By Kurt Seifried, [email protected]
Like a spinning top, our situation is extremely stable as long as things are moving fast enough but it will slow down, start to wobble, and eventually crash.
Several technicians clad in white overalls leave a room deep in the sub-sub-basement at Acme Corp. Separating from the group, one of the technicians approaches Jeff.
"The room is clean. We'll start our building sweep now. You're sure you want us to do the entire building? It's not cheap, you know."
This overtime bonus will be massive. The lead technician grins and wanders off to find his coworkers.
As they file into the room, looking rather grim, the senior IT staff of Acme Corp glance around. They're not quite sure they believe that the room is not electronically bugged. Jeff closes and locks the door, and then decides that wedging a chair under the knob might be a good idea as well. His eyes dart around the table and he sighs quietly.
"Uhmm. . . let me start by saying I'm sorry, Cindy, but it looked pretty bad. I didn't think they'd charge you with treason, either."
Cindy glares. Then she bounces an empty coffee mug off Jeff's forehead. "You better not fall asleep in the same time zone as me, lest you wake up in a tub of ice, buddy!"
Dragging himself upright with the help of a chair, Jeff winces. "OK. . . enough. Please, stop throwing things already!"
"Forty years of forced labor in marketing! Forty years!"
Staring at Cindy with fear, Andy clears his throat and decides to get things moving. "Maybe we should put that behind us for now and deal with our current problems."
Jeff nods and winces as the blood sloshes forward in his head. "Ooogh. . . yeah. . . I think it's safe to say we've had a major security breach. Someone with physical access to the building"
Andy interrupts. "Or the attacker bribed someone to do it!"
"Right. . . but the fingerprints on the devices didn't match. So let's assume it was an outsider that's not on file."
Andy taps a pencil on the table gently, in deep thought.
"Look, the attacker got in pretty deep and we kicked him out. Chances are he'll be back, so I suggest we pretend that everyone is back to normal, but keep a close eye on everything."
Jeff nods, keeping his eyes on Cindy in case she decides to hurt him again.
"I've had security install some more cameras, including several in the server room, and I'll be sleeping under my desk with the alarm rigged to wake me up if anyone goes into the server room. Every attack has been more elaborate and risky, so I think the server room is the logical place to strike. Stealing one backup tape would accomplish the same thing as all the other work."
|Backups are important and should be kept securely, especially the offsite ones. It hardly makes sense to spend effort securing your network and the data on it if you do not secure the backups of that data.|
"I'm going home to spend some time with my niece," Cindy says. "I won't be coming in tomorrow."
"Fine by me," Jeff replies. With her not at work, there is less danger of more bruises from flying coffee mugs.
The meeting breaks up. Andy pulls the chair out from under the doorknob and looks at Jeff. "Well, I just hope in future we can tell each other about any problems, rather than narcing on them to the security directorate."
Jeff nods, wincing again as his brain smacks the front of his skull. He wanders off to his office, loosens his tie and curls up under his desk. He yawns before tugging the blanket up and closing his eyes.
Cindy folds her cell phone up and stomps down on the accelerator. Passing an ambulance, she swerves across five lanes of traffic to the offramp. She glances at her watch and frowns, narrowly avoiding running over a startled squeegee kid. Tires squealing, she leaves a long black trail terminating in front of her sister's house. She hops out of the car and glances at her watch again. It's better late than never.
"Hey Mindy, where's Samantha?"
"She left an hour ago. . . she was really angry." Mindy turns around and sorts through some stuff on the table. "She left this for you."
Opening the envelope, Cindy frowns and unfolds the letter.
I'm sorry, but I can't go on like this. Everyone hates me and I need to do what the voices in my head told me to. Please don't forget to feed my fish.
Cindy looks up. "I told you to make her take her medication! Do you know where she was going?"
Mindy shakes her head. "All she said is that someone stole the key to her ghost. . . she wasn't making much sense."
Across the city in Jeff's office, we hear a loud klaxon. A startled Jeff bangs his head against the underside of his desk.
"Ahhh, shut it off! Shut it off!"
Realizing he is the only person around, Jeff crawls over to the alarm and switches it off. He looks up at the monitor. A short figure clad in black is trying to jimmy open the tape cabinet.
Jeff blinks a few times. His brain slowly processes the information; eventually a neuron fires (later to be identified by science as a panic neuron). Turning quickly, he flings the door open and goes running towards the server room.
|If you detect an intruder, you might want to call security before confronting anyone.|
Jeff punches the code into the door lock, but gets it wrong the first time. He takes a deep breath and gently taps it in. He breathes out as the light turns green.
"You! By the tape cabinet! Stop!" Hmm. He should have called security.
The intruder looks up, surprised. She stands and takes a swing at Jeff with a crowbar. Avoiding clumsily, Jeff grabs for her, but instead of gaining a firm grip succeeds only in pulling her balaclava off. "You! Samantha? Did Cindy make you do this?"
"No, stupid! It was me all along!" Grunting, she takes another swing at Jeff. The bar sinks into his stomach; gasping for air, he stumbles backwards.
"It was going to be perfect! I'd steal all your R&D and sell it to EMCA, and then me and Cindy would move to Borneo and live happily ever after!"
Jeff stumbles away from her, backs into the tape storage rack and falls down. He looks up, gasping for breath and holding up a hand to protect himself. Samantha lunges forward looking to finish him off, but suddenly stops.
Jeff finally gets his breath back. "I'll kill you!"
Samantha backs off slightly. "Look out! The"
With a loud crack, the raised floor has given out. The tape storage rack tips forward violently, falling onto Jeff with a wet squelching noise.
Samantha pales and steps forwards to see if Jeff is okay. She begins to look decidedly ill. She turns away, wiping a tear from her cheek, and leaves the server room.
Cindy enters the room several minutes later. She spies the tape rack on its side and advances cautiously. Letting out a movie starlet-quality shriek, she passes out on the floor.
Has Jeff died? Will Cindy take the rap? Does Samantha make it to Borneo? Stay tuned, same bat channel, same bat time.
Rubbing the back of her head, Cindy sits up groggily. With a startled expression she looks over at the tape rack and then stands upright. She walks over to the phone and dials.
"Hello, security? There's been an incident in the server room. I need you to call the police and seal the building no one goes in or out. I also want you to immediately find a member of the board and check on the surveillance tapes to make sure they're OK. Also, I need a security guard down here now to guard the door."
|Do you have a plan for sealing the building and
preventing an intruder from leaving? Are there enough
security people to guard all the fire exits, or do you
have teams of employees that can do so? Is the room with
all your surveillance recording equipment hardened and
Most people think of physical security as simply keeping people out of a building, but you may also need to keep them in. What's more, surveillance equipment is only good if you have the tapes. If an attacker steals or damages them you may have no evidence. When you must check something critical, send at least two people so that there is a witness.
"Yes ma'am. What should I tell the police?"
"Tell them there was an incident in which an employee may have been killed, but things are a bit confused at the moment."
Glancing around she notices several missing floor tiles, and a strong scent of ammonia. Blinking, she inspects the room, behind equipment and into the raised floor as well as the false ceiling.
|If something big (or small) is stolen or missing, it might still be in the building. Closets have a tendency to be ignored. They also make a good place to hide network sniffers.|
Cindy walks out and jogs over to the security desk.
"Are the tapes OK? Has anyone tried to leave the building with a big bag or box?"
"Charlie is just checking the tape room with Mr. White, and no, I haven't seen anyone leave through the main entrance with a large bag or box."
Cindy nods, feeling a bit relieved. Perhaps Jeff's death was staged as a practical joke by the R&D team.
"Hey Dave, I'm in the surveillance room with Mr. White, and some of the tapes are missing. Tapes for the server room, several hallways and one of the exits have gone missing. We're going to lock the room, and I'm staying here to make sure no more tapes go missing."
Cindy looks rather pale. She sits down and takes a deep breath.
"Dave, can you please tell Charlie to tell Mr. White to come to the security desk? Also, I want you to call in all the guards on the emergency call sheet and have them here immediately."
Dave nods and pulls out a list. "Ma'am, if you don't mind me asking, what the heck is going on?"
"I'm not entirely sure, but I think something serious. I went into the server room. . . and. . . and" Wiping a tear from her eye, Cindy stifles a sob. "I think I saw Jeff's body, he was dead. . . but I passed out. . . and when I came to. . . he was gone."
|If you're not quite sure what is going on during a security incident, it is best not to make conjectures and theories public, although the team handling the incident should probably be told.|
Dave nods and opens up a drawer. He pulls out a bottle of brandy and pours some into a paper cup. "Drink this, it'll help calm you down."
Cindy gulps the drink, coughing as the 80 proof "Old Stinky" brandy hits her throat. "This stuff is terrible!"
Dave grins. "Why do you think I keep it at work? It's the only stuff the cleaners won't drink!"
A white sedan pulls up to the front. Two large men in cheap suits enter the lobby.
"Which of you is Ms. Plunkett?"
"I am. . . er, Mr. . . .?"
"Detective Pembleton, and this is Detective Bayliss. We're with homicide. What seems to be the problem?"
Cindy coughs and relates her tale to them, wiping tears from her eyes as it progresses.
"Can you take us to the server room?"
"Of course. Dave, any word on the extra guards?"
"Yeah, they should be arriving in the next 10 to 20 minutes."
Cindy leads the two detectives to the server room, unlocks the door and points. "In there, in the far corner. . . where the floor tiles are missing. Watch your step." Looking away, she leans against the wall and closes her eyes.
Detectives Pembleton and Bayliss walk into the room, careful not to touch anything. Crouching in front of the missing floor tiles, Pembleton stares intently at the floor.
"Those look like blood stains on that edge, and there on the floor."
Bayliss nods and glances around. "So, uhhh. . . looks like he hit his head on that big. . . tape rack and the killer removed the body and the tiles and tried to clean up."
"Correct let's get forensics down here."
"I'll talk to the lady and get her story, if you could get the tapes. . . and any entry log books. And interview the guards."
Pembleton stands and follows Bayliss out. Stopping, he turns to the guard. "No one has entered or left the room since Ms. Plunkett left?"
"No sir. And this is the only door."
Pembleton nods and wanders back to the security desk.
Bayliss turns to Cindy. "So, you knew Jeff well?"
"Well. . . sort of, we worked together, but he's only been here a few weeks."
"Did he have any enemies? Has anyone been fired recently?"
"No. . . I mean, we had a few security incidents, but there's no personal contact. And we haven't fired anyone recently." Gulping nervously, Cindy thinks about Samantha's room.
"And, well. . . My niece, Samantha, she . . . she broke into our network, and stole some R&D plans. . . and, well. . . I don't think she's been taking her medication."
Bayliss glances up from his notepad. "Have you got an address for her?"
Cindy nods. "But I already checked there, she left. . . . The address is 12816 Baywood Lane. Her mother's name is Mindy."
"OK. We're going to have a forensics team go through the room, standard procedure really." He pauses. "Will the dust we use for fingerprints be a problem?"
Cindy is switching mental gears. "Well, I suppose so. But we can turn some stuff off and move it. I guess you have to dust for prints, huh?"
Meanwhile at the security desk, a rather frustrated Pembleton is talking to several security guards.
"So you mean to say that with all that equipment, and a locked door that requires a passcard and a security code, someone waltzed in and took all the tapes?"
The guards shuffle self-consciously. They look sheepish.
"We have the entry logs, but. . . the logs show Jeff entering the room approximately an hour ago and leaving five minutes later."
Pembleton blinks. "Jeff is the missing person, correct?"
Charlie nods. "But if the attacker took his passcard and knew the code, he could have gotten in. It's not foolproof."
Pembleton sighs and rolls his eyes up at the ceiling.
"OK, I need all of you to stay put."
Is all the evidence gone? Is your building physically secure? Will Cindy ever forgive Samantha?
Cindy wakes up with dark rings around her eyes. Rubbing her eyes, she rolls out of bed with a loud thump. Groaning, she picks herself up and looks into the mirror.
"What the hell is going on?" Staring at her reflection, she waits a few moments, as if expecting an answer. She sighs and heads for the bathroom to begin her daily rituals. She emerges a while later looking slightly less hung over. Slipping on a pair of sunglasses, she gets into her car and begins the drive to work.
Samantha coughs, choking on the dry Arizona dust. Looking around doubtfully, she heads towards the cafe. She opens the door and glances up at the chimes, wondering where it is they produce cactus-shaped bells. She sits at the counter, dumping her knapsack onto the ground.
"What'll it be, miss?"
"Uhm, a glass of water. . . and a hamburger and fries, please."
Looking over her shoulder, the waitress wonders what the poor kid is running from, or to. Knowing better, she decides not to talk to her, and instead polishes the already gleaming Toast-a-Tron 2000.
Samantha stares at her reflection in the counter and sighs. How did she get into this mess? She's probably wanted for murder. It's not like she was going to hurt him, just wound him a bit so she could get away, but then that tape rack fell on him. She blinks as a plate of food slides between her head and the counter. "Anything else, miss?" Shaking her head, Samantha starts greedily stuffing food into her face.
"When do you think they'll be done, detective?"
"Well, they're finished dusting for prints. We found about a dozen sets. We also took blood and other samples from the room, so we're done with it."
"Thank you. The victim, uh. . . Jeff, do you think he was murdered?"
"Too early to tell. It could be an accident."
"Security tells me they took all the videotapes?"
"Yes. Unfortunately, all the important tapes, the server room, hallways and such were taken, so it looks pretty suspicious."
|Once is a coincidence, twice is statistically improbable, three times is enemy action. If log files or videotapes suddenly go missing, it might be time to conduct an audit and check for signs of intrusion (physical and electronic).|
"Well, if I find anything I'll tell you."
"Thanks. Guess I need to find Pembleton before he makes any more of your guards cry."
Cindy watches Detective Bayliss wander off. Chewing on a fingernail, she spins and slowly walks towards Jeff's former office. Changing her mind, she heads toward the elevators and takes one to the sub-basement.
"Hey, John, you around?" Peering around a corner, she squints into the darkness in search of the building maintenance supervisor.
A rather startled John looks around, and seeing no one, shouts, "Yeah. . . just a minute!" Grunting, he gives the valve another half turn, looking relieved as it finally closes.
"Hey John, how are you?"
"Mmm. . . good, had one heck of a mess to clean up after the police mucked around in the server room. And then we had to replace all those floor tiles on account of. . . ." He realizes better and closes his mouth with an audible snap.
"I came to see you about the building logbooks. I need to take a look at them."
Nodding, John shuffles off deeper into the labyrinth of pipes and ventilation ducts. "What is it you're looking for?"
"I don't know, but when I find it I'll tell you."
John hands her several large tomes. "Well, just make sure you return them."
Waddling under the weight of several extremely thick books, Cindy finally makes it back to her office and dumps them onto her desk. Several hours later she is gazing at the setting sun, wondering what exactly it is she's doing. But she returns to the maintenance logs. Then she stops and her eyes widen over the page, looking first at Jeff's signature on the bottom and then at the purchase order itself, along with a hastily scribbled note:
run 200 feet CCTV cable from server room #1 to office #264 and drop. Overtime ok'ed.
Cindy hurries to Jeff's office, closing the door as she enters. Looking around, she spies a thin black coaxial cable dropped from the hung ceiling to behind Jeff's desk. She crouches and peers under his desk. The only items to greet her are a large dust ball and a tidy pile of coaxial cable next to the workstation. She munches a fingernail and ponders for a moment. Deciding that it probably won't do any harm, she turns Jeff's computer on, hitting F8 before Windows can load. Choosing "Command prompt only," she gets dropped to a C prompt:
C:\>dirVolume in drive C has no label Volume Serial Number is 3GH4-JS83 Directory of C:\COMMAND COM 93,890 12-23-00 10:22p AUTOEXEC BAT 164 12-23-00 10:34p CONFIG SYS 94 12-23-00 10:34p WINDOWS <DIR> 12-23-00 10:42p 3 file(s) 94,148 bytes 1 dir(s) 6,534,242,242 bytes freeC:\>
Cindy realizes her jaw is hanging open. She quickly turns the computer off and leans back, thinking. Deciding caution is the better part of valor, she turns the computer off and unplugs it.
|When hunting for lost data, the only action you should take with the hard drive (or whatever media) is to copy it assuming it isn't physically damaged. You should only work with a copy of the data, never the original, if possible. But our heroine is in a bit of a hurry, and will do exactly what she should not.|
Pulling Jeff's computer apart, Cindy takes the hard drive out and puts it into a spare machine. She digs through her desk and sorts through a pile of CD's, but gives up and dumps them back into the drawer. She picks up her phone.
"This is Cindy. Do we have any disk or data recovery software?"
"Uhmm. . . I don't think so. Why do you ask?"
Stifling a rude comment, she lets out her breath slowly. "Never mind, I've got it covered."
Pulling out her credit card, Cindy fires up a Web browser and heads for a search engine. Several minutes later, she has compared several products and opted for the professional version of Ontrack's EasyRecovery software. Sending her credit card number off into cyberspace to fend for itself, she downloads the software and installs it on the spare machine. She crosses her fingers and fires it up, choosing to recover everything possible on Jeff's hard drive to the large hard drive in the other system. She clicks Next and sits back.
What secrets will the recovery program unearth? Is Samantha headed for Area 51, the real headquarters of EMCA Corp? Do you have backups of your critical data?
Ontrack's EasyRecovery - http://www.ontrack.com/easyrecovery/
Drive Works for Windows 2000 - http://www.dtidata.com/2000recover.html
Windows Recovery Utilities - http://www.winappslist.com/utilities/recovery_utilities.htm
Windows 95/98 Disk Maintenance and Repair Utilities - http://winfiles.cnet.com/apps/98/disk-repair.html
Last updated on 3/20/2002
Copyright Kurt Seifried 2002