When the depths of the economic crisis became clear last September, public relations firms started using it as an opportunity to drum up publicity for their security vendor clients. One PR flak even started her e-mail pitch to me with an admission that the IT angle was a stretch.
“This might be a bit of hyperbole, but as companies like AIG and Lehman Brothers look for a bail out, it’s not surprising that adoption of open source software is increasing significantly in the wake of today’s economic downturn,” the pitch read. That’s right, the financial crisis means companies are fleeing to the safety of open source software, whether it’s for security or other purposes. By the way, the flak wrote, her vendor client would be more than happy to talk to us about this all-important issue.
Fast-forward to late February: Job losses are mounting, the economic outlook is gloomier than ever, and the PR machine is angling for another opportunity to exploit the news.
The latest example is a newly-released report from security vendor Symantec Corp. and the Ponemon Institute suggesting a growing crime wave where laid-off workers exact vengeance on their former employers by walking out the door with sensitive customer data and other proprietary information.
The Ponemon Institute conducted the Web-based survey last month — polling nearly 1,000 Americans who left an employer within the last year — and found, according to the press release, that “59 per cent of ex-employees admit to stealing confidential company information, such as customer contact lists. The results also show that if respondents’ companies had implemented better data loss prevention policies and technologies, many of those instances of data theft could have been prevented.”
Translation: If respondents’ companies would buy some data loss prevention technology from Symantec, this sort of thing wouldn’t happen.
Among the survey findings:
• 53 per cent of respondents downloaded information onto a CD or DVD, 42 per cent onto a USB drive and 38 per cent sent attachments to a personal e-mail account.
• 79 per cent of respondents took data without an employer’s permission.
• 82 per cent of respondents said their employers did not perform an audit or review of paper or electronic documents before the respondent left his/her job.
• 24 per cent of respondents had access to their employer’s computer system or network after their departure from the company.
“The survey’s findings should sound the alarm across all industries: your sensitive data is walking out the door with your employees. Even if layoffs are not imminent, companies need to be more aware of who has access to sensitive business information,” Ponemon Institute Founder and Chairman Larry Ponemon said in the press release.
“Our research suggests that a great deal of data loss is preventable through the use of clear policies, better communication with employees, and adequate controls on data access.” Added Rob Greer, senior director of product management for Data Loss
Prevention solutions at Symantec: “Data loss during downsizing is preventable. We can prevent employees from emailing sensitive content to personal Webmail accounts or downloading it onto USB drives. Companies need to implement data loss prevention technologies so they know exactly where sensitive data resides, how it is being used, and prevent it from being copied, downloaded or sent outside the company.”
Not wanting to be left out of a juicy PR opportunity, the public relations representative for data loss prevention vendor Fidelis sent along this pitch:
“A layoff is tough for an employee. It is also increasingly tough on employers, as employees walk out the door with confidential and proprietary information. This reality has resulted in increased sales of data leakage prevention software. This software monitors and can prevent the intentional or unintentional transmission of confidential, proprietary data. One data leakage prevention company whose sales have substantially increased in the past year is Fidelis Security Systems of Bethesda, MD.”
The PR rep encouraged me to call him to set up an interview with the vendor to discuss “trends in data theft and the sale of software to prevent it.”
Right about now many of my PR friends are getting annoyed with me. I don’t blame them. They are, after all, simply doing their jobs — looking for timely news angles to draw attention to their clients’ products. Many of them are driven by a genuine conviction that their clients offer real solutions in a cybersecurity world gone mad.
The goal of this column isn’t to belittle them. Rather, it’s to point out that some threats have been around for a long time. They are not some new recession-driven phenomenon justifying a panicked security shopping spree. I can’t help but think of the ill-advised DHS campaign that sent people scurrying to the store in search of duct tape and plastic sheeting in 2003.
The fact of the matter is that disgruntled employees have always been a threat to businesses. Sure, incidents will spike in times of massive layoffs because there are more angry people out there. But the insider threat is an old problem.
One could also argue that laid-off employees aren’t as big a threat as those who remain on the inside with access to data they can sneak off to black marketers offering cash for proprietary data one can only obtain if they’re still on the inside.
If enterprise security shops are only now discovering the insider threat and the need for a layered defense with tighter access controls, they have bigger problems than the current recession.
Employees with an ax to grind were around before the economic collapse and they will be around after the economy recovers. Companies should have a program in place to deal with such miscreants in any economic climate.
About FUD Watch: Senior Editor Bill Brenner scours the Internet in search of FUD – overhyped security threats that ultimately have little impact on a CSO’s daily routine. The goal: help security decision makers separate the hot air from genuine action items. To point us toward the industry’s most egregious FUD, send an e-mail to [email protected].
