An article broke yesterday that closely mirrors one of the discussion topics within the Human Factors seminar that I teach for the Norwich University MSIA program.
CNN reported that a couple of ex-Coca-Cola employees were sentenced to prison and ordered to pay $40,000 each for “conspiring to steal and sell trade secrets to rival Pepsi.”
One will get 8 years in prison and the other will get 5 years.
Another ex-Coca-Cola-worker was also involved and will be charged with wire fraud and unlawfully stealing and selling trade secrets, as were the other two, and sentenced this summer.
Pepsi notified Coca-Cola that the three had offered to sell samples of a new Coke product to Pepsi for $1.5 million.
Discussion of this type of incident is always fascinating. Thoughtful discussion highlights the importance of not only access controls to sensitive information, but also how important practicing ethical behavior, and having a code of ethics, is, and how it complements information security and privacy efforts.
A few things to point out about this:
* These were trusted employees with access to sensitive information (trade secrets) and actual product samples.
* The trade secrets were printed out and hard copies were offered to the primary competitor.
* An actual sample of the new product was offered to the primary competitor.
Here are a couple of scenarios for you to thing about:
* What if you had hired someone for a position…someone who used to be employed at your biggest competitor? What if the person said they still had access to their former employee’s computers systems and networks? What if they offered to log in and get access to the competitor’s trade secrets, customer database, or other sensitive information? What would you do?
Would you contact the competitor and let them know of that they need to review their procedures for completely removing all access to their networks when their employees leave the company? And that one of their ex-employees still, indeed, had access and was offering to give access to their trade secrets and customer lists?
* What if an employee from your competitor contacted you with a similar offer as in the Coca-Cola case? What if they offered to sell you the brand new plans or recipes for a product that your company has already determined will likely drastically cut into your company’s revenues?
Pepsi certainly exemplified doing the right, ethical, thing by working with law enforcement and Coca-Cola to make sure the at-the-time employees of Coca-Cola were brought to justice. But would all companies do that?
This is certainly an important talk to have with your legal counsel and HR head. Not only do you need to know what you would do in these situations, you need to work with the area that is responsible for your company’s code of ethics and ensure your information security and privacy policies and practices are hooked into them, and vice-versa.
You don’t have a code of ethics? Safeguarding your information depends heavily upon your employees doing the right thing. Your employees to whom you have entrusted your company’s trade secrets and customer information. You must tell employees what your expectations are for how they use the access with which they have been entrusted to your information and computer systems.
Ethics, information security and privacy all go hand-in-hand.
Tags: awareness and training, ethics, Information Security, insider threat, IT compliance, policies and procedures, privacy