Submitted by GlennR on
in
Forums
The NY Times has just published a lengthy article on the Russian hacking of the US Democratic National Committee and other organizations. Ignoring the politics, I read it to see what management lessons I could learn. Here are a few. Feel free to add your own.
1. If any employee gets a phone call from the FBI or any other law enforcement agency, supervisors should be notified immediately.
2. Failure to return the agent's calls because you have nothing to report is inexcusable. (90% of all management problems are caused by miscommunication.)
3. Why didn't the FBI agent contact DNC higher ups sooner?
4. The FBI office was only several miles from the DNC office. I understand why email was not realistic, why not get in your car and drive over there? We're talking about a foreign state stealing data from organizations legitimately engaged in our national elections.
5. Just because your software doesn't reveal a threat doesn't mean you're not being hacked. As a former president said, "Trust, but verify." And update your software.
Again, I'm trying to keep the politics out of this. Plenty of that elsewhere online.
http://www.nytimes.com/2016/12/13/us/politics/russia-hack-election-dnc.html
Total lack of defined process and behaviors
I too immediately saw red flags for poor IT management from the first paragraph. Just to add to your first point - To not have a clear policy, and staff training on how to comply with the policy, to immediately escalate any potential security incident to a manager is unthinkable. This demonstrates that no expectations for behavior were ever established - how to behave when someone reports a security risk - and no policies written to enforce that behavior. That's what a Helpdesk or IT support manager does - define behaviors, educate staff on those expectations, and enforce. Someone didn't do that most basic job.