Surface Comfort

There can be a preference to leave things that are working alone. Because they’re working. If it ain’t broke, don’t fix it. I was thinking about this in relation to a recent training event I had related to computer security, especially phishing. A too-narrow focus can make you feel like something is working, but only by ignoring what’s around you. A law library director or any manager can help by maintaining an eye on the horizon that other staff can’t.

The musical The Music Man is a bit of a touchstone for me. And in this instance, I recall the line “the burglar’s in the bedroom while you’re fiddling in the parlor!” You can feel comfort in what you’re doing without realizing that you don’t really know the entirety of what’s happening.

Let me put it into context with a technology example.

Floating Phish

At the moment the email arrived, it had been a few days since I’d done my training. This is a standard approach. You take security training and then, as a follow up, you are tested on it. I’d eventually get three emails.

The first email was pretty obvious. It may have been because of my email settings:

• all images are disabled so that my viewing an email doesn’t trigger a tracker
• disable HTML emails so all messages appear as plain text, to eliminate extra code that I can’t see

In addition to the benefits of not having technology acting without my knowledge, it strips out a lot of the visual presentation that phishers use to create authenticity. In this case, there was a warning that my email account had been accessed just after midnight from a Russian IP address.

As a rule, any email I don’t recognize from the information in the inbox (username, email address, domain name, subject line) is immediately deleted. I don’t preview it or check it. Lawyers can’t be that aggressive (see here (hat tip @CatherineReach) and here) but a lot of questionable email doesn’t need much of a look.

I thought for a moment this might be a spear phish, with the Russian aspect designed to create a reaction for me in particular. If so, it worked in the opposite direction because that’s immediately a red flag for me.

I didn’t click the link in the email to check whether my account had been accessed. And I reported the email as a phish. It couldn’t have happened because I didn’t get an multi-factor authentication warning. But the underlying problem is that it could have happened a few months ago.

At that point, we were not using two-factor authentication on our email accounts. Assuming it is working as it’s supposed to, an attempt to log into my email from a new device would trigger a 2FA warning that, ideally, the intruder couldn’t access.

Unfortunately, we use 2FA texting, which is about the least secure option possible. I mean, it’s better than nothing. Knowing we had 2FA on our email accounts made me more confident that this email was a scam on the first view.

What Lurks Beneath

At this point, if it were my shop, I might review our 2FA approach to make sure that all of our systems are secured the same way. That way, every front door has a second check. That would include email, Microsoft 365 or Google WorkSpace online services, and other internet-facing tools. This can be tricky because you may have some systems that don’t support standardization; they can’t be secured in a universal manner.

For example, integrated library systems may not support more detailed security even though it may store patron data. You may be able to provide some additional friction on access – I use a Cloudflare rule to limit access to my login page for this site – but it can make a universal solution harder.

That’s not been our approach. Some sites (like attendance and expense payment) have no security beyond a username and password. Others use one of a number of multi-factor authentication options. Some use text messages and some use security fobs, a spectrum of multi-factor authentication that is not tied to the sensitivity of the system they protect.

The site that uses a security fob is actually more of a false front. You are asked for the fob if you enter the site one way. But you are not prompted for 2FA if you go in a different way. As this story points out, unsecured lateral access even when frontal access is secured is not uncommon. Our intranet has been indexed by Google in just this manner.

It’s not just multi-factor authentication. Some sites can be accessed over the open web. Some require a VPN or RDP connection and so are like an intranet, even if they are visible on the public web. Sometimes one app – like Teams – will be accessible from any computer but a site it links to – like Teams files that are stored in SharePoint – requires VPN access.

There are a number of benefits to a consistent approach. One is that IT only has to focus on one method of securing things. Another is that the person who is likely to cause the problems – the user – can also become comfortable with just one method. They aren’t using a range of methods, from insecure texts to highly secure fobs. The minimum, and perhaps the sweet spot, is an authenticator app on a device, so that getting a code requires physical access to the device.

Take 2FA. Ideally using an app or an NFC token, everything they interact with will have that second layer of protection. And attempts to make them think their accounts have been attacked will be less successful because they will know that the intruder will have had to deal with 2FA as well.

But you can put technology to the side because, while it provides clear examples, we may do this in lots of areas.

Dive Deeper

It’s hard to look further into the depths. You may be afraid of what you’ll see! And if you do find something, it means someone’s got to resolve whatever you find. Everyone can do it in their work but a manager is in a particularly good place for this. I wrote about how managers may not seem to have a role in our emerging work wherever world, but this is another opportunity to leverage your different perspective.

Another example. An issue comes up at the reference desk. A reference librarian solves it. It comes up again. A reference librarian solves it, sometimes in the same way, sometimes not. Rinse and repeat.

In a sense, that’s the sort of work we do: solving problems with information access. And there may not be a better way to handle these interactions. But a repeated issue may indicate a deeper problem. “We get a lot of questions about” might mean you need better signage or better documentation or new pathfinders.

One way to look at it is like a collection request. I’ve heard an interlibrary loan rule of thumb as, if you borrow a book three times in a year, you probably need to own it. If you’ve got a problem that is repeatable – a certain type of question, a certain type of email intrusion – then it may be worth diving deeper into it and make sure you’re not just fixing the surface issue.

The thing that goes through my mind most about this is that we miss opportunities. If I go back to the phishing examples, it’s great that we’re gaining heightened awareness about this threat. But it’s a drop in the bucket and so, while somewhere to start, it begs the question why we aren’t digging into this issue further. As law librarians, when we have repeating issues, we can solve them to make it easier – for staff, for the researcher – to avoid having to ask or answer the same question over and over again. We can build on the experiences we’ve had to make things better, safer, more secure, more informative.