Information stolen electronically by rogue ex-employees can be detected and used in prosecutions if companies take adequate steps to lock down computers and mobile devices involved, according to a forensics investigator. Speaking at Security 2012 in Sydney, Klein Co director, Nick Klein, told delegates that a number of companies who have contacted him after suffering a data loss did not have a data recovery plan in place. Security threats explained: Internal excessive privilege “We ask them what happened to the computer that was used to steal information and find out they redistributed it to another staff member two months ago,” he said. “Then we ask them what happened to the mobile phone and they say it was replaced.” In addition, companies had not saved backup data which could point investigators to clues as to what data the culprit had stolen. According to Klein, the most important step companies should take is to develop a data breach plan. “Think about where your confidential data is, how someone is going to steal it and if they did it, how would you detect and investigate it?” he said. Klein added that if IT executives knew where their data was they could start putting controls in place such as logging and monitoring. In addition, executives should consider installing improved access control systems or data loss prevention offerings to detect when someone’s attempting to access information. “We have had clients call us up six months later and say it’s happened again,” he said. “But this time they have put the computer in storage and seized the mobile phone.” During an investigation, forensic investigators build a chronology of what happened in the computer including email data and time stamps within Word documents. “Quite often we find evidence that people have plugged a USB key into their computer and browsed network folders for information that they shouldn’t be accessing,” Klein said. If the evidence is enough to build a case which proceeds to legal proceedings, he said companies should brief lawyers who have an understanding of ICT evidence. “If it does go to court make sure your barrister can show what the evidence proves because at the end of the day they’re the ones who have to present and argue the case in court,” he said. Follow Hamish Barwick on Twitter: @HamishBarwick Follow CIO Australia on Twitter and Like us on Facebook… Twitter: @CIO_Australia, Facebook: CIO Australia, or take part in the CIO conversation on LinkedIn: CIO Australia Related content feature 4 remedies to avoid cloud app migration headaches The compelling benefits of using proprietary cloud-native services come at a price: vendor lock-in. Here are ways CIOs can effectively plan without getting stuck. By Robert Mitchell Nov 29, 2023 9 mins CIO Managed Service Providers Managed IT Services case study Steps Gerresheimer takes to transform its IT CIO Zafer Nalbant explains what the medical packaging manufacturer does to modernize its IT through AI, automation, and hybrid cloud. By Jens Dose Nov 29, 2023 6 mins CIO SAP ServiceNow feature Per Scholas redefines IT hiring by diversifying the IT talent pipeline What started as a technology reclamation nonprofit has since transformed into a robust, tuition-free training program that seeks to redefine how companies fill tech skills gaps with rising talent. By Sarah K. White Nov 29, 2023 11 mins Diversity and Inclusion Hiring news Saudi Arabia will host the World Expo 2030 in Riyadh By Andrea Benito Nov 28, 2023 4 mins Podcasts Videos Resources Events SUBSCRIBE TO OUR NEWSLETTER From our editors straight to your inbox Get started by entering your email address below. Please enter a valid email address Subscribe