A new white paper from Symantec profiles the risk indicators of the malicious insider. There are key patterns and technologies that can help you identify the employee who might have a penchant to steal your company’s intellectual property.
Be on the lookout for this person: He is currently employed, between the age of 35 and 40, holds a technical position, and he has a new job offer at a competing company.
Calm down, this is not a Department of Homeland Security profile for some terrorist. But it’s someone companies the world over should be concerned about.
He is the “malicious insider,” as profiled by Dr. Eric Shaw and Dr. Harley Stock, experts in the fields of psychological profiling and employee risk management, in a new white paper from Symantec: “Behavioral Risk Indicators of Malicious Insider Theft of Intellectual Property: Misreading the Writing on the Wall.” The analysis work by Shaw and Stock is based on a review of empirical research and identifies several key behaviors and indicators that contribute to intellectual property (IP) theft by malicious insiders.
SECURITY QUIZ: How well do you know the insider threat?
There are key patterns of behavior that can help companies spot — and hopefully prevent — insider theft, according to Stock. “Common problems occur before insider thefts and probably contribute to insider’s motivation. These precipitants of IP theft support the role of personal psychological predispositions, stressful events, and concerning behaviors as indicators of insider risk,” says Stock. Among the triggers outlined in the report are “employees getting tired of thinking about it and deciding to act, or solicitation by others to do so. This move often occurs on the heels of a perceived professional set-back or unmet expectations.”
According to the report, IP theft costs U.S. businesses more than $250 billion per year. FBI reports confirm that insiders are a major target of opponent efforts to steal proprietary data and the leading source of these leaks. Analysis of existing empirical data shows that the majority of IP theft is committed by male employees averaging about 37 years of age who serve in positions including engineers or scientists, managers and programmers. And, about 65% of employees who commit insider theft had already accepted positions with a competing company or started their own company at the time of the theft.
Identifying the potential malicious insider before they walk away with IP, or any asset, can be the difference between a good night’s sleep and living out a nightmare in the boardroom. Companies can implement a variety of measures to stop insider theft of data and IP. Some are as easy as being alert and knowing whether employees have an opportunity to steal data.
LOOKING BACK: 2011’s biggest security snafus
The report features a risk assessment checklist and recommendations for organizations concerned with mitigating the risk of the malicious insider:
• Build a team: To fully address insider theft, organizations need to have a dedicated team made up of HR, security and legal professionals that create policies, drive training and monitor problem employees.
• Organizational issues: Organizations need to evaluate whether they are at greater risk due to inherent factors such as employee morale, competitive risk, adversary operations, local overseas, use of local contractors, etc.
• Pre-employment screening: The information collected during this process will help hiring managers make informed decisions and mitigate the risk of hiring a “problem” employee.
• Policies and practices: This is a checklist of specific policy and practice areas that should be covered within an organization’s basic governance structures.
• Training and education: These are essential to policy effectiveness since policies and practices that are not recognized, understood and adhered to may be of limited effectiveness. For instance, most IP thieves have signed IP agreements. Organizations should have more direct discussions with employees about what data is and is not transferrable upon their departure and the consequences for violating these contracts.
• Continuing evaluation: Without effective monitoring and enforcement, compliance will lapse and insider risk will escalate.
As you might expect given the source of the white paper, it recommends pre-empting IP theft by flagging high-risk insider behavior with a security technology like data loss prevention (DLP). Implementing a data protection policy that monitors inappropriate use of IP and notifies employees of violations will also increase security awareness and deter insider theft. The report also suggests using a file monitoring technology to alert managers, HR and security staff when exiting or terminated employees access and download IP in unusual patterns.
Other forms of technology that may help prevent IP theft include privileged access management, which restricts privileged employees to specific resources on the network and logs all of their activities, and security incident and event managers (SIEM), which can correlate unusual activities and flag them for investigation.
Brian Musthaler is a principal consultant with Essential Solutions Corporation. You can write to him at Bmusthaler@essential-iws.com.
______________________________________________________________
About Essential Solutions Corp:
Essential Solutions researches the practical value of information technology, and how it can make individual workers and entire organizations more productive. Essential Solutions offers consulting services to computer industry and corporate clients to help define and fulfill the potential of IT.
