Despite the industry focus on cyber-criminals and defending against different attack methods, employees continue to be the primary source of data loss to businesses. In this article we will discuss different documented ways employees have stolen corporate data for the employee’s benefit.
Employees achieve economic gain by stealing business data through three primary methods. First, an employee can steal cash from a business. Often an employee is entrusted with taking care of the company’s financials. If the employee has end to end authority over financial transactions, it is easy for the employee to divert funds into their pockets. There are many examples of this type of employee criminal behavior including processing false reimbursement vouches, cashing fraudulent checks and paying factious invoices to company’s controlled by the employee or an accomplice. Safeguarding the company’s accounting system is based on establishing clear procedures with at least two people involved in every transaction. The person processing accounts payable should NOT be the person paying the bills. Expense vouchers and bills should be reviewed by a second person prior to payment to reduce fraud.
The second way employees attempt to profit by stealing business data is to use that data to either enhance their position with a new employer, or to start their own business. The most common theft is of client contact and sales information which can be used by the new entity to market to company’s clients. There are two ways to combat this type of loss. One method uses tools after the theft to legally pursue the former employee, and the second relies on technology to try and stop a theft in progress. In order to pursue a former employee for possible data theft a company needs both contractual protection and electronic proof of theft. Legal protection is normally included in the employee hand book or employment contract. Electronic proof can come from phone logs, computer security logs, videos, emails and hi-tech monitoring software. Putting together the evidence of theft is often impossible for companies that haven’t done the proper up front work to retain log files and archive emails.
The third way employees attempt to capitalize on business data theft is by selling the data. A recent example of this was the Capital One data theft. The cyber-criminals used knowledge gained as a former employee to gain access to Capital One’s client financial data. Once stolen, the employee attempted to market the data on the internet. These types of threats are increasing in frequency and intensity. Methods to prevent these types of business losses include limiting employee access to only the data they need to perform their business tasks. Make sure logging is enabled and that log files get archived so that if there's a breach, log file forensics can determine who and what was taken.
DeckerWright supports multiple employee tracking software systems including Veriato and Teramind. These software solutions track everything an employee does and can provide alerts if the employee is doing suspicious activities. While these solutions aren’t cheap, they do provide a method for using technology to both prevent and then document employee data theft.
Click HERE for more information.