Spy case demos insider threat

[InfoSec News <isn () C4I ORG>]

http://www.computerworld.com/cwi/stories/0,1199,NAV47-68-84-88_STO58062,00.html

By DAN VERTON
February 26, 2001

The career FBI agent charged with spying last week had significant IT
experience and access, underscoring the growing threat to corporate
data by insiders.

The agent, Robert Phillip Hanssen, was charged with spying for Russia
since 1985. He allegedly gave Russian intelligence agents highly
classified documents and details about U.S. intelligence sources and
electronic surveillance, in exchange for an estimated $1.4 million in
cash and diamonds.

According to a 100-page affidavit filed in the U.S. District Court in
Alexandria, Va., Hanssen used his computer access to the FBI's
Electronic Case File system, which contains classified information
about ongoing FBI investigations, to check whether the FBI had been
alerted to his activities.

The lesson for corporate America "is that companies tend to gain a
false sense of security from strong perimeter security," like
firewalls and intrusion-detection systems, said Eric Friedberg, a
former computer and telecommunications crime coordinator at the U.S.
Attorney's Office in New York. "What goes on behind the firewall can
be even more damaging because of the degree of access insiders have."

Friedberg is now a computer crime consultant at Stroz Associates LLC
in New York. During the past six months, the firm has worked with half
a dozen companies that have been victimized by insiders, said
Friedberg. Those cases involved everything from deleted files to cases
where individuals covertly set up competing businesses on their
employers' servers, he said.

Because Hanssen was an authorized user, his queries didn't raise any
suspicion. However, after Hanssen was arrested while allegedly
dropping off classified paper documents for his Russian handlers, the
FBI was able to correlate his log activity in the database with his
espionage activities.

"In short, the trusted insider betrayed his trust without detection,"
FBI Director Louis Freeh said during a press conference.

Freeh has since ordered that a special panel be formed to review all
FBI processes and systems and to study the issue of insider abuse.

According to a survey of 359 companies by the FBI and the Computer
Security Institute in San Francisco, companies lost more than $50
million last year as a result of unauthorized insider access and abuse
of IT systems. Some 38% of firms in the survey reported between one
and five incidents of insider abuse. Another 37% said they didn't know
how many breaches had taken place.

Hanssen was assigned to the New York Field Office's intelligence
division in 1979 to help establish the FBI's automated
counterintelligence database in that office. Investigators
characterized Hanssen as having a "high degree of computer technology
expertise."

Hanssen made extensive use of computer media, such as encrypted floppy
disks, removable storage devices and a Palm II handheld computer, to
communicate with Russian intelligence officers, according to the
affidavit. He provided as many as 26 encrypted floppy disks during the
course of his activities, it said. Hanssen used a technique called
40-track mode, in which a floppy disk is made to have slightly less
capacity than normal, allowing text to be hidden in what appears to be
a blank disk.

"Security is not mainly about software or biometrics. First and
foremost, it's about people and policies," said Richard Hunter, a
security analyst at Stamford, Conn.-based Gartner Group Inc.

One way companies can protect themselves from insider abuse is to
focus on what their networks can tell them about what's going on
inside the company, said Friedberg. He recommended that companies look
into artificial intelligence-enabled software that can tip
administrators off to anomalous activity on the network.

Allen Thomson, a former CIA scientist, suggested that maybe the FBI
and companies should consider using the two-person integrity rule for
all sensitive database searches and system operations as a means to
reduce the chance that information will be deliberately compromised.
That means two people would have to agree to the searches and both
would bear witness to what was being done and why. The intelligence
community routinely uses the two-person integrity rule for things such
as handling cryptographic keys and other highly sensitive data.

"This would be a pain but might cut down on unauthorized/malicious
use," Thomson said. The downside, however, is that this could frighten
some users and cause them not to use the tools that are available to
them, he said. So, "roaming around and looking for anomalies and
patterns is [still] a good thing in many disciplines,
counterintelligence among them."

ISN is hosted by SecurityFocus.com
---
To unsubscribe email LISTSERV () SecurityFocus com with a message body of
"SIGNOFF ISN".