Count 1 – Randal installed a backdoor program =
‘gate’ on two of=20
Intel’s firewalls (on separate occasions), which essentially =
enabled him=20
to access Intel’s internal network (to check email) from the =
Internet.
Counts 2 and 3 – Randal who was an advocate of good =
security=20
measures ran the program crack[3] on a password file =
from a=20
system which was within a division that he at one time provided =
systems=20
administration (and still had an active account on, although it =
should=20
have been disabled), to determine the level of compliance based on =
Intel’s=20
password policy. Upon running this, a password was cracked quite=20
effortlessly. To verify his results (from running crack), Randal =
logged in=20
to the system using the cracked userid/password. Randal then =
logged in to=20
a cluster within SSD (which was a division that Randal also no =
longer=20
administered, nor had access to) with the cracked userid/password. =
Upon=20
logging in to the cluster, Randal copied its password file to run =
crack at=20
a later date to determine the level of compliance within this=20
division.
What steps can we take to stop this =
from=20
happening to us?
There are a number of principles =
that can be=20
employed to eliminate or minimize the issues that surfaced in the =
Randal=20
Schwartz case. The flushing out of unauthorized applications (as =
was=20
‘gate’) can be greatly improved by using such =
practices as Separation of=20
Duties and Configuration Management.
Separation of =
Duties
People within the organization =
are the=20
largest category of risk to the LAN and WAN. Separation of =
duties is a=20
key to internal control and should be, designed to make fraud or =
abuse=20
difficult without collusion. For example, setting up the LAN =
security=20
controls, auditing the controls, and management review of the =
results=20
should be performed by different=20
persons.[4]
Configuration=20
Management
Configuration Management =
identifies in=20
detail the total configuration (i.e. hardware, firmware, =
software,=20
services and supplies) current at any time in the life cycle of =
each=20
system to which it is applied, together with any changes or =
enhancements=20
that are proposed or are in course of being implemented. It =
provides=20
traceability of changes through the lifecycle of each system and =
across=20
associated systems or groups of systems. It therefore permits =
the=20
retrospective reconstruction of a system whenever=20
necessary.[5]
Also, we must ensure that we employ =
sound user=20
account management policies and procedures. This includes the =
auditing and=20
subsequent disabling of user accounts for personnel that have been =
assigned new responsibilities (as was the case with Randal, who=20
transferred from one division within Intel to another).
User Administration =
Effective administration of =
users' computer=20
access is essential to maintaining system security. User =
account=20
management focuses on identification, authentication, and =
access=20
authorizations. This is augmented by the process of =
auditing and=20
otherwise periodically verifying the legitimacy of current =
accounts and=20
access authorizations. Finally, there are considerations =
involved in the=20
timely modification or removal of access and associated =
issues=20
for employees who are reassigned, promoted, or terminated, or =
who=20
retire.[4]
An Issue-Specific Security Policy, =
in this=20
example referring to password auditing/assessment, is strongly =
recommended=20
as is creating a personal security policy, which should identify =
and=20
clarify our roles and responsibilities that are beyond the scope =
of our=20
organization’s security policy.
Systems administrators are =
responsible for=20
taking proactive steps to assure the security of the server. =
Examples=20
include regularly checking for weak user passwords and checking =
the=20
system for common security=20
vulnerabilities.[6]
Summary
I don’t think that Randal =
acted with any=20
malicious intent, in fact he didn’t seem to make any =
attempts to stealth=20
his ‘illegal’ activities such as running his backdoor =
program and crack=20
under his userid merlyn. The backdoor that Randal placed on =
Intel’s=20
firewalls appeared to have been installed and used merely out of=20
convenience. Randal knew that he was violating Intel policy, as he =
was=20
warned of these breaches on several occasions, but he chose to =
continue=20
despite the warnings.
Performing password assessments =
should be a=20
part of every security professional’s regimen. We need to =
regularly audit=20
our passwords to identify and rectify our potential weaknesses. =
How else=20
are we to know if our user community is using ‘hard to =
guess’ passwords or=20
not. The path of least resistance seems to be the one that is most =
frequently traveled by attackers, so we need to ensure that our=20
organizations have strong password policies and that they =
enforced. It is=20
essential that we effectively communicate with the user community =
why it=20
is important that they comply with such policies.
I think one of the most important =
points is=20
that we, as security professionals need to ensure that we have an=20
insurance policy in the form of a written personal security policy =
that=20
covers all facets of the tasks that we perform, and that this =
document is=20
authorized and signed by upper-level management. It certainly =
would have=20
greatly impacted the Randal Schwartz case.
References
1. PERL
URL: http://www.perl.com/ (December =
27,=20
2000)
2. Intel Corporation
URL: http://www.intel.com/ (December =
27,=20
2000)
3. Crack and its author Alec =
Muffett
URL: ftp://=
ftp.cerias.purdue.edu/pub/tools/unix/pwdutils/crack=20
(December 27, 2000)
URL: http://www.users.dircon.co=
.uk/~crypto=20
(December 27, 2000)
4. Tipton, Hal and Krause, Micki =
(Consulting=20
Editors) "Handbook of Information Security Management" January 1,=20
1998
5. BS 6488 the British Standard =
Code of=20
Practice for Configuration Management of computer based systems. =
[BS 6488=20
- Ref 4]
URL: http://www.bsi-global.com/ =
(December=20
27, 2000)
URL: http://www.=
dis.port.ac.uk/~allangw/papers/pub97a.htm=20
(December 27, 2000)
6. Administrative Computing =
Security Policy –=20
University of Pennsylvania
URL: http://www.upenn=
.edu/computing/policy/acsp.html=20
(December 27, 2000)
