Cry For Help: One-Third Of IT Security Staff Say They Could Hold You Hostage

Written by Frank Hayes
June 1st, 2011

A survey released last week (admittedly by a vendor that has a stake in the answers) says that one-third of IT security staffers could tie up their companies by withholding access to encryption keys. That’s an astonishing statistic—especially when half the survey’s respondents said their companies had set up systems so they couldn’t hold the business hostage that way.

Those results suggest that keeping encryption keys, administrative passwords and other IT security elements from being under the control of a single employee is possible, and even practical, but that too many companies aren’t following up on it. And last month brought a reminder of how big a problem that can be: A judge ordered a former San Francisco network engineer to pay $1.4 million in restitution for locking city IT managers out of the city’s network for 12 days.

It appears that the only thing standing between this scenario and many retailers may be the goodwill of IT staffers. According to the results of the survey released by Venafi, which polled 500 IT security specialists at a European security conference in April, 36 percent said they could essentially do what Terry Childs did by refusing to turn over encryption keys. Thirty-one percent said they could take the keys with them after they quit and still access sensitive information remotely. And 43 percent said if they left the company they could still wreak havoc on its networks.

Again, in each category, most of the security people said that type of problem didn’t exist in their companies. The organizations with the security holes are in the minority—but they’re an uncomfortably sizable minority. Yes, those results come from Europe and they’re not broken out by the industries these IT security people come from, so there’s no way to know how many work for retailers. For that, we’ve just got one recent data point: the Gucci network engineer who was indicted in April after he was fired and then allegedly blocked access by Gucci to documents and E-mail for nearly 24 hours, deleted other documents and E-mails, deleted virtual servers and cut off E-mail access to both corporate and Gucci stores for most of a day. Total estimated cost: more than $200,000.

Is that a common occurrence? Of course not. But it probably happens far more often than is reported, because companies prefer to handle such problems quietly. That’s not only because businesses want to avoid bad corporate publicity. Whenever an IT staffer goes rogue, there’s usually a security hole big enough to drive a getaway car through. And that fact reflects whether it’s a single person in control of passwords or encryption keys, sloppy procedures on the part of support staff (that Gucci admin allegedly managed to get a VPN token activated weeks after he was fired) or some other failed security policies and procedures.

But if a third of IT security people say those types of conditions exist at their companies, it’s a cry for help. They’re obviously not planning on taking advantage of those problems (otherwise they’d be hiding the security issues, not talking about them in a survey). They also apparently can’t do anything about the problems by themselves.

Retailers are pretty good about handling payment-card data, because they have to be—PCI failure costs money with every transaction. Standards are lower for securing other business data, especially customer data in CRM systems, which has now become the target for a string of recent intrusions—ranging from Epsilon to Sony. Internal rules for handling things like encryption keys and administrative passwords? They’re way down on the list of concerns.

They shouldn’t be, though. You have to be able to trust your IT security team. They have the ability to do more damage than anyone else in your organization, which means they can potentially steal anything, lock down anything or cripple everything in your IT infrastructure. But if paranoia is the hallmark of a security person, then these are the very people who will understand best why you can’t afford to trust them completely.

And when one in three of them say they can hold the business hostage, you can be pretty sure they don’t want to be that type of threat.


One Comment | Read Cry For Help: One-Third Of IT Security Staff Say They Could Hold You Hostage

  1. Patrick Dooley Says:

    This has been a problem for years. It is an across the board problem on all operating systems. The industry provides no internal audit tools and 90 of all advertising and therefore security money is spent on building walls to thwart external predators. Meanwhile back at the shop internal administrators have no auditing done on their IDs and the auditing that does happen rarely gets reviewed. The house of cards is ours.


StorefrontBacktalk delivers the latest retail technology news & analysis. Join more than 60,000 retail IT leaders who subscribe to our free weekly email. Sign up today!

Most Recent Comments

Why Did Gonzales Hackers Like European Cards So Much Better?

I am still unclear about the core point here-- why higher value of European cards. Supply and demand, yes, makes sense. But the fact that the cards were chip and pin (EMV) should make them less valuable because that demonstrably reduces the ability to use them fraudulently. Did the author mean that the chip and pin cards could be used in a country where EMV is not implemented--the US--and this mis-match make it easier to us them since the issuing banks may not have as robust anti-fraud controls as non-EMV banks because they assumed EMV would do the fraud prevention for them Read more...
Two possible reasons that I can think of and have seen in the past - 1) Cards issued by European banks when used online cross border don't usually support AVS checks. So, when a European card is used with a billing address that's in the US, an ecom merchant wouldn't necessarily know that the shipping zip code doesn't match the billing code. 2) Also, in offline chip countries the card determines whether or not a transaction is approved, not the issuer. In my experience, European issuers haven't developed the same checks on authorization requests as US issuers. So, these cards might be more valuable because they are more likely to get approved. Read more...
A smart card slot in terminals doesn't mean there is a reader or that the reader is activated. Then, activated reader or not, the U.S. processors don't have apps certified or ready to load into those terminals to accept and process smart card transactions just yet. Don't get your card(t) before the terminal (horse). Read more...
The marketplace does speak. More fraud capacity translates to higher value for the stolen data. Because nearly 100% of all US transactions are authorized online in real time, we have less fraud regardless of whether the card is Magstripe only or chip and PIn. Hence, $10 prices for US cards vs $25 for the European counterparts. Read more...
@David True. The European cards have both an EMV chip AND a mag stripe. Europeans may generally use the chip for their transactions, but the insecure stripe remains vulnerable to skimming, whether it be from a false front on an ATM or a dishonest waiter with a handheld skimmer. If their stripe is skimmed, the track data can still be cloned and used fraudulently in the United States. If European banks only detect fraud from 9-5 GMT, that might explain why American criminals prefer them over American bank issued cards, who have fraud detection in place 24x7. Read more...

Our apologies. Due to legal and security copyright issues, we can't facilitate the printing of Premium Content. If you absolutely need a hard copy, please contact customer service.