eWEEK content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.
XYZ Corporation’s trusted employee, Harry, scanned his computer screen, whistling through his teeth. “Nearly there now,” he thought. “Just a few more clicks and I’ll get what I need to know. They’re going to pay me for what I find out.” Harry’s fingers flew over the keyboard, typing in the password. A malicious smile spread across his face as the spreadsheet opened, revealing column after column of sensitive information about all his fellow employees. It took him a while to find the juicy details about his chief rival for the position he wanted.
“I might as well be hanged for a sheep as a lamb,” Harry mused. “While I’m here, I’ll see what I can find out about Jenny in Accounting; a bit of background might improve my chances with her, too.”
In another company across town …
A new personal assistant named Jeff rolled his eyes at the on-screen request. “You stupid system; I’m allowed to access this file. It’s my job to make sure that everyone gets the mail-out inviting them to the holiday party. So I’ve got to get everyone’s home address.” Jeff tapped in his password and opened the file. “Dumb machine,” he thought. Breezily, he scanned the information that opened up, expecting to see a list of addresses.
“Uh-oh!” he thought as he saw a list of medical details open up instead. “This isn’t what I wanted!” A familiar name caught his eye, alongside an embarrassing detail. “I’m in trouble now. He won’t want me knowing that!” Hastily, Jeff closed the file and buried his head in his hands. “How am I going to keep what I read there secret and not blurt it out? And how much trouble am I in for getting into a file I shouldn’t have accessed?”
These are two examples of how sensitive information within a network can be accessed by unauthorized employees-either deliberately by a malicious insider or inadvertently by an inexperienced operator. Whether it’s a trade secret, private employee detail or something else, sensitive company data is more vulnerable to inside parties who access it rather than to hackers from outside who try to break into a system to steal information. While the popular image of security breaches is one of bored, intelligent teenagers getting into Pentagon files just for a laugh to see if they can do it, most security breaches are insider jobs.
Have an Auditing System in Place
Have an auditing system in place
One of the most common ways of preventing this security breach from occurring is to have an auditing system in place, which monitors who is doing what within the system. However, this is a classic case of shutting the stable door after the horse has been stolen. Having an auditing system in place, and publicizing this fact, will help to deter the malicious insiders of the corporate world. Harry knows he will get found out eventually, but this won’t actually stop him from trying to get the dirt on his rival.
And, even if Harry is given the boot, no auditing system in the world can erase the sensitive information from Harry’s mind. Even if the system security folks check Harry’s laptop, flash drive and other information storage devices before he is shown the door in disgrace, they can’t get rid of the hard-copy printout Harry has stashed in his files at home.
And, auditing systems won’t stop the inexperienced operators of the corporate world from accidentally stumbling onto what they shouldn’t. After what Jeff inadvertently did, he will probably get a dressing-down from his supervisor when the audit reveals all. This will probably be followed by a bit of retraining for Jeff so that the problem doesn’t happen again.
Implement a job rotation system
Another method of preventing insider security breaches is to implement a system of job rotation or separation of duties. However, these systems are rather limiting, and can prevent business and communication from flowing smoothly. This is because they are designed to not let the right hand know what the left hand is doing. A personal assistant such as Jeff ends up wasting time going from person to person, trying to find out a few simple details. Job rotation is also detrimental to office morale, and is likely to create an atmosphere of suspicion and mistrust rather than teamwork.
Use Multi-Party Authorization
Use Multi-Party Authorization
A better method for preventing interior security breaches is Multi-Party Authorization (MPA). MPA requires two or more people in order to allow access to a certain file before it is opened. This is similar to bank accounts that require more than one signature on the checks before funds are released. One person can’t do it on his or her own. This means that employee Harry, for example, is prevented from getting into the details he wants, as someone else will have to approve his access. And employee Jeff is also prevented from getting into the wrong files by mistake.
The advantage that MPA has over other methods of internal security is that it is proactive and prevents data from ever being compromised, rather than dealing with the breach after it has happened. And, unlike job rotation and duty separation, MPA promotes teamwork and communication rather than hindering it.
MPA is suitable for all workplace networks and can be used to protect any type of sensitive information, ranging from salary details to personal communication. MPA is able to work in real time, allowing businesses to run smoothly without any unwanted holdups.
Craig Palmore is a co-founder and the Director of Business Development at Engedi Technologies. His prior experience includes a variety of leadership positions in finance, technology and engineering companies. Before co-founding Engedi, Craig was a manager in the financial risk management group at PricewaterhouseCoopers. Prior to that, Craig worked at KMV Corporation, where he was responsible for marketing, sales, training and product support to clients representing commercial and investment banks. Earlier, at Swiss Bank Corporation, Craig assisted in the credit management of industry portfolios. Craig also co-founded an engineering consulting company in the early 1990s. Most recently, he was a co-founder of a financial technology company in New York City, serving the needs of commercial banks and fund managers.
Craig received a B.S. in Civil Engineering from the Virginia Military Institute, and served six years active duty with the United States Navy Civil Engineer Corps, with duty assignments in Washington DC, Antarctica, Micronesia, and Hanoi, Vietnam. Craig is a licensed Professional Engineer in the State of Virginia, and received his MBA from the Fuqua School of Business at Duke University. He can be reached at palmore@engedi.net.