Security 2012: Prepare for rogue employees before they strike
- 27 July, 2012 09:13
- Comments
Information stolen electronically by rogue ex-employees can be detected and used in prosecutions if companies take adequate steps to lock down computers and mobile devices involved, according to a forensics investigator.
Speaking at Security 2012 in Sydney, Klein & Co director, Nick Klein, told delegates that a number of companies who have contacted him after suffering a data loss did not have a data recovery plan in place.
Security threats explained: Internal excessive privilege
“We ask them what happened to the computer that was used to steal information and find out they redistributed it to another staff member two months ago,” he said. “Then we ask them what happened to the mobile phone and they say it was replaced.”
In addition, companies had not saved backup data which could point investigators to clues as to what data the culprit had stolen.
According to Klein, the most important step companies should take is to develop a data breach plan.
“Think about where your confidential data is, how someone is going to steal it and if they did it, how would you detect and investigate it?” he said.
Klein added that if IT executives knew where their data was they could start putting controls in place such as logging and monitoring.
In addition, executives should consider installing improved access control systems or data loss prevention offerings to detect when someone's attempting to access information.
“We have had clients call us up six months later and say it’s happened again,” he said. “But this time they have put the computer in storage and seized the mobile phone.”
During an investigation, forensic investigators build a chronology of what happened in the computer including email data and time stamps within Word documents.
“Quite often we find evidence that people have plugged a USB key into their computer and browsed network folders for information that they shouldn’t be accessing,” Klein said.
If the evidence is enough to build a case which proceeds to legal proceedings, he said companies should brief lawyers who have an understanding of ICT evidence.
“If it does go to court make sure your barrister can show what the evidence proves because at the end of the day they’re the ones who have to present and argue the case in court,” he said.
Follow Hamish Barwick on Twitter: @HamishBarwick
Follow CIO Australia on Twitter and Like us on Facebook… Twitter: @CIO_Australia, Facebook: CIO Australia, or take part in the CIO conversation on LinkedIn: CIO Australia
Recommended
Join the CIO Australia group on LinkedIn. The group is open to CIOs, IT Directors, COOs, CTOs and senior IT managers.
- Bookmark this page
- Share this article
- Got more on this story? Email CIO
- Follow CIO on twitter
-
Why change management doesn’t work
-
Larry Page wants to see your medical records
-
Dual-Persona Smartphones Not a BYOD Panacea
-
After two-year hiatus, EFF accepts bitcoin donations again
-
CIOs struggle to deliver timely mobile business apps: survey
-
Implementing A Security Analytics Architecture
According to the 2012 Verizon Data Breach Investigations report, 99% of breaches led to data compromise within “days” or less, whereas 85% of breaches took “weeks” or more to discover. This presents a significant challenge to security teams as it grants attackers extended periods of time within a victim’s environment. More “free time” leads to more stolen data and more digital damage. Principally, this is because today’s security measures aren’t designed to counter today’s more advanced threats. Read on. -
CSO Spotlight: Security-as-a-Service Gaining Popularity
Organizations that are looking for security features including identity management, encryption and access control — and at the same time want to take advantage of the cost and flexibility benefits of the cloud —might check into security-as-a-service offerings available now from several vendors. Download now to find out more. -
Accelerate Cloud and Composite Application Delivery
Are your requirements the need for faster release cycles, you have reduced budgets required to run and manage a complex test environment, and you want to decrease your third party expenses? HP Service Virtualisation, designed to enable your teams to create, develop and test against virtual services that simulate real service behaviour with no constraints, available anytime.
Get exclusive access to Invitation only events CIO, reports & analysis. 
