Close
  • Latest News
  • Big Data and Analytics
  • Cloud
  • Networking
  • Cybersecurity
  • Applications
  • IT Management
  • Storage
  • Sponsored
  • Mobile
  • Small Business
  • Development
  • Database
  • Servers
  • Android
  • Apple
  • Innovation
  • Blogs
  • PC Hardware
  • Reviews
  • Search Engines
  • Virtualization
Read Down
Sign in
Close
Welcome!Log into your account
Forgot your password?
Read Down
Password recovery
Recover your password
Close
Search
Logo
Logo
  • Latest News
  • Big Data and Analytics
  • Cloud
  • Networking
  • Cybersecurity
  • Applications
  • IT Management
  • Storage
  • Sponsored
  • Mobile
  • Small Business
  • Development
  • Database
  • Servers
  • Android
  • Apple
  • Innovation
  • Blogs
  • PC Hardware
  • Reviews
  • Search Engines
  • Virtualization
More
    Home Applications
    • Applications
    • Cybersecurity
    • IT Management

    How to Protect Against Insider Security Breaches

    By
    Craig Palmore
    -
    January 20, 2010
    Share
    Facebook
    Twitter
    Linkedin

      XYZ Corporation’s trusted employee, Harry, scanned his computer screen, whistling through his teeth. “Nearly there now,” he thought. “Just a few more clicks and I’ll get what I need to know. They’re going to pay me for what I find out.” Harry’s fingers flew over the keyboard, typing in the password. A malicious smile spread across his face as the spreadsheet opened, revealing column after column of sensitive information about all his fellow employees. It took him a while to find the juicy details about his chief rival for the position he wanted.

      “I might as well be hanged for a sheep as a lamb,” Harry mused. “While I’m here, I’ll see what I can find out about Jenny in Accounting; a bit of background might improve my chances with her, too.”

      In another company across town …

      A new personal assistant named Jeff rolled his eyes at the on-screen request. “You stupid system; I’m allowed to access this file. It’s my job to make sure that everyone gets the mail-out inviting them to the holiday party. So I’ve got to get everyone’s home address.” Jeff tapped in his password and opened the file. “Dumb machine,” he thought. Breezily, he scanned the information that opened up, expecting to see a list of addresses.

      “Uh-oh!” he thought as he saw a list of medical details open up instead. “This isn’t what I wanted!” A familiar name caught his eye, alongside an embarrassing detail. “I’m in trouble now. He won’t want me knowing that!” Hastily, Jeff closed the file and buried his head in his hands. “How am I going to keep what I read there secret and not blurt it out? And how much trouble am I in for getting into a file I shouldn’t have accessed?”

      These are two examples of how sensitive information within a network can be accessed by unauthorized employees-either deliberately by a malicious insider or inadvertently by an inexperienced operator. Whether it’s a trade secret, private employee detail or something else, sensitive company data is more vulnerable to inside parties who access it rather than to hackers from outside who try to break into a system to steal information. While the popular image of security breaches is one of bored, intelligent teenagers getting into Pentagon files just for a laugh to see if they can do it, most security breaches are insider jobs.

      Have an Auditing System in Place

      Have an auditing system in place

      One of the most common ways of preventing this security breach from occurring is to have an auditing system in place, which monitors who is doing what within the system. However, this is a classic case of shutting the stable door after the horse has been stolen. Having an auditing system in place, and publicizing this fact, will help to deter the malicious insiders of the corporate world. Harry knows he will get found out eventually, but this won’t actually stop him from trying to get the dirt on his rival.

      And, even if Harry is given the boot, no auditing system in the world can erase the sensitive information from Harry’s mind. Even if the system security folks check Harry’s laptop, flash drive and other information storage devices before he is shown the door in disgrace, they can’t get rid of the hard-copy printout Harry has stashed in his files at home.

      And, auditing systems won’t stop the inexperienced operators of the corporate world from accidentally stumbling onto what they shouldn’t. After what Jeff inadvertently did, he will probably get a dressing-down from his supervisor when the audit reveals all. This will probably be followed by a bit of retraining for Jeff so that the problem doesn’t happen again.

      Implement a job rotation system

      Another method of preventing insider security breaches is to implement a system of job rotation or separation of duties. However, these systems are rather limiting, and can prevent business and communication from flowing smoothly. This is because they are designed to not let the right hand know what the left hand is doing. A personal assistant such as Jeff ends up wasting time going from person to person, trying to find out a few simple details. Job rotation is also detrimental to office morale, and is likely to create an atmosphere of suspicion and mistrust rather than teamwork.

      Use Multi-Party Authorization

      Use Multi-Party Authorization

      A better method for preventing interior security breaches is Multi-Party Authorization (MPA). MPA requires two or more people in order to allow access to a certain file before it is opened. This is similar to bank accounts that require more than one signature on the checks before funds are released. One person can’t do it on his or her own. This means that employee Harry, for example, is prevented from getting into the details he wants, as someone else will have to approve his access. And employee Jeff is also prevented from getting into the wrong files by mistake.

      The advantage that MPA has over other methods of internal security is that it is proactive and prevents data from ever being compromised, rather than dealing with the breach after it has happened. And, unlike job rotation and duty separation, MPA promotes teamwork and communication rather than hindering it.

      MPA is suitable for all workplace networks and can be used to protect any type of sensitive information, ranging from salary details to personal communication. MPA is able to work in real time, allowing businesses to run smoothly without any unwanted holdups.

      Craig Palmore is a co-founder and the Director of Business Development at Engedi Technologies. His prior experience includes a variety of leadership positions in finance, technology and engineering companies. Before co-founding Engedi, Craig was a manager in the financial risk management group at PricewaterhouseCoopers. Prior to that, Craig worked at KMV Corporation, where he was responsible for marketing, sales, training and product support to clients representing commercial and investment banks. Earlier, at Swiss Bank Corporation, Craig assisted in the credit management of industry portfolios. Craig also co-founded an engineering consulting company in the early 1990s. Most recently, he was a co-founder of a financial technology company in New York City, serving the needs of commercial banks and fund managers.

      Craig received a B.S. in Civil Engineering from the Virginia Military Institute, and served six years active duty with the United States Navy Civil Engineer Corps, with duty assignments in Washington DC, Antarctica, Micronesia, and Hanoi, Vietnam. Craig is a licensed Professional Engineer in the State of Virginia, and received his MBA from the Fuqua School of Business at Duke University. He can be reached at [email protected].

      Craig Palmore
      Craig Palmore is a co-founder and the Director of Business Development at Engedi Technologies. His prior experience includes a variety of leadership positions in finance, technology and engineering companies. Before co-founding Engedi, Craig was a manager in the financial risk management group at PricewaterhouseCoopers. Prior to that, Craig worked at KMV Corporation, where he was responsible for marketing, sales, training and product support to clients representing commercial and investment banks. Earlier, at Swiss Bank Corporation, Craig assisted in the credit management of industry portfolios. Craig also co-founded an engineering consulting company in the early 1990s. Most recently, he was a co-founder of a financial technology company in New York City, serving the needs of commercial banks and fund managers. Craig received a B.S. in Civil Engineering from the Virginia Military Institute, and served six years active duty with the United States Navy Civil Engineer Corps, with duty assignments in Washington DC, Antarctica, Micronesia, and Hanoi, Vietnam. Craig is a licensed Professional Engineer in the State of Virginia, and received his MBA from the Fuqua School of Business at Duke University. He can be reached at [email protected]

      MOST POPULAR ARTICLES

      Cybersecurity

      Visa’s Michael Jabbara on Cybersecurity and Digital...

      James Maguire - May 17, 2022 0
      I spoke with Michael Jabbara, VP and Global Head of Fraud Services at Visa, about the cybersecurity technology used to ensure the safe transfer...
      Read more
      Big Data and Analytics

      Alteryx’s Suresh Vittal on the Democratization of...

      James Maguire - May 31, 2022 0
      I spoke with Suresh Vittal, Chief Product Officer at Alteryx, about the industry mega-shift toward making data analytics tools accessible to a company’s complete...
      Read more
      Big Data and Analytics

      GoodData CEO Roman Stanek on Business Intelligence...

      James Maguire - May 4, 2022 0
      I spoke with Roman Stanek, CEO of GoodData, about business intelligence, data as a service, and the frustration that many executives have with data...
      Read more
      Applications

      Cisco’s Thimaya Subaiya on Customer Experience in...

      James Maguire - May 10, 2022 0
      I spoke with Thimaya Subaiya, SVP and GM of Global Customer Experience at Cisco, about the factors that create good customer experience – and...
      Read more
      Cloud

      Yotascale CEO Asim Razzaq on Controlling Multicloud...

      James Maguire - May 5, 2022 0
      Asim Razzaq, CEO of Yotascale, provides guidance on understanding—and containing—the complex cost structure of multicloud computing. Among the topics we covered:  As you survey the...
      Read more
      Logo

      eWeek has the latest technology news and analysis, buying guides, and product reviews for IT professionals and technology buyers. The site’s focus is on innovative solutions and covering in-depth technical content. eWeek stays on the cutting edge of technology news and IT trends through interviews and expert analysis. Gain insight from top innovators and thought leaders in the fields of IT, business, enterprise software, startups, and more.

      Facebook
      Linkedin
      RSS
      Twitter
      Youtube

      Advertisers

      Advertise with TechnologyAdvice on eWeek and our other IT-focused platforms.

      Advertise with Us

      Menu

      • About eWeek
      • Subscribe to our Newsletter
      • Latest News

      Our Brands

      • Privacy Policy
      • Terms
      • About
      • Contact
      • Advertise
      • Sitemap
      • California – Do Not Sell My Information

      Property of TechnologyAdvice.
      © 2021 TechnologyAdvice. All Rights Reserved

      Advertiser Disclosure: Some of the products that appear on this site are from companies from which TechnologyAdvice receives compensation. This compensation may impact how and where products appear on this site including, for example, the order in which they appear. TechnologyAdvice does not include all companies or all types of products available in the marketplace.

      ×