By Dan Verton

The insider threat today is not just about the security of your enterprise’s data. It’s also about knowing that your organization has developed the right policies and procedures to prevent inadvertent disclosures or blatant misuse of corporate computer resources from becoming a hole filled with legal quicksand.

Today’s regulatory environment is such that the stars are perfectly aligned for an example to be made of somebody—a company or government agency. And whoever the unfortunate soul is who sits atop the corporate chain of command at that time, he or she will wish they had taken the time to answer the following ten questions and implement the appropriate changes in their organization.

Question 1. What types of information must be protected by internal controls according to Sarbanes-Oxley?

Answer: Unauthorized disclosure of nonpublic data is a violation of federal securities laws. Information should be considered nonpublic if it isn’t widely disseminated to the general public, including electronic information. This information should be protected, but it should also be monitored to ensure it isn’t disclosed inappropriately.

Section 404 describes management’s responsibility for building internal controls around the safeguarding of assets related to the timely detection of unauthorized acquisition, use or disposition of an entity’s assets that could have a material effect on the financial statements. You need to demonstrate that you have the capabilities to monitor, detect and record electronic information disclosures.

Question 2. Since so much nonpublic information is communicated beyond e-mail based on the Simple Mail Transfer Protocol, how can we build internal controls to adequately detect the timely disclosure of information flowing over Web mail, chat or HTTP?

Answer: Management can’t ensure the truthfulness or accuracy of financial data if it doesn’t have the means to monitor the movement of sensitive information across the entire corporate network 24 hours a day, seven days a week.

Demand more from technology. New products are available that can monitor electronic disclosure of nonpublic information and aren’t limited to SMTP-based e-mail. These technologies can monitor, record and provide alerts on electronic disclosures by analyzing all information flowing over the corporate network from Web mail and chat to file transfer protocol and HTTP. This type of monitoring technology combined with a storage system that allows forensic searches into stored information can prove invaluable if an investigation is required.

Question 3. What are the penalties for exposing nonpublic information?

Answer: The use of nonpublic information concerning a company or any of its affiliates (a.k.a. "inside information") in securities transactions ("insider trading"), may violate federal securities laws. Penalties can include: