed at the time they did it but most crimes were committed by insiders following termination. Most incursions -- 64 percent -- involved VPNs and old passwords that had never been terminated, highlighting a lack of security controls and gaps in their organizations' access controls.
As a result, Carnegie Mellon has developed a methodology that it said can help detect insider threats as early as possible, involving management, IT, human resources, security officers, and others who "must understand the psychological, organizational, and technical aspects of the problem, as well as how they coordinate their actions over time."
The university's study, Management and Education of the Risk of Insider Threat (MERIT): System Dynamics Modeling of Computer System Sabotage, is available here.
According to security management vendor Calum Macleod of Cyber-Ark, most organizations are leaving themselves exposed by "not paying due care and attention to the people who are charged with looking after their systems and applications." Even outsourcing cannot resolve the problem fully, he said.
Macleod's solution is password management. This means ensuring that policies and standards are in place to control administrative access by containing the number of privileged accounts to three or fewer. This reduces the difficulty of managing those accounts. Passwords also need to be changed regularly.
Macleod concluded: "So as far as doing the right thing, I'd suggest that you start from the basis that your IT staff are the biggest risk to your organization's security, and if anyone of them disputes this, remember that arguing with colleagues was one of the clear signs of an impending attack.
"And automate the whole process. If privileged password management is not on your shopping list in 2007 it may already be too late."
» posted by abennett
Techworld.com
Sign up for ITworld's Daily newsletter
Follow ITworld on Twitter @IT_world
jfruh
Apple syncing patent can't come soon enough
pasmith
New Twitter features borrow from 3rd party clients
Esther Schindler
Open Source Changes the Software Acquisition Process
mikelgan
How to set up continuous podcast play on the new iTunes
David Strom
Five important Windows 7 mobility features
sjvn
Guard your Wi-Fi for your own sake
Sandra Henry-Stocker
Grepping on Whole Words
Sidekick: The Good News & the Bad News
Either way you look at it Microsoft Data Center management did not follow standards or best practices in this failure. In which case it makes me wonder more about the outsourcing of corporate data much less personal data.
- mburton325
Join the conversation here
Quick, practical advice for IT pros. Made fresh daily.
Want to cash in on your IT savvy? Send your tip to tips@itworld.com. If we post it, we'll send you a $25 Amazon e-gift card.














This is the DUMBESTthing
This is the DUMBESTthing I've ever heard of. It is simply more mind reading attempts by voodoo artists. This kind of stuff poisons-the-well when people like me, who have integrity, try to defend themselves against malicious managers.In fact, the single more dangerous person to my organization is my immediate manager. His characteristics follow:
1) over committed
2) arrives at work early and leaves late
3) constantly sabotages employees work (documented fact).
4) manager constantly modifies web site files without notification.
5) manager constantly assigns work and demands unrealistic completion withing a few minutes or hours at the end-of-the day.
The list goes on.
Funny how they always assume the employee is guilty and never nail the managers.
Such is the new American slavery, scape goating, and employee sabotage by American business manager who get away with murder.