Employee gone rogue is definitely a threat to the integrity of your data, especially those who have a high rank due to their access and privilege, but fingers do not exclusively point to high ranking employees.
What could be the possible risks?
- Data Theft
- Robbery(inside job)
- Online forgery
- Phishing activities
A lot of incidents could root from data theft, why? Data could be processed into different forms of information and utilize it potentially for one’s self-gain. Some fraud-related cases in a financial institution that I personally witnessed are accompanied either by an insider or a former employee. One example was in a call center of a well-known prepaid debit card brand in America were receiving “alleged” test calls to new hires where the caller impersonates a manager or a supervisor. The modus was to impersonate a customer who happens to be in the customer database, and then in the middle of the call the caller will introduce himself as a high ranking official and then tell you stuff that only employees know in order to gain the trust of the call center employee, then comes the part where the criminal will extract as much information as he can from you, this crime which came from data theft is called Vishing a phishing scam done through the phone.
Some employees who have gone rogue with enough research and coding skills could easily forge documents and host phishing sites similar to their company’s website, and then accompany it with a blog hosted via Blogger or WordPress.
The bottom line is no matter how strict policies and sophisticated a system is protecting your data, it is still not enough. Don’t get me wrong, it really is a correct step to prevent the data breach from happening especially it is most effective against outsiders. Some things are bound to happen but mitigation does not have to stop there. A post-incident plan should always be ready to protect data and save a company’s reputation.
What can we do?
Since we are talking about data first of all always keep a backup of your data, it is wise to have a backup that is disconnected from the network to avoid certain risks. Now let us list down what we could do in case prevention fails,
- Educate employees and keep them reminded that they are bounded by the terms and conditions regarding their cyber activities to raise awareness. Some people need to be constantly reminded.
- Have a team who internally or externally do the brand monitoring for the purpose of going after contents and users who spreads data and intellectual property sensitive information within the first few hours.
- For financial institutions offering alerts on compromised credit cards of their users: stay on your toes by monitoring the surface internet and the dark web because some phished data might be sold to the black market in exchange for profit.
The common misconception regarding cybercrime in layman’s perception is individuals and small businesses are targeted often, and big corporations are not heavily victimized due to the perception that they can afford reliable and powerful security systems.
Think twice before rationalizing the thought above. Big corporations may have the most sophisticated systems and anti-malware solutions employed at their disposal, but is that enough? Most people think it is foolproof, I once thought so too, however when it comes to danger anything is possible but it can be mitigated.
To mitigate cybercrime we must at least know the possibilities and the sources of such future incidents. Here is one major source; an insider or it could also be an ex-employee. It makes sense why? Keep your friends close but keep your targets closer this is how criminals put it.
