Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

One manager i work with insist companies take the time to spy on large competing companies. The company itself does not allow passwords to be revealed by phone or IM with our jabber IM being encrypted (or so i am told) and running on company servers/machines.

Is there any truth to it or is he (and some people in the company) being paranoid?

share|improve this question
5  
Golly gosh no. Everyone in the world is completely honest and no business would ever even consider spying on a competitor. Wake up. –  John Gardeniers Jul 4 '10 at 11:22
    
@John: Tapping phones and sniffing packets on network cables doesnt seem realistic. –  acidzombie24 Jul 7 '10 at 21:36
1  
@acidzombie24 - Perhaps you are unaware of just how easily such things can be done in most cases. –  John Gardeniers Jul 8 '10 at 0:37
    
@John Gardeniers: Phones will have hundreds of hours without much useful information and networks could have gb of data before anything interesting is passed through and thats if you can spot it. It sounds like a lot of resources must be spent. –  acidzombie24 Jul 8 '10 at 2:58
    
I've got a 250GB USB drive. Let's pretend I'm really mad at my company, and their data is very valuable ($$$$) to our competitors. If you were the guy that said "We don't have to encrypt anything b/c everyone is a good honest person" you're likely to be the second person management fires. –  Chris S Jul 14 '10 at 13:54

5 Answers 5

I'm not sure how a password could be revealed by phone. It would never be stored in cleartext anywhere, and no one should know someone else's password.

However, there are companies that specialize in corporate intelligence that you can hire to watch other companies. Not necessarily so nefarious that they try to hack the competition, but, enough intelligence to learn about new products, current products, etc. There are of course black-hat people in companies that will go a step further and probe their competition for security vulnerabilities, etc.

In this day and age of agile development, it takes months rather than years to imitate the competition and write software that is passable enough to gain clients or at least present the product for sale. In other IT businesses, competitive edges are very hard to maintain.

Look at the lengths Apple and other companies go through to keep new releases from the public until they are ready.

Loose lips sink ships.

share|improve this answer
    
you don't know how a password could be revealed by phone? Maybe by someone calling and asking - or intercepting a tech support call? –  warren Jul 8 '10 at 13:51
    
you are missing his point that the password should be stored hashed and that the person on the other end of the phone shouldn't know it in the first place. –  JamesRyan Jul 14 '10 at 14:31

Yes and no. There have certainly been cases of people snooping into the business of other people. There's been cases of people getting access to corporate secrets by sheer dint of social engineering.

If everyone within the company knows that you only ever reveal passwords by encrypted email to within the company or by handing over an envelope with the password inside, anyone who tries to social-engineer access from you suddenly has a bigger problem.

They can't just phone up and go "It's Bertie. YOu know I'm off on holiday" (this information handily provided by the corporate policy on having an accurate out-of-office message) "and I wanted to do some quick checks on the doodah, but it seems my remote access password has expired. Could you reset it and tell me the new one?"

Mostly because they'd then have to say "Sorry, Bertie, you know you have to pick that password up from our nearest office, identifying yourself with the corporate ID badge".

Same thing goes for IM. Can you tell from the chat window exactly where the oter end of an IM conversation is and who's physically present at that end? If you can't, revealing something sensitive runs the risk (remote as it is) that whoever you're talking to isn't who you think.

Of course, there's always the need to balance convenience and security. It may be that revealing passwords over phones and IM sessions is convenient enough (and frequent enough) that it outweighs the security implications. I cannot tell you if that is the case for you.

share|improve this answer
    
+1 Mostly "yes", with some sensible "no" mixed in. –  Chris S Jul 14 '10 at 13:56

Whether this manager is right or not, there is a lot to be said for finding a good balance between behaving as if he is correct, but without stopping the progress of the business.

I hate the term "paranoid" to describe secure business practices, by the way. Unless the precautions are truly over the top vs. the risk being addressed there is nothing "paranoid" about treating company and customer information carefully.

Keep in mind that someone might not only be trying to 'steal' business secrets in the sense of future secret projects, but also things like internal price lists and customer details (useful to a competitor who would like to undercut you).

Also consider criminals who might quite like to steal the list of customer details including credit card numbers from that poorly protected, unencrypted CRM database that everyone knows ought to be updated but no one ever gets around to doing. This latter example has certainly happened often enough to be a real concern.

The precautions you outline in your question are certainly not any evidence of security "paranoia" as far as I'm concerned. I'd say those are part of the absolute minimum standards that any business that was serious about protecting its own interests and liabilities plus those of its customers ought to be doing as a matter of course.

share|improve this answer
    
He didnt want to send me source code through ssh because it 'might' travel outside the network (he didnt know if my machine was inside the network at the time and i had to remind him ssh is secure). This is what made me think he was paranoid but what you and others said here made sense. –  acidzombie24 Jul 7 '10 at 21:42

Realistically, it's always easier to just hire away the humans that engage in what you might assume to be spying (intercepting packets as you describe, etc). I'd be curious to know what sector you're operating in, as that might make a difference in who your perceived adversary is.

An example: A trader from Goldman Sachs left the firm to join a competitor in the high-frequency trading space. He is alleged to have stolen source code from his previous firm.

[O]n Friday, one Sergey Aleynikov was arrested at Newark airport by FBI agents, as he was coming back from a trip to Chicago (maybe visiting his new employer), on what are basically industrial espionage charges.

[...]

In the 5 days immediately preceeding his departure from "Financial Institution" (potentially GS), Sergey allegedly downloaded 32 megs of ultra top-secret quant trading proprietary code, that, according to Special Agent McSwain's affidavit, he then proceeded to encrypt and upload to a website in Germany, with a UK owner

Another classic example is government-industrial espionage, of which the French, Chinese, and others have been accused (and of course they have accused the United States similarly). From a case study on the French:

[This report] examines the industrial espionage activities of a French electrical engineer against an American software engineering company in Northern California. It illustrates the relationships between French government and business intelligence activities and the way in which even the smallest American firms are at risk from sophisticated and focused intelligence tasking and operational activities.

[...]

deGaulle initially authorized the aggressive collection of economic and technological intelligence information in order to assist French companies and industries become more competitive in the international marketplace.

share|improve this answer

The old fashioned dumpster diving is still in vogue and can still provide useful information if an organization doesn't pulverize all paper leaving their offices.

Tail-gating at a secured entrance is common practice even though many companies publish policy statements against it.

Smoke-holes still exist and just because that guy hanging around the company smoke-hole is wearing a Cisco shirt it doesn't mean that he is a legitimate vendor taking a smoke break.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.