Home » Data Protection » Malware/Cybercrime

Opinion

Laid-off Workers as Data Thieves?

A Symantec/Ponemon report points to an ominous byproduct of the economic crisis: laid-off employees stealing data in acts of vengeance. CSO Senior Editor Bill Brenner is skeptical of this report's news value

By Bill Brenner, Senior Editor

Page 2

Not wanting to be left out of a juicy PR opportunity, the public relations representative for data loss prevention vendor Fidelis sent along this pitch:

"A layoff is tough for an employee. It is also increasingly tough on employers, as employees walk out the door with confidential and proprietary information. This reality has resulted in increased sales of data leakage prevention software. This software monitors and can prevent the intentional or unintentional transmission of confidential, proprietary data. One data leakage prevention company whose sales have substantially increased in the past year is Fidelis Security Systems of Bethesda, MD."

The PR rep encouraged me to call him to set up an interview with the vendor to discuss "trends in data theft and the sale of software to prevent it."

Right about now many of my PR friends are getting annoyed with me. I don't blame them. They are, after all, simply doing their jobs -- looking for timely news angles to draw attention to their clients' products. Many of them are driven by a genuine conviction that their clients offer real solutions in a cybersecurity world gone mad.

The goal of this column isn't to belittle them. Rather, it's to point out that some threats have been around for a long time. They are not some new recession-driven phenomenon justifying a panicked security shopping spree. I can't help but think of the ill-advised DHS campaign that sent people scurrying to the store in search of duct tape and plastic sheeting in 2003.

The fact of the matter is that disgruntled employees have always been a threat to businesses. Sure, incidents will spike in times of massive layoffs because there are more angry people out there. But the insider threat is an old problem. [See: Embarrassing Insider Jobs Highlight Security, Privacy Holes]

One could also argue that laid-off employees aren't as big a threat as those who remain on the inside with access to data they can sneak off to black marketers offering cash for proprietary data one can only obtain if they're still on the inside.

If enterprise security shops are only now discovering the insider threat and the need for a layered defense with tighter access controls, they have bigger problems than the current recession.

Employees with an ax to grind were around before the economic collapse and they will be around after the economy recovers. Companies should have a program in place to deal with such miscreants in any economic climate.