Slashdot Mirror
Employees Admit They'd Walk Out With Stolen Data If Fired
Gunkerty Jeb writes "In a recent survey of IT managers and executives, nearly half of respondents admitted that if they were fired tomorrow they would walk out with proprietary data such as privileged password lists, company databases, R&D plans and financial reports — even though they know they are not entitled to it. So, it's no surprise that 71 percent believe the insider threat is the priority security concern and poses the most significant business risk. Despite growing awareness of the need to better monitor privileged accounts, only 57 percent say they actively do so. The other 43 percent weren't sure or knew they didn't. And of those that monitored, more than half said they could get around the current controls."
I remember reading long time ago in security 101 best practices to remove employee's network privileges a week before they receive the notice. I also know of a big company which had ITSEC work all weekend to remove and change creds so when workers came to work Monday they found themselves now jobless.
http://www.mafiasecurity.com maf
I recall distinctly during my time with a certain F50 company that they would not only refuse to buy any of the secrets, but that they would be the first to call the FBI on you for trying. The last thing they wanted or needed was to have those secrets unearthed years later, potentially costing them billions of dollars.
Now the gray/black market? Maybe... but that's as much of a jail risk as carrying around an open box full of kiddy porn in front of a police station.
If anything, the things I can see IT employees walking out with are software licenses, images (even hardware!) and crap like that - things they would find useful to themselves later on.
Quo usque tandem abutere, Nimbus, patientia nostra?
I honestly don't understand. IT people need to be trusted with very important data. Each time one of these surveys come out they demonstrate that they can't be trusted with data.
As an IT guy, I wouldn't consider for a second walking out with data that's not mine. What the hell is wrong with the rest of you?
What doesn't kill you only delays the inevitable
I thought that's data protection 101.
thegodmovie.com - watch it
The solution to "insider theft" is simple:
Don't hire from the bottom of the barrel just to save a buck, and you won't have to fire people.
Treat your employees like valuable assets and not just cogs, and your people won't quit.
Everyone preaches about the insider threat, even though less than 4% of all incidents come from insiders.. If you count by the number of breached records, insiders make up less than 1% of all breached records (though, arguably, they may be breaching records that are more valuable)
http://www.verizonbusiness.com/resources/reports/rp_data-breach-investigations-report-2012_en_xg.pdf
Try telling that to the MBA's. They are obsessed over metrics and the things you talk about are hidden costs that do not show up in a nice spreadsheet. Simply wait there is Bob's resume go terminate him still screw Bob over even if he is an IT pro. His reputation is ruined and a new employer will wonder why is not currently employed? Hmm
These same companies also have policies that they can't hire unemployed people too.
http://saveie6.com/
At my last job it was common practice to take a copy of the source code even if you were just leaving for greener pastures.
I considered it myself - not for the trade secrets or to sell, but because it functioned as a programming reference guide ("How do I do that again? That's right, I did it before in library X"). In the end I took the high road and consoled myself that anything I had figured out before I could figure out again.
When I fire someone, there is a significant amount of planning that goes into it, and the whole process takes about 4 weeks.
When I decide it's time for someone to go, I have HR stage a company-wide reaffirmation of adherence to company policy. Employees are reminded that they are not allowed to bring any company data home on thumb drives (which technically they aren't allowed to bring in from home or leave the office with anyway), personal laptops, phones, and so on. During this initiative, they are asked to bring in any thumb drives they have with company data, and make sure they erase company date from their personal devices. I instruct the IT department to assist any employee who asks for help with locating and purging company data.
We are certain to remind them that this is to protect the company from security issues and corporate theft, reduce legal costs, and so on.
After about a week of that, we install a keystroke logger and screenshot collector on the employees PC, and collect all of their passwords to local resources, databases, servers, and so on. We monitor their computer activity 24/7 to make sure it will be a clean break. This is also useful for creating justification for violations of IT policy, since most employees violate it by using their company-owned computer for personal endeavors (email, non work-related web browsing, etc), which is against IT policy and subject to disciplinary action up to and including termination.
After a week or two of monitoring, I get the ball rolling with HR and IT. I submit the necessary termination documentation to HR, and IT generates a script that instantly locks them out and changes all of their passwords so that they cannot access any company resources.
We usually try to execute a firing when the terminated employee is in a meeting or other place where s/he will not have immediate physical access to items at their desk or lab. I usually just pop my head in the door and say "Hey XYZ, I need your help for a second." We walk back to my office, where HR is waiting with the termination paperwork, while IT removes their laptop from their desk and locks all of their drawers and cabinets.
To communicate the firing, I actually read from a script, because the lawyers are very particular about the language and what is said. Security escorts the employee to their work area and supervises and thoroughly documents any personal effects they take with them. They are not allowed to take any memory devices with them, including those in picture frames, without first having them checked by IT for company information. Picture frames are also disassembled and other items searched as thoroughly as possible.
Terminated employees are also searched/wanded on their way out to ensure they are not hiding things like USB keys or hard drives on their person.
It's an arduous process, but it's my job to protect the company from thieves.
No matter how hate the concept, the parent post is right.
Once the honest employee gets screwed no matter what, there's absolutely no incentive to the other employees to be honest!
You get what you promotes!
Lisias@Earth.SolarSystem.OrionArm.MilkyWay.Local.Virgo.Universe.org
This survey seems (admittedly without having read TFA) to be skewed by the "if fired" clause. Now, I would have thought most admins would have their privileges revoked if they were being sacked, but here's a question:
How many of us, if on the receiving end of unjust treatment, would honestly not at least entertain the fantasy of "getting back" at that company? Be honest, now.
Thought so.
Since the company invests a lot of trust in its sysadmins, it should at least treat them respectfully, since trust has to work both ways.
jobs in accounting making decisions. You know, oh Jeff makes X money but we can hire jackie for X-Y dollars and then fire Jeff. We don't care that Jeff knows the business inside out and Jackie doesn't. We don't care it'll be a year before Jackie comes up to speed and all the evidence says he won't be as good. We'll save a couple bucks now which is good enough. (Even if it screws us in the end.)
Did you know 80 to 90% of the moderators on slashdot wouldn't recognize a troll even if one dragged them under a bridge.
As someone who has been laid off from a job (and forced to wipe the hard drive of my personal laptop before I could leave the building), and who has had to hire and fire dozens of employees over the last 10 years, I can offer a bit of insight:
10% of your employees would never steal from you. Ever. It wouldn't occur to them to do it.
10% of your employees are determined to steal from you. It's why they applied for the job!
The other 80% are swayed by circumstance and opportunity. If you treat them like crap (when they're employed or when you fire them) or make it clear that you're lax on security (often as simple as not paying attention), they're going to steal from you. Treat them well (as employees and as ex-employees... don't just toss them overboard... give them a severance package... give them a nice letter of recommendation... make some genuine effort to ease this life-altering transition and show them that you care about what happens to them after they leave) and maintain good security practices and you will drastically cut down on the number of people who steal from you.
This is because these companies seem to be getting the opposit results from these tests that are intended. They are weeding out the good, honest, and hard working employees. The only people that can pass these things are liars, cheaters, and BSers. Is that the type of employee they really wan't.
Be very careful when reading these surveys. The wording can be critical, and can mean something different than what the headline is implying. For example:
If you were told that you were going to be fired tomorrow, what, if anything would you take with you?
The answer would have to include things that you already have in your possession. So no malicious intent is required here! For example, 5% responded "R&D plans." That doesn't mean that they would steal R&D plans in response to being fired. It could be that they already had those plans on a flash drive on their key ring, perhaps because they gave a presentation on the topic recently. 8% responded "Privileged password list" which could mean that they keep an encrypted copy of vital passwords in case they need to remote into the servers from home. They might take the "Customer database" because they keep a copy on their laptop in case they are on call and need to contact a customer.
The problem I have with this is the hypothetical "if you were fired tomorrow" angle on the survey. Why would I be fired tomorrow? For cause? Due to downsizing? A lot of people would feel threatened if they were suddenly fired, especially if they can see their termination as unjustified. This doesn't justify their potential actions, but it really leaves out a lot. How many people, if they were fired tomorrow, would come back with a gun and start shooting people? Probably a lot less. Was that question on the survey?
I actually had company backup tapes in my possession when I was let go once. Took them back a few days later, and they were so pleased that they told me to keep the 56k modem that I had used for remote access.
"Think about how stupid the average person is. Now, realise that half of them are dumber than that." - George Carlin
That is awesome!
Instead of losing a copy of your data when you fire an employee, you lose complete access to your data when you "fire" the cloud provider.
Or when they fire you by jacking up the rates so much that your company profits go to their company.
I love it!
You have two competing goals, company security BY the employees, vs company security FROM the employees.
IT are like the cops in town. In order for them to do their job you have to trust them with powers that can be abused. There is no perfect solution to this problem. The best thing you can do if you are a reasonable sized organization is to simply have the power spread out horizontally well, so the watchers can watch each other.
In small businesses, you may have a small IT staff tree that's composed of people that do jobs that have very little overlap, and that makes their position more abusable.
I've seen it work both ways on the way out. I've seen people get 6 weeks of advance notice, and I've personally been handed papers when I arrived in the parking lot. Paranoia varies, just as trust varies. If you're in an "at-will state" you can get the rug pulled out at any time, and many companies do this as a matter of policy. I consider it very double-standardish, that last place my manager told me he expected me to give two weeks notice if I was leaving, but when I asked how much notice he'd give me, well, that's different! IMHO, employers that think that's playing fair deserve zero day notice, and should consider that the tradeoff for having a zero-day notice for their employees.
Considering the present economy, the value of job security has gone up, and I would certainly find a job less attractive if I knew my employer had a "meet you at the door on Monday with a box of your stuff" policy. But what if I were going to be evil? Then I'd say you need to train your HR people to hire people with better character, good references, and thorough background and job-history checks. You need to be able to trust your IT staff, because of the nature of their position, just like the city needs to be able to trust the cops it hires. If you don't hire people you don't trust, you don't have to zero-day bomb them when layoffs are required. Promote from within instead of hiring off the street into positions of trust and power. If a new hire isn't trustworthy, thank him for his time and give him his two weeks and find someone else. Don't burn people that are in a position of power.
You think it's unfair when a semi-key staff walks on you? Try being that staff when he gets to go home and sit on the couch all day waiting for the wife to get off work, trying to figure out how to tell her he's unemployed as of now. It hits the employee a lot harder than it should hit the company. And in any reasonable sized company, no single person walking should be able to do great damage, nothing like your home income dropping 50 (or 100) percent overnight.
I also read from time to time about karma coming back and biting employers that zero-day a key IT. And I'm not talking about the cases where Joe Fired remotes in and makes a mess etc. I mean the "this broke again, oh crap, Joe usually fixes this, what do we do now?" sort of cases. Responsible employees try to prevent this sort of dependency but companies often don't give enough time or resources to accomplish it. (time to document, hours to crosstrain, etc) So you can't just blindly go blaming the employee. And so now you're left with missing key experience, and a burned bridge. I watched that happen twice at one company. They zero-day'd a key person, only to find that he was the best go-to man for certain things, and a company mass-mail went out to NOT call that person for help. (because they had made it clear they were going to charge for every support call they received a result of his departure) So that leaves us all fumbling around for hours at a tim trying to figure things out that a 10 second phonecall could have solved. Wonderful waste of resources, makes us look like bumbling idiots in front of the client, etc. "Why are you here? Where's Joe, he's always the one you send to work on our server? Really? Are you going to be able to fix this? (after a few hrs...) Can't we just call
I work for the Department of Redundancy Department.
Companies might build TRUST with their employees that they won't get fired at the drop of a hat, and Companies might develop an ecosystem of resilience with their workers, such that everyone feels responsible for the company and vice versa. How? Socialism. Democritise the work place. VOTE for your boss. You wouldn't accept totalitarian political solutions, why do you accept totalitarian economic solutions? If everyone felt like what they did mattered, and felt like their employment was a vital part of their existence (as opposed to something they do to make money) then people wouldn't dream of walking off with data when they get fired, because getting fired would be rare, and a mark of massive failure. CHANGE YOUR WORLD. For the better. it's not that hard. You just have to get off your ass and demand it.
Shoes for Industry. Shoes for the Dead.
This is the mentality that causes people to stick it to the holy churches of corporate psychopathy in the first place. subject employees to hostile working environments like slaves, and they'll act like slaves when they rebel.
That's why you don't understand.
The title should read: " MANAGEMENT Admits They'd Walk Out With Stolen Data If Fired"
TFS says they surveyed managers and executives, not rank and file.
General Relativity: Space-time tells matter where to go; Matter tells space-time what shape to be.
An ID management provider does a survey designed to promote identity management. Why should I trust them?
In 30 years as a software dev I don't think I've known more than a couple computer geeks who might have the guts to steal data, let alone the personality to locate a buyer, negotiate a price and actually follow through on the deal. Sure we've all seen Office Space and talked trash about what we'd like to do to a company, but at the moment of truth, no way. And managers tend to be even more gutless -- something tells me the survey results were heavily skewed by false bravado.
I very much doubt I'd want or have any need for crm data, financials etc, and on moral grounds wouldn't consider it anyway. However, when it comes to my own knowledge that i've dumped on our wiki (linux tips and tricks, oracle installation/configuration notes, useful sql/scripts etc), hell yes. I've put that content there and use it quite often. If I can't put that kind of things there without being able to take it when I leave, why should I bother putting it there at all.
"Stealing data" is another way of saying "offsite backup".
The one time I was laid off (knowing it was coming for months - closing an entire facility, plus I got extended a couple times and had turned down an offer to move to Dayton, Ohio), I was working on wrapping up a project up to the very last day. The last parts were documenting, etc. but when I walked out the door I had my personal laptop that I'd been using for some development work and testing.
What did I do with the company information on that laptop? I zipped it all up, burned it to a CD along with an index/directory and notes on what might be of interest in case there was anything like homegrown test tools that wasn't on my main system, and mailed it to them. What did I get for all this? Thanks for being so great about everything, which kind of confused me - they'd offered to keep me on if I was willing to move and I refused, and I wasn't going to screw the people I'd been working with for years.
If you dislike the people you work with enough to screw them when you leave, you're in the wrong place (mentally, physically, whatever) already.
As it turned out, I ended up doing some fairly substantial hourly consulting for a different division of the same company a few years later, and I suspect that had I pouted my way out the door it wouldn't have happened. I didn't end up needing any of my old coworkers as references (jumped into freelance work with some other former employees), but I have no doubt that I'd have been able to get good references with no difficulties.
fencepost
just a little off
There is, believe it or not, another way - it consists in treating your employees as real people, with fairness, respect, dignity and honour. The fact is, you basically get what you ask for; if your whole attitude is that your coworkers are criminals, then for the most part that is exactly what they will choose to be.
I know this from personal experience - at one point I felt ostracised and treated with suspicion and contempt; and I wouldn't have hesitated with stripping the company of all valuables if I had got the chance. Then we got a new manager, who gave a fair chance to prove myself - and now I wouldn't dream of betraying the trust of my workplace. Of course, the problem is finding a manager who has the integrity and the guts.
... They are not "insiders" any more. You could call it "previously-insiders" threat.
And there in lies the problem. If I develop code, on my own time, that I reuse at the workplace, whose code is it?
Yours, but only if you take proper steps to make sure that they know it is yours. I would suggest offering the code to the company to use in perpetuity for the golden license fee of $.01 if you really have some re-usable code you want to give them. They won't balk at the price, and you can whip out a simple little contract that says you own the code but they can do whatever they like with it internally. Then there is never a legal question over who created it later.
HA! I just wasted some of your bandwidth with a frivolous sig!