Network World: NET BUZZ: News, insights, opinions and oddities

An ugly look inside

True story (or so I'm told): With Web mail accounts strictly prohibited by corporate policy and the ban enforced by filtering software, the potential customer assured technicians from Reconnex there would be no need to check for this particular security threat as part of the vendor's free 48-hour e-Risk Rapid Assessment.

No harm in checking anyway, the techs assured their prospect.

And, of course, they did find Web mail, the first of which bragged: "Hey, I finally figured out a way to get around this ban on Web mail."

Author Dan Verton, a former Computerworld reporter, has collected buckets full of such tales - many of them far more serious, some downright criminal - in his new book entitled The Insider: A True Story. While every IT professional already knows that security threats from within are often more dangerous than those kept at bay by firewalls, the book shines a spotlight directly on the depth and breadth of the problem.

There are examples and anecdotes aplenty plucked from today's headlines and recent history - who knew that the cosmetics industry was so cutthroat? But the book's most telling tales are gleaned from the first 50 of those risk assessments conducted by Reconnex, a start-up headed by veteran entrepreneur Don Massaro.

"This is real live information taken from large companies and agencies, and in some cases where the person who's doing the criminal activity has not been caught," says Verton, whose previous books include Black Ice: The Invisible Threat of Cyber-Terrorism. "This is what's really happening behind the firewalls."

A pretty picture it isn't, either for the IT executives learning the unvarnished truth or the wayward employees caught red-handed abusing company networks and ignoring policies.

"On many of these occasions somebody - or multiple people - ended up getting fired as a result of the data that was found," Verton says.

"One of the cases really stands out in my mind. It was a major government agency that was just completely drowning in pornography and gambling sites and all kinds of inappropriate content. They thought they had tools that were blocking access to this stuff. They found so much hate and racist content and pornographic content that the people who were in the room from the agency when they got their briefing basically had to get up and leave - it was that bad."

One major advantage of the Reconnex reports is that the information is provided in a format that's easily digestible by not only IT executives but also business managers, according to Verton.

"You don't have to be an IT security expert; it's not bits and bytes," he says. "Managers can do the live forensics on this data and you can see the e-mails, you can see the content of Web postings, you can see the content of FTP traffic, of instant messages, of attachments of all kinds, including encrypted attachments. You get this report after two days, and whether you buy [the Reconnex risk management products] or not, you now know instantly the scale of the problem inside your organization."

One company that felt fairly confident in its policy that everything be encrypted 100% - was startled to learn that less than 20% was actually under lock and key.

Banks were learning that their employees were virtually opening the vaults to identity thieves by ignoring policies governing e-mail correspondence with customers.

"They had no idea that the extent of the problem was such that the employees were telling customers, 'Yes, we'd love to help you open that account; send me your name, address, Social security number, current bank account number, routing number- all this stuff via unencrypted e-mail. These are at major companies with tens of billions of dollars of assets under their control," Verton says.

Near the end of our chat, I asked Verton whether any of the 50 risk assessment reports he read painted a picture of an organization fully in control of its insider threat vulnerabilities.

Answer: "No."

There's no risk in letting me know what you think. The address is buzz@nww.com.