ETHICS ARE IMPORTANT
Warning! The following post details certain actions in the possible commission of a crime. Many important steps have been left out so as to not accidentally aid in wrongdoing. If you follow the steps in this post you WILL FAIL and be CAUGHT!
I found out today that I am an ethical person. That sounds like it is a statement I should have had a grasp on before. I do have a strong work ethic and I do what I can for the good of others. However, no matter what you think you would do you never know for sure until you are walking down the road and you find a suitcase of money. Do you turn it in for fear of being caught? You didn’t steal it. It isn’t y ours however.
Earlier this week one of my clients had a great deal of trouble with their network after a lightning storm. As it turned out one router managing a point to point fiber connection was dropping their VOIP and data about every 20-30 minutes. There were no outward signs and no log errors that gave it away. That is one of the joys of lightning. It can do really weird things.
About three days into the search through this campus network I was working after hours with some engineers from the company that provided transport services to rule out all their equipment. One of the engineers produced a page of scrap paper and diagramed out our network so we could get a good idea of where to look. Two days later after the problem was found and solved I was making some checks to verify the new equipment. Sitting on top of an ONS I saw our piece of paper with the diagram. I picked it up to throw it away and absently turned it over to look at the back. I stopped and my jaw hit the floor as I read the printing.
The engineer had obviously been working recently on a network transport issue for a large bank about 40 miles away. This particular piece of scrap held the audit results from the bank in question. It had the equipment serial numbers, user logins, passwords and use description. The names of all the routers and servers were there with their administrative logins. The computer that kept the syslog was in the list. As an engineer who has done penetration testing and security audits for over two decades I ran over in my mind how to enter and turn off logging, remove a low percentage from every account in the database, place it in an anonymous account, transfer it to another and then another, finally spread it to several smaller accounts. Then I would remove the access traces from the server and router and the secondary logs so that they all matched. … That is about as far as fantasy got before I took the 8 steps to the shredder. I held in my hands a method of untraceable millions between this paper and my experience and my first action was the shredder. Well there it is. It would be vain to tell you I am a good person but I now know. I am an ethical person. What would you do?