Security 2012: Prepare for rogue employees before they strike

Companies advised to lock down computers and mobile devices that may have accessed data

Information stolen electronically by rogue ex-employees can be detected and used in prosecutions if companies take adequate steps to lock down computers and mobile devices involved, according to a forensics investigator.

Speaking at Security 2012 in Sydney, Klein & Co director, Nick Klein, told delegates that a number of companies who have contacted him after suffering a data loss did not have a data recovery plan in place.

Security threats explained: Internal excessive privilege

“We ask them what happened to the computer that was used to steal information and find out they redistributed it to another staff member two months ago,” he said. “Then we ask them what happened to the mobile phone and they say it was replaced.”

In addition, companies had not saved backup data which could point investigators to clues as to what data the culprit had stolen.

According to Klein, the most important step companies should take is to develop a data breach plan.

“Think about where your confidential data is, how someone is going to steal it and if they did it, how would you detect and investigate it?” he said.

Klein added that if IT executives knew where their data was they could start putting controls in place such as logging and monitoring.

In addition, executives should consider installing improved access control systems or data loss prevention offerings to detect when someone's attempting to access information.

“We have had clients call us up six months later and say it’s happened again,” he said. “But this time they have put the computer in storage and seized the mobile phone.”

During an investigation, forensic investigators build a chronology of what happened in the computer including email data and time stamps within Word documents.

“Quite often we find evidence that people have plugged a USB key into their computer and browsed network folders for information that they shouldn’t be accessing,” Klein said.

If the evidence is enough to build a case which proceeds to legal proceedings, he said companies should brief lawyers who have an understanding of ICT evidence.

“If it does go to court make sure your barrister can show what the evidence proves because at the end of the day they’re the ones who have to present and argue the case in court,” he said.

Follow Hamish Barwick on Twitter: @HamishBarwick

Follow CIO Australia on Twitter and Like us on Facebook… Twitter: @CIO_Australia, Facebook: CIO Australia, or take part in the CIO conversation on LinkedIn: CIO Australia

Join the Computerworld Australia group on Linkedin. The group is open to IT Directors, IT Managers, Infrastructure Managers, Network Managers, Security Managers, Communications Managers.

More about: etwork, Facebook
References show all
Comments are now closed.
Related Whitepapers
Latest Stories
Community Comments
Whitepapers
All whitepapers

NBN Co hits 105Mbps in limited FTTN trial

READ THIS ARTICLE
MORE IN Social Networking
DO NOT SHOW THIS BOX AGAIN [ x ]
Sign up now to get free exclusive access to reports, research and invitation only events.

Computerworld newsletter

Join the most dedicated community for IT managers, leaders and professionals in Australia