Practical Information Security Management by Tony Campbell

Author:Tony Campbell
Language: eng
Format: epub
Publisher: Apress, Berkeley, CA

Edward Snowden

Edward Snowden was employed by the National Security Agency (NSA) as a computer systems consultant, with administrator-level privileges to the NSA’s internal network. For whatever reason, and there is much speculation as to whether his story told publicly is the truth or was he simply an unknowing victim of espionage, he used the privileges he had to copy a massive number of highly sensitive, national security documents from their network and released it to the media, claiming it was in the public interest to see what the US government was up to. Snowden had the highest level of clearance and, as such, was trusted by the NSA to run their systems. He proved through this deception and leaking of TOP SECRET information that he was not trustworthy, irrespective of whether his motivations were altruistic or criminal.

Would delegation of administration have stopped this? Potentially it might have helped. If he had of had less rights to NSA systems, then he may not have been able to get the documents off their network. This would have slowed him down considerably as he would have needed to copy the documents off the screen, print them (which may be have been flagged) or somehow photograph them using a smartphone, which again may have been noticed. If he was designing systems, he didn’t need production passwords. If he was administering production systems, he didn’t need domain administrator rights for all his work—he could have been better controlled.

Finally, if all of this was entirely impossible to stop as he needed those rights for his work, then every time an administrator uses a “privilege function” should raise an alert to the security operations team, who should seek a change request or some kind of rationale why the work was being done. As it turned out, none of these controls were in place. Edward Snowden became disenfranchised with the US government for one reason or another and misused his position of trust to leak millions of documents. As a result, he seriously undermined the United States’ national security capability and reputation and could well have jeopardized military and intelligence operations, putting countless lives at risk. Using delegation of administration coupled with comprehensive auditing and alerting, this could have been prevented.

Download

Copyright Disclaimer:
This site does not store any files on its server. We only index and link to content provided by other sites. Please contact the content providers to delete copyright contents if any and email us, we'll remove relevant links or contents immediately.