I’ve been hearing a lot over the past year about trusted insiders…or formerly trusted insiders…doing bad things to their employers, ex-employers, the customers, and so on. The latest I’ve heard about is the Honeywell ex-employee who the company says posted sensitive information about 19,000 of the company’s U.S. employees. When I read these types of incidents, I wonder, why did one person have access to all the information on all these people? If the person truly needed it, why weren’t there compensating controls to monitor what a person with such trust and access did with this data? The story reported, "In the court filings, Honeywell claimed that Nugent "intentionally exceeded authorized access to a Honeywell computer," but the integrity of Honeywell’s computer systems was not compromised, Ferris said. " So, was this employee a systems administrator?
Companies must realize, after hundreds of frauds and incidents over the years, that information is most vulnerable to those in trust. Just look at the yearly CERT/Secret Service Study. Why does it always seem that most companies do not want to appropriately or adequately safeguard information until something bad happens? Why are business leaders so willing to gamble that something bad will not happen within their organization? Surely they do not take the same gambles with the other parts of their business…or do they?
Technorati Tags
insider threat
fraud