Subscriber Sessions “Online Information Security Sessions from Global Leaders in Information Security Topics.”

Hack ED “Check out our daily articles on Ethical Hacking Education and Discussion Topics!”

Laid-off workers as data thieves?

Posted by admin on Apr 14th, 2009 and filed under Cybercrime. You can follow any responses to this entry through the RSS 2.0. You can leave a response or trackback to this entry

When the depths of the economic crisis became clear last September, public relations firms started using it as an opportunity to drum up publicity for their security vendor clients. One PR flak even started her e-mail pitch to me with an admission that the IT angle was a stretch.

“This might be a bit of hyperbole, but as companies like AIG andLehman Brothers look for a bailout, it’s not surprising that adoption of open-source software is increasing significantly in the wake of today’s economic downturn,” the pitch read. That’s right, the financial crisis means companies are fleeing to the safety of open-source software, whether it’s for security or other purposes. By the way, the flak wrote, her vendor client would be more than happy to talk to us about this all-important issue.

Fast-forward to late February: Job losses are mounting, the economic outlook is gloomier than ever, and the PR machine is angling for another opportunity to exploit the news.

The latest example is a newly released report from security vendor Symantec Corp. and the Ponemon Institutesuggesting a growing crime wave where laid-off workers exact vengeance on their former employers by walking out the door with sensitive customer data and other proprietary information.

The Ponemon Institute conducted the Web-based survey last month — polling nearly 1,000 Americans who had left an employer within the past year — and found, according to the press release, that “59% of ex-employees admit to stealing confidential company information, such as customer contact lists. The results also show that if respondents’ companies had implemented better data loss prevention policies and technologies, many of those instances of data theft could have been prevented.”

Translation: If respondents’ companies would buy some data loss prevention technology from Symantec, this sort of thing wouldn’t happen.

Among the survey findings:

  • 53% of respondents downloaded information onto a CD or DVD, 42% downloaded data onto a USB drive, and 38% sent attachments to a personal e-mail account.
  • 79% of respondents took data without an employer’s permission.
  • 82% of respondents said their employers did not perform an audit or review of paper or electronic documents before the respondent left his job.
  • 24% of respondents had access to their employer’s computer system or network after their departure from the company.

“The survey’s findings should sound the alarm across all industries: your sensitive data is walking out the door with your employees. Even if layoffs are not imminent, companies need to be more aware of who has access to sensitive business information,” Ponemon Institute founder and Chairman Larry Ponemon said in the press release. “Our research suggests that a great deal of data loss is preventable through the use of clear policies, better communication with employees, and adequate controls on data access.”

Added Rob Greer, senior director of product management for Data Loss Prevention solutions at Symantec: “Data loss during downsizing is preventable. We can prevent employees from e-mailing sensitive content to personal Webmail accounts or downloading it onto USB drives. Companies need to implement data loss prevention technologies so they know exactly where sensitive data resides, how it is being used, and prevent it from being copied, downloaded or sent outside the company.”

You must be logged in to post a comment Login