Michael D. Moberly March 30, 2009
Just how vulnerable are companies to having their proprietary-sensitive information, data, and intellectual property stolen or comprised as a consequence of the current recession? According to McAfee’s recently released report ‘Unsecured Economies: Protecting Vital Information’ the global economic crisis (recession) is quite literally creating a ‘perfect information security storm’ as increased pressures on companies to reduce spending and cut staffing have lead to more porous defenses and increased opportunities for cyber criminals.
It’s certainly not unexpected to learn that the McAfee study found that the current economic stressors will exacerbate security issues for several reasons, one of which is that mass layoffs will incite (influence) a percentage of previously loyal employees to look at criminal activity, e.g., tempt an increasing percentage of financially strapped and laid-off employees to use their corporate data access to steal vital information.
While most security practitioners have known about – recognized such vulnerabilities for years, the fact that McAfee elected to release this report during the 2009 World Economic Forum and title the study ‘Unsecured Economies: Protecting Vital Information’ and devote an entire ‘chapter’ (in the study) to address ‘insiders’, certainly gives credence to the current challenges as well as those that lay ahead with respect to the multitude of risks – threats presented by insiders globally.
Therefore, its not entirely unexpected to learn from the McAfee study that:
– 68% of the respondents now cite ‘insider threats’ as the top threat to vital information, and
– 42% of the respondents cite laid-off employees are the biggest threat caused by the economic downturn, with
– 36% of the respondents conveying ‘worry about the security threat from financially strapped employees’.
‘With more sophisticated technologies at their fingertips and increased access to data, it has become easier for current employees and other insiders, such as contractors, consultants, suppliers, and vendors, to steal information. Data thefts by insiders tend to have greater financial impact given the higher level of data access, and, when combined with the affect of today’s economic realities on IT security spend, this could mean even greater financial risk to corporations’. (Tim Shimeall, Carnegie Mellon University’s CERT/NetSA)
Ultimately, financial information becomes a recognized and sought after currency for employees. It presents much greater incentives (for employees – insiders of all stripes) to steal valuable, proprietary, competitive advantage information and data for (a.) personal financial gain, (b.) to try to improve their job opportunities by ‘peddling’ it to unscrupulous or naïve competitors, or (c.) to literally start companies of their own by using the knowledge and insight they gained (stole) from their former employer.
In addition, the substantial cutbacks in company travel have, for all practical purposes, significantly curtailed or altogether ended on-site visits, inspections, personnel training, and audits for safeguarding a company’s sensitive information assets. We can assume that in many instances, security practitioners are adapting to those realities by de-centralizing and delegating their ’information asset protection and oversight’ role to on-site personnel.
