Risktraining.info

Back to Basics

In this section we'll do this on a very basic level just to give some ideas on what can be done, and where things lead. It also acts a good introduction or refresher on some of the basics of technology.

Although this section mainly deals with computers and networks we'll take a brief look at other areas of technology that are open to abuse and should be examined for any potential risks.

These days, the most obvious sign and immediate sign of an office computer network failing tends to be the lack of access to printing facilities; however, with Internet access becoming more and more vital to everyday business operations, a lack of Internet access may soon replace broken printing as the primary "user whinge" when a computer network dies.

Our network is now quite advanced and where it goes from here really depends on the structure of the organisation. In our example now, we are assuming that another department now decides that it wants to link its computers to the existing network. The new department wants access to the bigger printers, the "safe" file store and importantly, the Internet. When more than one department becomes involved it soon becomes apparent that the organisation would be better suited having its own computer (or IT) department. The IT department takes control of the server, and may put a number of smaller departmental servers around the organisation to deal with networked printers. The IT department will have responsibility for making sort the network is reliable, that printers always work, that files are always available and that different departments within the organisation are compartmentalised and secure from one another. It would be embarrassing if anyone within the company had access to the payroll systems, for example. By this point, the connection to the Internet has probably been upgraded so that it runs faster and maybe some access restrictions have been implemented to stop people abusing the link. The IT department has probably by now also implemented electronic mail which will allow the company to communicate not only internally but also with other companies.

Finally in our example company, someone in the Marketing department will probably read an article about having a company website and demand that the IT department build them one. The IT department will then either go their own way and create a server available to people on the Internet via the world wide web (a webserver) or, they will create a website on an Internet Service Provider's systems and transfer data to it as and when it is required.

Questions you should be asking about all of these devices include:

• Who has non-physical access to this?
• Who has physical access to this?
• Would you know if someone accessed or used it?
• Would you know what they did?
• Is the output of this item secure? Can it be accessed or stolen?
• Is there a risk/loss/cost or otherwise involved in abuse of this?

This is a section that could go on for ever, however it is worth looking at a small number of scenarios, all of which actually happen a lot more than you may expect. These scenario's will highlight a number of obvious risks and hopefully will require no explanation.

It is very easy these days for a member of staff to be running their own business whilst at your premises, and on your company's time. There is often an assumption that if someone is sitting in front of a computer looking busy then they are working. This may well be the case, but are they working for you? On the simplest level, people may well just be doing a bit of casual stocks and shares trading or maybe placing the odd bet with their Internet bookies. On a more serious scale, they may well be running their own buying and selling business, using your postal services to ship goods, your printers and photocopiers to produce paperwork and your phone and email/web systems to talk to customers.

A member of IT staff or a computer-literate staff member may consider themselves hard done by or may have been made redundant or even sacked. This member of staff may well know electronic ways into your systems, may have planted "back doors" or may use their knowledge of members of staff to get a destructive virus into your systems. On their way out of the building on their last day they may also pop your computer's backup tapes into their pocket just in case they are useful in the future.

A hacker employed by your competition wants to get into your computer systems. They know very little about your organisation so the first thing they do is to have a quick look through your bins. Luckily for them a whole pile of old printed emails have been thrown away and by reading that, the hacker is able to get a pretty good idea of who a number of people within the organisation are, what they do and what their level of competence. The hacker finds a fairly naive and poorly trained user and forges an email to them instructing them to change their password to "letmein" so that their files can be backed up. The user, knowing no better does as they are told and Later on, the hacker will break into the organisation's computer systems using this users identity and the password they have provided.

A company has a good physical security policy and very restrictive access. A concerned employee wants to know what is happening with the company but they cannot gain physical access to the Finance Director's office. Luckily, they are friends with the cleaners, and ask one of them to sneak the Finance Director's laptops disk out for a few minutes, since the cleaner has access to all of the offices. The employee quickly copies the disk and gives it back to the cleaner to pop back in and nobody is any the wiser.

A member of staff waiting for some documents to print spots some interesting looking staff records sitting by the printer. Whilst they are waiting for their own printing to be done they quickly put the staff records into the nearby photocopier, copy them and put the originals back.

A member of IT staff receives some free training from a network supplier and they very nicely offer him a coffee cup, a rather stylish baseball hat and a bottle of wine. A few months later a number of network components need updating and whilst they are not the best price and they don't do the job very well, the IT staff member buys equipment from the supplier he got the free hat from; after all, it's not his money is it...?

A virus's job is to infect as many systems as possible and modern viruses are very sophisticated and they are getting harder to detect. There are many rumours that a lot of modern viruses are created by the people who write the anti-virus software; this may well have a grain of truth in it but it may also be the case that the virus writers and the virus prevention writers are at constant "war" with one another, and it's us computer users who end up the victims.

A Virus is a tiny computer program that may or may not cause some damage to a computer system. In some ways, the damage that a virus does is secondary to it's main aim in life which is to spread to other programs and computer systems. A virus will attach itself in a fairly "innocent" way to a program or some other items and when that program is transferred to another system, it will spread itself around to other programs, thus "infecting" a new system. Some viruses do nothing at all to the actual computer other than just sit there but some will actually cause damage to files, slow the computer down or even "explode" on a certain date, wiping everything on the computer system out.

A Macro Virus is similar to a normal virus except that they travel around in documents, spreadsheets or other items that are not traditional virus-transport mechanisms. They received their name because they were traditionally transported in Microsoft Word Macros.

There has to be a fine balance between staff education, making your staff realise that they have to report viruses and having a disciplinary procedure that can deal with staff that deliberately put your company at risk.

It is very tempting to "test" a virus scanner with a number of viruses. This is not really a sensible thing to do but it is natural to want to see if they do actually work. If you are going to test a virus scanner with "live" viruses, make sure it is done on a non network-connected machine and that the machine is wiped out and re-installed afterwards.

Whilst this document is not a guide to websites, it is worth looking at some of the Risk and Security aspects of something that has this much exposure.