Laid-off Workers as Data Thieves?
A Symantec/Ponemon report points to an ominous byproduct of the economic crisis: laid-off employees stealing data in acts of vengeance. CSO Senior Editor Bill Brenner is skeptical of this report's news value
CSO —
When the depths of the economic crisis became clear last September, public relations firms started using it as an opportunity to drum up publicity for their security vendor clients. One PR flak even started her e-mail pitch to me with an admission that the IT angle was a stretch.
"This might be a bit of hyperbole, but as companies like AIG and Lehman Brothers look for a bail out, it's not surprising that adoption of open source software is increasing significantly in the wake of today's economic downturn," the pitch read. That's right, the financial crisis means companies are fleeing to the safety of open source software, whether it's for security or other purposes. By the way, the flak wrote, her vendor client would be more than happy to talk to us about this all-important issue.
Fast-forward to late February: Job losses are mounting, the economic outlook is gloomier than ever, and the PR machine is angling for another opportunity to exploit the news.
The latest example is a newly-released report from security vendor Symantec Corp. and the Ponemon Institute suggesting a growing crime wave where laid-off workers exact vengeance on their former employers by walking out the door with sensitive customer data and other proprietary information.
The Ponemon Institute conducted the Web-based survey last month -- polling nearly 1,000 Americans who left an employer within the last year -- and found, according to the press release, that "59 percent of ex-employees admit to stealing confidential company information, such as customer contact lists. The results also show that if respondents' companies had implemented better data loss prevention policies and technologies, many of those instances of data theft could have been prevented."
Translation: If respondents' companies would buy some data loss prevention technology from Symantec, this sort of thing wouldn't happen.
Among the survey findings:
- 53 percent of respondents downloaded information onto a CD or DVD, 42 percent onto a USB drive and 38 percent sent attachments to a personal e-mail account.
- 79 percent of respondents took data without an employer's permission.
- 82 percent of respondents said their employers did not perform an audit or review of paper or electronic documents before the respondent left his/her job.
- 24 percent of respondents had access to their employer's computer system or network after their departure from the company.
"The survey's findings should sound the alarm across all industries: your sensitive data is walking out the door with your employees. Even if layoffs are not imminent, companies need to be more aware of who has access to sensitive business information," Ponemon Institute Founder and Chairman Larry Ponemon said in the press release. "Our research suggests that a great deal of data loss is preventable through the use of clear policies, better communication with employees, and adequate controls on data access." Added Rob Greer, senior director of product management for Data Loss Prevention solutions at Symantec: "Data loss during downsizing is preventable. We can prevent employees from emailing sensitive content to personal Webmail accounts or downloading it onto USB drives. Companies need to implement data loss prevention technologies so they know exactly where sensitive data resides, how it is being used, and prevent it from being copied, downloaded or sent outside the company."
