How to become spies

[Витаутас. Частный детектив г. Вильнюс. Литва]

How to become spies: Symantec has published a study on the psychological aspects of data theft
01/17/2012 Symantec Corporation announces the results of a new study, “Behavioral Risk Indicators for Identifying Insider Theft of Intellectual Property”.

This report was conducted in order to answer the questions of organizations that are worried about the potential theft of important intellectual private information by their own employees. The study reveals the conditions when people and organizations become exposed to these risks. The document was prepared by Eric Shaw and Harley Stock, experts in the field of psychological testing and risk management related to employee actions.

“Most organizations fear external security threats, but malicious behavior by insiders using their rights to some internal information may pose even greater risks,” said Francis deSouza, president of Symantec's corporate product and service group. “In an era of developing global markets, companies and government agencies of all sizes are faced with increasing difficulties in protecting the most valuable resources - intellectual property - from competitors.”

Theft of intellectual property cost US businesses more than $ 250 billion in one year, and according to the FBI, insider activity is the main tool of opponents to steal private data and the main cause of such leaks. Based on empirical research, Eric Shaw and Harley Stoke identified key behaviors and indicators indicative of intellectual property theft by insiders. Some theft patterns are used most often:

* Theft of intellectual property by insiders often occurs in technical positions: the majority of employees stealing information are men around the age of 37 who hold various positions, including engineers and scientists, managers and programmers. Most of them have signed non-disclosure agreements. This means that the presence of politicians alone, without understanding and effective application by their employees, will not produce a result;

* Usually, information is hijacked by employees receiving a new job: about 65% of employees who have committed theft of intellectual property move to a new position in a competing company, or start their business during the theft. About 20% were hired by an external attacker hunting for important data, and 25% transferred information to another company or country. In addition to this, more than half of the data was stolen in the last month of employee work;

* Insiders basically steal the information that they have access to: subjects copy the data that they know, with which they work and access to which is somehow permitted. In fact, 75% of insiders steal material to which they have been granted legitimate access;

* Trade secrets are most often transmitted by insiders: in 52% of cases, trade secrets were stolen. Business information, such as billing data, price lists and other administrative data, is stolen only in 30% of cases. The source code is copied in 20% of cases, private software - in 14%, customer information - in 12% and business plans - in 6%;

* Insiders use technical means, but most thefts are detected by non-technical employees: the majority of entities (54%) use network and email, remote access channels or file transfer services to transfer stolen data. However, most thefts are detected by non-technical specialists;

* The theft is preceded by key prerequisites: the main problems arise before the insider commits theft, and are the motivation for the insider. Previously, psychological prerequisites, stresses and appropriate behavior occur - all this can be an indicator of the risk of an insider attack;

* Demotion leads to plans to steal information: it is important to pay attention to when the employee begins to "think about it" and decides to go to action, or other people persuade him. This often happens in the event of a demotion or when career expectations are not met.

The report includes practical recommendations for managers and experts in the field of information security, allowing to prepare for the risks of theft of intellectual property. Among them:

* Create a team: in order to respond to the threat of insiders, organizations need to create a dedicated team consisting of specialists from HR, information security and lawyers who will formulate policies, conduct training and track the activities of problem employees;

* Organizational measures: companies need to assess what level of risk they are dealing with, based on related factors - employee morale, competitive risks, enemy actions, the presence of foreign rivals, engagement of contractors, etc .;

* Screening before hiring: information collected during the interview process will help HR managers make informed decisions and minimize the risk of hiring “problem” employees;

* Policies and practices: there is a list of specific policies and practices that should be implemented by the main structures of the company;

* Trainings and training: they are a necessary component to ensure the effectiveness of policies if they are not recognized, understood, or have insufficient effect. For example, most people stealing information actually signed a non-disclosure agreement. Organizations should conduct more detailed conversations with employees about what data can and cannot be transferred when switching to another job, explaining what the violation of these agreements may lead to;

* Continuous assessment: without monitoring the effectiveness of policies, compliance with them will decrease, and the risks of insider attacks will increase.

In addition to this, Symantec recommends:

* Take preventive measures, identifying the risky behavior of insiders, through the use of information security technologies, such as data loss prevention systems (DLP);

* Implement data protection policies by monitoring the unauthorized use of confidential information, as well as inform employees about violations - this will help to increase staff awareness, preventing them from data theft;

* Inform the managers, HR service and personnel responsible for information security when an existing or dismissed employee accesses important data or downloads it in an atypical way, thanks to file monitoring technologies such as Data Insight.

 

[Игорь Эдуардович]

Thank you! I read it with interest!

 

[Евгений СБ]

Thank.

 

[Детективное агентство Тула]

Thanks for the clever idea!

 

[Симферополь]

Thanks for the stuff!

 

[Плотников Юрий Михайлович]

Thanks, interesting!

 

[Детективное агентство. Москва. Арбат.]

Interesting

 

[Частный детектив. Тайный советник. Омск.]

Vytautas, thanks for the interesting stuff !!!

 

[Детектив-Молдова]

Thank!
Very interesting stuff!
The recommendations are relevant for both heads of state institutions and private business managers.
In their practice, they had one order on this topic.
A former employee of the company, upon dismissal, also grabbed a copy of the program, which was the author. Despite the fact that the technology was patented by the company in which he previously worked, he sold the program to a rival company, which subsequently illegally sold similar products to our client. The information and evidence we obtained helped our client substantiate the lawsuit against plagiarists.

 

[Stels]

In theory, everything is beautiful, but in practice it is unlikely that the implementation of the whole complex of measures will be cost-effective for small campaigns.