Stupidity trumps security

The attorney I was chatting with over coffee smiled and then launched into what could only be called a horror story -- at least if you were her client. "My client's soon-to-be-ex-wife apparently wanted to get back at him," explained the attorney, one of the top divorce lawyers on the east coast. "So she got into his office somehow and then used his assistant's computer to send an e-mail message to everyone in the company telling of his affair with one of his coworkers."

We chatted longer, my friend telling of the pain the e-mail caused her client. But I wondered how any company could have security so lax that an outsider could sneak in and send an e-mail to the entire company. Didn't the managers of the company know that they had a responsibility to ensure the privacy of their customers and other employees, as well as to safeguard information critical to the running of the company? Apparently not.

I thought through all of the security holes the scorned wife apparently exploited. First, there was no physical security, or she would never have been able to get into the area with the computers. Second, she was able to get into an employee's e-mail account without knowing any passwords. And third, how was it that she was able to create a message to all of the other employees without knowing who they were?

Now I realize that a bitter divorce can cause the parties involved to rise to new levels of low, but this was more than just simple retribution. Clearly, the person involved in this example had to be able to find out everything she needed in seconds. This is not a sign of a secure network.

I wondered aloud if there was any sign of special training, but my friend said that her client's wife had little computer experience beyond using e-mail. This was apparently a network so insecure that anyone could do anything they wanted simply by walking in the door and sitting down at a computer. Somebody, I thought to myself, needs a lesson in security, and maybe it had finally been taught.

So what went wrong here? From what I could determine, the e-mail had been sent from a computer that was logged into the company network with the e-mail client up and running. The wife simply used that computer to send the companywide e-mail. Apparently, the employee assigned to that computer did not log off when going out for lunch. Worse, there was apparently no provision for logging the user off after a period of inactivity, so computers connected to the network stayed connected.

In other words, this was a vulnerability waiting to be exploited. There were no safeguards. Fortunately, you can prevent such an event on your network with some simple steps. You can set up your screensaver so that a password is required when you attempt to start using the computer again. You can set up your server to detach inactive users. You can require secure passwords. You can put locks on your office doors.

What you can't do is ignore the problem and hope it will go away. It won't go away. Instead, the security problems you ignore will still be waiting for just the right chance to take over your network and scramble your information.