Security News > 2001 > February > Spy case demos insider threat

http://www.computerworld.com/cwi/stories/0,1199,NAV47-68-84-88_STO58062,00.html By DAN VERTON February 26, 2001 The career FBI agent charged with spying last week had significant IT experience and access, underscoring the growing threat to corporate data by insiders. The agent, Robert Phillip Hanssen, was charged with spying for Russia since 1985. He allegedly gave Russian intelligence agents highly classified documents and details about U.S. intelligence sources and electronic surveillance, in exchange for an estimated $1.4 million in cash and diamonds. According to a 100-page affidavit filed in the U.S. District Court in Alexandria, Va., Hanssen used his computer access to the FBI's Electronic Case File system, which contains classified information about ongoing FBI investigations, to check whether the FBI had been alerted to his activities. The lesson for corporate America "is that companies tend to gain a false sense of security from strong perimeter security," like firewalls and intrusion-detection systems, said Eric Friedberg, a former computer and telecommunications crime coordinator at the U.S. Attorney's Office in New York. "What goes on behind the firewall can be even more damaging because of the degree of access insiders have." Friedberg is now a computer crime consultant at Stroz Associates LLC in New York. During the past six months, the firm has worked with half a dozen companies that have been victimized by insiders, said Friedberg. Those cases involved everything from deleted files to cases where individuals covertly set up competing businesses on their employers' servers, he said. Because Hanssen was an authorized user, his queries didn't raise any suspicion. However, after Hanssen was arrested while allegedly dropping off classified paper documents for his Russian handlers, the FBI was able to correlate his log activity in the database with his espionage activities. "In short, the trusted insider betrayed his trust without detection," FBI Director Louis Freeh said during a press conference. Freeh has since ordered that a special panel be formed to review all FBI processes and systems and to study the issue of insider abuse. According to a survey of 359 companies by the FBI and the Computer Security Institute in San Francisco, companies lost more than $50 million last year as a result of unauthorized insider access and abuse of IT systems. Some 38% of firms in the survey reported between one and five incidents of insider abuse. Another 37% said they didn't know how many breaches had taken place. Hanssen was assigned to the New York Field Office's intelligence division in 1979 to help establish the FBI's automated counterintelligence database in that office. Investigators characterized Hanssen as having a "high degree of computer technology expertise." Hanssen made extensive use of computer media, such as encrypted floppy disks, removable storage devices and a Palm II handheld computer, to communicate with Russian intelligence officers, according to the affidavit. He provided as many as 26 encrypted floppy disks during the course of his activities, it said. Hanssen used a technique called 40-track mode, in which a floppy disk is made to have slightly less capacity than normal, allowing text to be hidden in what appears to be a blank disk. "Security is not mainly about software or biometrics. First and foremost, it's about people and policies," said Richard Hunter, a security analyst at Stamford, Conn.-based Gartner Group Inc. One way companies can protect themselves from insider abuse is to focus on what their networks can tell them about what's going on inside the company, said Friedberg. He recommended that companies look into artificial intelligence-enabled software that can tip administrators off to anomalous activity on the network. Allen Thomson, a former CIA scientist, suggested that maybe the FBI and companies should consider using the two-person integrity rule for all sensitive database searches and system operations as a means to reduce the chance that information will be deliberately compromised. That means two people would have to agree to the searches and both would bear witness to what was being done and why. The intelligence community routinely uses the two-person integrity rule for things such as handling cryptographic keys and other highly sensitive data. "This would be a pain but might cut down on unauthorized/malicious use," Thomson said. The downside, however, is that this could frighten some users and cause them not to use the tools that are available to them, he said. So, "roaming around and looking for anomalies and patterns is [still] a good thing in many disciplines, counterintelligence among them." ISN is hosted by SecurityFocus.com --- To unsubscribe email LISTSERV () SecurityFocus com with a message body of "SIGNOFF ISN".

News URL

http://www.computerworld.com/cwi/stories/0,1199,NAV47-68-84-88_STO58062,00.html