You've gotta give this guy 10 out of 10 for initiative
===================================
By Jaikumar Vijayan - January 17, 2013 - Computerworld
Showing what can happen when companies don't periodically review network logs, a software developer working for a large U.S. critical infrastructure company hired a Chinese firm to do his job so he could spend time surfing Reddit and watching cat videos.
Details of the 2012 incident, investigated by Verizon's security services group, was recounted this week in a blog
http://securityblog.verizonbusiness.com/2013/01/14/case-study-pro-active-log-review-might-be-a-good-idea/ post by Verizon security researcher Andrew Valentine.
Last May, the unidentified company's IT security department started monitoring logs generated at their VPN concentrator and discovered an open and active VPN connection originating from Shenyang, China.
"This discovery greatly unnerved security personnel," Valentine wrote. "
They're a U.S. critical infrastructure company, and it was an unauthorized VPN connection from China. The implications were severe and could not be overstated."
The company had created a
two-factor authentication process for VPN connections.
........................................
The developer, said to be
in his mid-40s, was a long-time employee, a family man, inoffensive and quiet. "
Someone you wouldn't look at twice in an elevator," Valentine noted in his blog.
From, there, investigators quickly pieced together what happened.
"As it turns out, Bob had simply outsourced his own job to a Chinese consulting firm.
Bob spent less that one fifth of his six-figure salary for a Chinese firm to do his job for him," Valentine said.
He had
FedExd his RSA token to the Chinese firm so that the company could log in and work using his credentials. Meanwhile "Bob" was typically in his office at the company from 9 a.m. to 4:30 p.m. watching cat videos, reading stories on Reddit and spending time on eBay, Facebook and LinkedIn, the blog post said.
At 4:30 p.m. most days, he would send an end of day update to his managers."Evidence even suggested he had the same scam going across multiple companies in the area. All told,
it looked like he earned several hundred thousand dollars a year, and only had to pay the Chinese consulting firm about fifty grand annually," the blog post said.
Bob's superior's had rated his work as excellent quarter after quarter. Computerworld full storysecurityblog
