Chapter 3: The Security Frame of Mind
Rubin pulled out the thick MYZRE security analysis report and popped the cap on his fat black pen. He flipped a few pages and said, “The report has a long list of cosmetic issues. There are some problems with file transfers and some kind of hole in the basic account views. Also, the main login screen doesn’t enforce proper password retries.”
“You’d have to be a pretty dumb criminal to break in that way. The MYZRE login screens are only available inside the bank. So fixing this problem is essentially a waste of time and money.”
“Not a question of logic.” Rubin said while cupping a hand over his fist, “It’s an audit issue and must be corrected, whether it makes sense to you or not. That’s the way it works.”
“Totally fits with everything else here.”
Rubin wrote a few careful notes in his notepad and then turned back to the report. “Very good. Here they mention a security oversight in the account views.”
“The default account views? Every user has those privileges. If there was a problem, I think we’d have noticed it by now.”
“So that must be why it’s marked as high-priority.” He drummed a finger down on the page for emphasis.
“Lemme see.” I took it and scanned through the pages. The name on the document footer yanked my attention. Dragoon Consulting. Was Roger involved? Didn’t he just arrive onsite? The footer date indicated the report was prepared weeks ago.
I flipped to the relevant section and read aloud, “Says if a user looks at customer data but doesn’t change anything, it’s not flagged in the oversight report. So?”
“Audit rules were written to catch people stealing. To do that, you need to be able to change things undetected, not just look at them.”
I found myself nodding along without fully understanding, although I knew a thing or two about computer crime. “I remember a story about the guy who stole a penny from a bunch of bank accounts every month. And after a few years, he netted himself a million bucks or so.”
“Salami slicing.” He smiled that wise old copy smile. “The bad guy steals a tiny slice at a time. No one notices since it’s so small. It’s an old trick in the fraudster’s handbook. That’s not what we’re talking about. We need to close the account view hole because it’s a potential privacy violation.”
“A pain in the ass to fix. What else do we have here? Bank account numbers over eight digits don’t display correctly. I don’t really see how that’s a security issue.”
“Me neither.” He said with a nod.
I scanned ahead to the next section of text. “File transfers are dropping every 512th record.”
Rubin shrugged, “It’s probably not a big issue. Someone needs to break down all the file transfers that could be affected.”
“That’s a task that we let our project leader deal with.”
He just smiled and made another note in his pad. I figured now was a good a time as any to ask, so I did. “Rubin. What happened with Alicia Lyons?”
His long eyelashes fluttered. He finished making his notes before he answered, “She died.”
“I know that. I heard it was suicide. I mean, was she in trouble?”
He put on a frowny face. “You know that my job requires discretion.”
“Yes. I’m sorry. It’s just that...I got a weird bounced e-mail from her yesterday.”
He cocked an eyebrow. “Weird?”
“My job requires discretion too, you know.”
There was a hint of authority-figure in his response. “Does this e-mail concern the safety and security of Puget Regional Bank?”
“Don’t think so.” Butterflies bounced around inside me as I answered.
“Unless it’s something hinky, then it’s none of my business.” Rubin leveled a cold stare at me. “And none of yours.”
Hinky. Rubin was sliding into cop-mode. “Well, she was definitely worried about something.”
“You’re being very unprofessional.” My butterflies became dragonflies. “Your sarcasm is one thing, but when you start prying into other people’s personal affairs, living or dead, it’s not right.”
“I know.” It was like sitting through a cop’s lecture, hoping he wouldn’t write that speeding ticket. “I just wondered if...I’m sorry.”
I turned my head to avoid looking at him and studied his desk. I hated it when he made me feel like this. He slid the report back to his side of the table and read.
I needed to lighten things up a bit. “Rubin, I’ve always wondered, what is that wooden knife-thing on your desk?”
“Mmm?” He looked up with a confused look on his face. “Old cop buddy of mine gave it to me—a sentimental thing between us.”
“What does it say on it?”
“Lex Talionis. It’s Latin for the law of retribution. An eye for an eye, a tooth for a tooth.”
“Old school justice?”
He nodded with a deep chuckle. “Yes. Back from the days when civilization consisted of wandering gangs, administering justice their own way. There was no law of the land, except the law of retribution.”
“Oh Jeeze, and you and your friend believed—-”
“No, no.” A smile cracked, but he wasn’t looking at me anymore. “It’s why we became police officers. Without laws and people like us to stand up for them, there would be only anarchy and indiscriminate killing.”
When he said us, I thought for a moment he was referring to him and me. But no, he must have meant the brotherhood of police.
Eyes still glazed, he kept going, “As the years went on, things happened with SPD that made me...The way our lawyers and judges worked, it felt like we were wasting our time. There was a temptation to skip the courts and just...”
He paused and thought for a moment. I gave him his silence.
He closed his eyes as he spoke. “It was easier to just pull some punk into an alley and beat the hell out of them. At least they’d get the message.”
I nodded silently. Rubin’s voice was whisper-low, barely audible. “That’s when I knew it was time to leave. Not to be a cop any more.”
His gaze returned to my face with a deep smile. It felt like something shared between comrades in arms.
He lifted the audit report and said, “Now regarding the project...”
I nodded, ready to get back to business.
“Gayle is calling weekly project status meetings.” He gave me a playful look as he said it. Good, the mood was lifting.
“So we should make sure we corroborate our stories beforehand, huh?”
He chuckled his agreement. I explained more. “Project meetings mean we’ve got to document our accomplishments. And be ready to prove it in the meeting.” Lest he forget, I added, “And of course, we need to be prepared for any cross-examination.”
I got another smile.
On my way out of Rubin’s area, I brushed past that blond lawyer-lady. She squinted a glance at me and continued to swagger down the hall towards the elevators. I tried to peek at her name badge but just saw visitor, no escort required. Whoever she was, this woman was sure getting around. I hoped she wasn’t an auditor.
It’s not like an auditor would ever actually shut us down. I’d only heard of that happening in extreme cases.
The blonde woman didn’t seem weasely enough to be an auditor. Maybe a lawyer? I tried to remember if another lawsuit was pending. No, but maybe there was another investigation. About a year or so ago, PR Bank hired a VP without fully checking his references. It turned out that he had left his last job under a pending fraud investigation. Took nearly two months before they caught on. Our lawyers crawled around the bank like roaches in a dirty kitchen. Good thing the FDIC or the newspapers didn’t find out.
After that, they brought Rubin aboard and he made a whole bunch of changes to our security. One of which was the addition of a computer burglar alarm, an IDS. Not that he understood how it worked—that’s for geeks like me. Yeah, we nerds love our acronyms. Besides, there are too many syllables in Intrusion Detection System.
The IDS consisted of network sensors at key locations throughout PRB’s computer system. It monitored and recorded suspicious behavior. How did the IDS sensors know what was suspicious? Part of my job was to program in those patterns. That reminded me to check on the IDS entry that watched for Glenda.net e-mail.
The IDS kept an eye on all the hackers trying to break into our system from the Internet. And believe me, there were a lot of them. Like everyone else on the Internet, PRB gets several hundred attacks a day. Worm infectors, port scans and backdoor sweeps are the background radiation of the Internet. The IDS sifted through the worst of it and batched it into a big fat report. My group’s responsibility was to make sure these reports got proper attention. That’s how I got to know Rubin. Every week, I explained the technical implications. If necessary, Rubin informed the proper authorities.
After an eternity of meetings, I finally made it back to my desk. I figured I could squeeze in a quick break to do some real work. Maybe even eat. While my e-mail loaded, I snagged a can of albacore solid from my desk. There was a lot of the usual e-mail garbage: more Spam, more to-dos, more meeting notices and an attaboy e-mail to all Tech-Services from Rusty. Yay, team.
As I sat through meeting after meeting today, Rubin’s comments ran through my mind. I kept replaying our conversations, adding all the counter-arguments that I didn’t voice. Alicia may not be part of the safety and security of Puget Regional Bank, but she deserved some justice. Someone needed to care, someone who had the power to help. I wasn’t going to stand aside and do nothing. Not again.
I needed Alicia’s browsing records to tell me a bit more about what she was doing. I still hadn’t heard anything back from Wes, which wasn’t too surprising. He was our firewall guy, which meant that he thought he was above the normal techs. As in any profession, we had a hierarchy.
At the bottom, you have the help-desk, who deal directly with the end users and their confusions. Above them, you have desktop people, like Lee. They install and fix things at the user’s computers. System Operator are the people you see in the movies sitting at desks operating the giant mainframes, changing tapes and watching the dials. My group’s responsible for network infrastructure. We kept all the pieces connected and running, which included everything from the wires to the giant servers that stored data files.
My clutch of nerds included Mitch, Gayle and sort of Wes. His network duties revolved around how PRB connected to the mighty Internet. Although Wes was barely over five feet tall, his specialized firewall training and exotic Internet certifications granted him immense stature. Believe it or not, I actually liked the guy, although his youthful brilliance made me feel old and used up. My respect for his esoteric skills made it easier to muster the charm to occasionally coax a boon out of him.
Gripping my handy can-opener, I tapped in his extension with a spare finger. The phone rang in both of my ears, one sound issuing from the receiver while the other echoing over the cubicles from his desk thirty yards away. Computer people preferred mediated communication. Just more convenient. Wes answered and I immediately asked, “You get my e-mail about those firewall records?”
Wes sounded irritated, but that’s par for the course with him. Most of us detested interruptions, especially when we were heads down in a technical problem. He didn’t bother to be polite. “Not sure what you meant.”
I had to face down his grumpiness without being too pushy. “Could I not be more plain? I need the web-surfing records of a particular user.”
In a little too whiny of a voice for a grown male, Wes said, “Yeah, but you didn’t give me the eye pee.”
Crank, crank, crank, and the tuna can popped open. I pressed down on the lid and poured the tuna juice into my empty cocoa cup. I answered Wes as it drained, “Why do you need that? I gave you the user name.”
Wes dropped into his condescending tone. I shut up and listened. “The firewall doesn’t care about names. Everything on the Internet runs on Internet protocol, including our stuff that talks to it. I need the IP address for that user’s computer.”
What a pain. I put down the can and reached for the keyboard. “Hang on.” I punched in a few commands, “Okay, according to the user inventory, the last known IP address of Alicia’s machine is 192.168.30.207.”
“Uh huh,” I heard him clacking along at a much faster rate than I ever could. I retrieved my crusty fork from a desk drawer and cleaned it off with a napkin. Wes came back on the line, “No records at all for that address.”
“What? That doesn’t make any sense.”
“The firewall don’t lie, baby.”
Baby. I let it slide and thought for a minute. As I put a forkful of tuna in my mouth, I realized that our network periodically rotated the addresses for the workstations. It’s part of our housekeeping, when a machine gets turned off for a while, it gives up its address so others can use it. Maybe Alicia’s computer had a different address before she...I forced the tuna flakes down my dry throat and told Wes to hang on.
“Sure, but hurry up. I got a meeting. That stupid Apollo thing. They want to make a bunch of changes to the firewall. More tracking and recording.”
I double-checked the printout of Alicia’s inventory. Yep, her old address was different. “Try 192.168.30.95.”
More furious typing. “Yeah, buncha stuff. Gotta run, I’ll e-mail it.”
I granted him my perky sweet voice. He deserved it: “Thanks! Yet another one I owe you.” He hung up. I chewed more tuna while I waited—then his e-mail arrived.
Every PRB Internet web browser is set to automatically open our main website, so I ignored those entries for now. Stockfunding? She must have checked her stocks online. Lots of people do. No big deal there. She went to a search engine but I can’t tell what she looked up. Well, that’s another thing people are always doing.
Go2Trips was an online travel agency. Was she booking a trip somewhere? I’m not a psychiatrist but people who commit suicide usually don’t plan vacations. Weird.
Portal at Whizz.net. Whizz.net is a regional service provider, which wired up people’s homes with high-speed Internet access. I got my feed from the phone company but Alicia could have used Whizz.net. Many Internet services put up e-mail access websites so users don’t have to download mail to their computers. Instead, they just web surf to the site, put in their username and password to get access to their mail from anywhere. Alicia might have done that to check her home e-mail from work. If I’m reading the line correctly, then her username is lyons14. And that gave me an idea.
My phone rang, an internal call. It was Mitch, down on the second floor with server connectivity problems. I dropped the half-eaten can of tuna and headed for the stairs. No rest for the wicked.
Downtown Seattle is definitely the place to go if you’re looking for some chic new boots or some of the best wasabi on the coast. However, it’s hardly the place to find decent computer parts. For that, you gotta head south past Boeing to the tentacles of strip-malls and warehouses that surround South Center. Whenever we need something uncommon, say like an RJ-45 double-female connector or a copy of Red Hat’s latest, that’s where we go. Today, it was a new drive controller to fix the problem on the second floor. I volunteered to zip down and get what we needed. Not only was it a chance to get a daily-recommended dose of sunlight, but I wanted to take a look at one of those Titanium laptops. You never knew what new toys were waiting to be discovered. With Warren’s corporate card in hand, I took off down I-5.
Traffic turned out to be pretty light, so I had a little time for a sidetrack. I had Alicia’s home address from the system. She lived in SeaTac, just a few miles from the mallsville of South Center. I pulled off near the airport the neighborhood is named after and slowly rolled through acres of concrete and neon ugliness. In reality, SeaTac looks like every other airport adjacent suburb: overnight hotels, blocky apartments, seedy bars and rental car lots. Alicia probably lived here because it was cheap, generic living-quarters. Nothing more, nothing less. There’s one small bonus to the places like this. Because of the constant traffic from the freeways and the skyways, all the apartments are soundproofed.
I drove into the wide entrance of the SeaView Woods apartment complex. I thought of military housing when I saw the white three-story rectangles woven together by asphalt parking lots and cedar-chip islands. Alicia’s address indicated she was in building D. I studied the colored map mounted next to the honeycomb of aluminum mailboxes. Her place was in the back.
As my Jetta glided around a corner, I saw a big moving truck surrounded by cardboard boxes and appliances in the parking lot. I pulled into an adjacent lot and studied the scene. Someone was moving out. Two men in faded denim overalls were carrying a big screen television down the stairs towards the truck. A pudgy-but-solid-looking older woman in cheap jeans and a brown sweater was directing them with terse gestures. She had straight dark hair, but it was pulled back into a bun. I got out of the car and walked over.
As the men loaded the television, the woman picked up a cardboard box and set it on a stereo speaker the size of a steamer trunk. As I got closer to her, I could make out slivers of grey mixed into her tight bundle of hair. I thought I might as well ask the obvious question. “Excuse me?”
She turned and her tired ashen face and bloodshot eyes confirmed my suspicions. Now I had second thoughts about coming down. What did I intend to find anyway? “Is this...” I waved my hand over the spread, “Alicia Lyon’s...um...” I fell silent.
The woman closed her eyes and nodded. The roar of a passing jumbo jet rumbled through the parking lot, echoing off the buildings and hard asphalt. I put my hand on her shoulder and offered my apologies. She looked me in the eye and smiled. “Are you friend of Alicia’s?” Her accent was soft but still rendered her English into a breathy staccato.
“From work, yes.” It really wasn’t a lie.
“Oh. She never hardly talk about bank.”
I brought the corners of my mouth up half mast. “I understand. Not much to say about the bank. Are you her mother?”
“Yes. And so proud, she do so well. Then her husband get sick. And look all she do for him...”
I followed her eyes to the assortment waiting to be loaded onto the truck. A nappy Def-Tech stereo, pinball machine, multimedia computer system and a wheelchair. Ma sadly smiled at the chair, “To help Tommy. He had such hard time. So she get him all this. But now it needs going away.”
Alicia must have maxed out her cards to buy all this. I spied a Herman Miller Aeron chair. Hadn’t seen one since my dot-com days. No way she bought all this on what we got paid. And what was Ma doing cleaning house so soon? She seemed to love her daughter, but the way she glared at those expensive toys. Way suspicious.
I heard the thump-thump-thump of tires rolling over a speed bump. I turned to see a large black Lincoln Navigator rolling up towards us. It stopped in the middle of the lane in front of us. Ma perked up and turned to face the driver. The massive door swung open and a suede boot emerged, followed by a giant denim leg. With a thud, a lumberjack-sized man in jeans and a black leather Harley jacket hopped to the pavement. A cloud of cologne and cigarette-smoke clung to his massive frame and it made my nose itch. With a Rolexed hand, he slammed the door and scooped Ma up in a big hug. They exchanged guttural words in what I assumed was Russian.
They both turned and faced me. Ma held his hand when she told him, “Alexy, this is Alicia’s friend from her work.”
Alexy gave me a full set of molars as he pumped my hand. I tried not to squeak when I introduced myself. “I’m Heidi. Pleased to meet you.”
Unlike Ma, Alexy had only a slight trace of an accent. “You work at my cousin’s bank too?”
“Yes. I was an acquaintance of Alicia’s. She was a good worker and well liked.”
“I bet. You work in Collecting with my cousin?”
“Uh no, computers.”
He smiled and looked over at the boxed up PC. “Oh, I love computers!”
He turned away and opened the back door of the Navigator. Then he walked over and loaded the box of computer equipment on to the seat and secured it with the seatbelt. “No, not computer expert, just know some little things.”
“Well, there’s a lot to learn but it’s...”
He closed the door and faced me, thumbs in pockets. “You do side-work? You know, outside of the bank?”
Yeah, I guess I did, but usually for free. He fished a business card out of his back pocket and handed it to me. “I have a few computer things that need doing. If you’re interested, call.”
It was a plain card, just the name “Alexy Novgorod” and a phone number. As I slid his card into my wallet, I automatically yanked mine out and offered it to him.
Another jet tore through the atmosphere high above. Our conversation paused as the sound reverberated like thunder. Alexy used this time to study my card carefully. As the air grew still once again, he smiled and said, “Senior Technical Specialist. So you are really good at computers.”
Why did I hand him my card, especially with that insipid title from that inane place? He placed my card in his pocket, gave Ma a hug and got into his massive vehicle. I gave her hug as well and wished her the best. I needed to get out of here before I said or did anything stupid. Anything more stupid.
As I pulled the car to a stop in front of Bella’s, the valet opened the door for me. I was wearing my new charcoal top with matching skirt and my favorite kitten heels. Despite my usual feelings of frumpiness about dressing up, I was feeling quite vampy. And on a school-night as well.
For his part, Peter wore his nicest jeans, a burgundy long-sleeve polo and his shiny black Ecco’s. He was neatly shaved and his sideburns were trimmed back to an almost reasonable length. I should have been grateful for the effort, but I kinda expected a bit more. Especially since this was his idea.
The valet handed me a ticket and hopped into the car. Peter took my arm as we sauntered through the doors into a humid fog of garlic. Bella’s is large enough that there was never a long wait for a table yet the layout made everything feel intimate and cozy. No matter what time of day it was, the dim lighting made you feel like it was just a short time after sunset. Perfect.
The matire’d smiled with recognition and greeted us with a hearty “Buongiorno” before leading us to a candle-lit booth far in the back. His accent was so thick I suspected it was fake.
I ordered the pesto over penne, a dish they’re famous for, though it’s never on the menu. They knew me well enough to make it for me with a minimal amount of fussing. Peter went for his usual, gnocchi in an Alfredo sauce. We split a bottle of Walla Walla Chardonnay, my favorite.
With a grin, Peter announced, “The band picked up a gig next week.”
He just chuckled and shook his head. “Just for tips, as usual.”
My non-plussed reaction got me his wounded look. He tried to turn the conversation to something more positive. “Hey, I got a call back from that temp agency. They said that there might be a few slots opening up in Redmond.”
“That’s great. Except for the trip over the bridge.”
“Uh yeah, I was wondering if I—”
“Could borrow the car? We’ll see. It’s a bus ride downtown for me, but it might be worth it if your thing turns perm.”
“Yeah and I think it will.” The grin was back. “A lot of those kinds of things are just lead-ins to the main positions. That’s how these big companies do their hiring now. Temp to perm!”
I tried not to sound too patronizing. “Yeah, I’ve heard that.”
“If I land this, then maybe we can finally move out of that little apartment and get a house.”
“That’d be nice. With a garden. And I could get a cat or two.”
“And I could practice in the garage with the guys. So cool.”
“Only on weekends. I don’t want to annoy the neighbors.” I took a big sip of wine and winked at him. He smiled back and added, “We can put a refrigerator in the garage. And a pool table.”
“And a dog...it’d be nice to have a dog to walk after work.” And to cuddle with.
“And a play room for Pete-junior.”
“Huh? Pete-junior?” This was filed under things I tried not to think about: marriage, kids, me all grown up. It just didn’t suit me.
“What’s the matter?” His face slipped into a plaintive stare, “Isn’t that what everyone dreams of?”
“Well, yeah. You said something along those lines once.”
“Someday, Peter. Someday.”
He leaned back and nodded. “I know. That’s what I meant. After we get the house and stuff.”
“And after you get the job.”
“Oh, yeah.” His smile faded. “After that.”
“Sorry, it’s hard to think of the future when we live hand-to-mouth.”
“Babe, I’m trying my best.”
“I know, sorry. Things at work are all over the place. I just don’t have the energy left to figure out your future too. Just keep pounding the pavement. I’ll make sure we get there, ok?”
He was still smiling but the mood had been deflated. During dinner, we didn’t say much more of consequence. I passed on dessert and put the meal on my card. I felt like I was always apologizing to everyone. I did it enough at work. I didn’t need it at home. I was just too tired to deal with it.
We headed outside and it was starting to rain. Peter slipped my coat over my shoulders and held open the door. I was still thinking of Alicia. Her hard drive had doubled in size since the last time it had been inventoried. If anyone at PRB did any kind of upgrade on a workstation, it was noted in the support tracking system. Since our job performance reviews were tied to what that system showed we’d done, people were quite anal about recording things. And I know that computer equipment can’t just grow larger on its own. Someone had taken her drive out and replaced it with another one. I hated unanswered questions and the more I thought about this one, the more it bugged me.
Peter took the ticket from me and handed it to the valet, who quickly stubbed out a cigarette. What about Alicia’s home e-mail account? If I could get in there, maybe I’ll something useful, like a note from her secret lover or something. I had her username, but I needed the password. She didn’t seem to be a computer genius, so I thought of a way to get it. I hated falling off the wagon, but I needed to know what was going on. Even if I had to resort to my old hacker ways. I’d need some help though. I was way out of practice, plus I was not a technical hacker. But I did know where to find one. The kid pulled up with my car and handed the keys to Peter. “Babe, you look tired, want me to drive us home?”
“Yeah, I need to think about things.”