See your link here
Why security professionals need to document everything
7 comments- IT TOPICS:Security
This story about the New Hampshire state IT employee who was put on leave pending the results of a security investigation caught my eye. The guy is speaking up because he wants his side of the story heard.
Apparently, the guy used an open source security tool called Cain & Abel during a previous security incident response situation. That investigation is documented. I think his mistake was that he left the tool on a server. Along comes the FBI and the U.S. Department of Justice who are running their own investigation; they find the tool and decide that this poor shmuck might be a bad guy.
If the guy really wanted to hide his use of the tool he would not have installed it under his own credentials. He would've installed it using a bogus account with root privileges. And it was dumb to leave the tool on the server, not to mention a security risk. I think the feds are over-reacting and if I were Douglas Oliver, I would've gone to the papers too.
A very important lesson for security professionals is learned here. There must be a formal security incident response process in place that requires sign off from management. The tools and methods used must be described. The results of the response must be documented and signed off again. In that process, there is a clean up stage. If a highly defined process had been followed, the tool would not have been left on the server.
Print
Email this
Digg this
