Security 2012: Prepare for rogue employees before they strike

Information stolen electronically by rogue ex-employees can be detected and used in prosecutions if companies take adequate steps to lock down computers and mobile devices involved, according to a forensics investigator.

Speaking at Security 2012 in Sydney, Klein & Co director, Nick Klein, told delegates that a number of companies who have contacted him after suffering a data loss did not have a data recovery plan in place.

Security threats explained: Internal excessive privilege

“We ask them what happened to the computer that was used to steal information and find out they redistributed it to another staff member two months ago,” he said. “Then we ask them what happened to the mobile phone and they say it was replaced.”

In addition, companies had not saved backup data which could point investigators to clues as to what data the culprit had stolen.

According to Klein, the most important step companies should take is to develop a data breach plan.

“Think about where your confidential data is, how someone is going to steal it and if they did it, how would you detect and investigate it?” he said.

Klein added that if IT executives knew where their data was they could start putting controls in place such as logging and monitoring.

In addition, executives should consider installing improved access control systems or data loss prevention offerings to detect when someone’s attempting to access information.

“We have had clients call us up six months later and say it’s happened again,” he said. “But this time they have put the computer in storage and seized the mobile phone.”

During an investigation, forensic investigators build a chronology of what happened in the computer including email data and time stamps within Word documents.

“Quite often we find evidence that people have plugged a USB key into their computer and browsed network folders for information that they shouldn’t be accessing,” Klein said.

If the evidence is enough to build a case which proceeds to legal proceedings, he said companies should brief lawyers who have an understanding of ICT evidence.

“If it does go to court make sure your barrister can show what the evidence proves because at the end of the day they’re the ones who have to present and argue the case in court,” he said.

Follow Hamish Barwick on Twitter: @HamishBarwick

Follow CIO Australia on Twitter and Like us on Facebook… Twitter: @CIO_Australia, Facebook: CIO Australia, or take part in the CIO conversation on LinkedIn: CIO Australia