Vulnerabilities / Threats

12/23/2015
11:30 AM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Survey: When Leaving Company, Most Insiders Take Data They Created

Most employees believe they own their work, and take strategy documents or intellectual property with them as they head out the door.

Employees feel a sense of ownership over the data and documents they create on the job -- so much so, that 87 percent of them take data they created with them when they leave the company, according to a new survey.

Secure communications company Biscom surveyed individuals who previously left a full-time job -- voluntarily or otherwise. While only 28 percent of respondents stated they took data they had not created when they departed, the vast majority walked off with copies of their own work.

"I think the biggest driver was that sense of ownership," says Biscom CEO Bill Ho. Of those who took data they created, 59 percent said they did so because they felt the data was theirs. Seventy-seven percent said they thought the information would be useful in their new job.

The good news is that none of the respondents said they did it to harm the organization. (Although 14 percent admitted that they'd be more likely to nab data on the way out if they were leaving under "negative circumstances.")

"There may be a concept in their mind that it's not malicious because they're not trying to harm anyone," says Ho, "but I think deep down they know it's wrong."

The other good news is that none of the respondents stated they took data protected by privacy regulations. Yet 88 percent of respondents took company strategy documents and/or presentations, 31 percent took customer contact lists, and 25 percent took intellectual property (IP).

"IP is a really, really big problem," says Ho. "It's [a company's] differentiator. It's what gives them their competitive edge."

The vast majority of respondents, a whopping 94 percent, said that weren't aware of any protections their organization had in place to prevent employees from removing data and documents. Only 3 percent admitted that they knew of these protections and ignored them. Another 3 percent said they knew of them, and couldn't get around them.

Biscom researchers say that it's doubtful 94 percent of the organizations had no policies or procedures in place to prevent insider data leaks/theft. The trouble, therefore, was that companies were doing a poor job of educating employees on the existence of these policies, procedures, and security technologies.

"If there were tools and technologies in place," says Ho, "it wasn't stopping them."

The most common method respondents used to take data was moving it to a Flash or external drive (84%). Other tactics were emailing it to their personal accounts (47%), printing hard copies (37%), loading it onto a shared drive (21%), or saving it to a sync and share service like Dropbox (11%).

Although some respondents said they were more likely to abscond with data if they left the company under negative circumstances -- like being fired or laid off -- security teams are better equipped to handle those situations. They know the bad news before the employee does, and can protect the company by quickly revoking access privileges and having people escorted out of the building. However, the employees who quit are a step ahead of the security team, and can begin the process of exfiltrating data long before they give their two weeks notice.

So how to dissuade that type of behavior? One, which may seem counterintuitive, is to provide users with better, easier, more secure file-sharing tools that the organization can monitor, Ho says. 

"If the employees don't have the tools to share, they're going to use what they can," he says. Technologies like DropBox and Google Drive are free and easy to obtain. "Companies should probably serve their own employee" better.

Ho also recommends technologies to monitor user behavior -- like behavioral analytics and data exfiltration monitoring -- and regular security awareness programs that inform users about the company's policies about data removal and the tools they use to enforce them.  

"The people who are really determined, they'll probably find a way," he says. "It's the people who are on the edge ... who you can potentially change their behavior."

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Page 1 / 2   >   >>
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
12/29/2015 | 9:55:55 AM
Re: Confidentiality Agreement Documentation
@Joe. Silicon Valley S2....just kidding. This makes sense. The argument could be made that utilizing company resources during creation were pivotal to the point that the product could not have been created otherwise.
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
12/29/2015 | 9:53:23 AM
Re: DropBox and Google Drive are free and easy to obtain.
@Dr.T, (personal email at work). That's fine but it should still be monitored for sensitive data. DLP can monitor not only SMTP but webmail as well.
Dr.T
100%
0%
Dr.T,
User Rank: Ninja
12/28/2015 | 2:37:56 PM
Re: Confidentiality Agreement Documentation
I agree but I do not know if data created by an employee would be owned by that employee. If that was the case the company would not have owned any data, it would be all employees' data, which is not the case as we know it.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
12/28/2015 | 2:35:12 PM
Re: For decades
Agree. We would need to trust and respect the employees and expect that is mutual. If employees want to share data with third parties, there is no policy or system that can prevent from that. One can easily memorize the information needed before leaving the company.
Dr.T
100%
0%
Dr.T,
User Rank: Ninja
12/28/2015 | 2:32:15 PM
Re: Confidentiality Agreement Documentation
Agree, acceptable use policy is already covering basic information that company's customers' data could not be shared with third parties.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
12/28/2015 | 2:30:24 PM
Re: DropBox and Google Drive are free and easy to obtain.
It can be blocked but you need tools and services for that. Some companies do not want to restrict employees' options to use personal email at work, that that creates a risk of losing data without knowing it of course.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
12/28/2015 | 2:24:25 PM
Re: Confidentiality Agreement Documentation
That is something certainly interesting to know. The norm is that you do not take company's customer list and share with somebody else. 
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
12/28/2015 | 2:22:12 PM
Data or insights?
I would doubt that anybody individually would own the data in an organization, it will be like customers' data being taken and released to other companies no customers would like that. If it is insights gained from data then I would think the person who created the insights would own it and he/she can take it, if it is not directly related with the customers I would say.
theb0x
100%
0%
theb0x,
User Rank: Ninja
12/28/2015 | 10:32:23 AM
Re: Confidentiality Agreement Documentation
True, an Acceptable Use Policy will not stop an employee's actions whether they be intentional or unintentional. However, this can and will be grounds for immediate termination of employment if enforced appropriately.

I am referencing to electronic data created/stored that pertains to one's job function in best interest of the Company. And if it wasn't something an employee created that does not give them the right exfiltrate data on the Company's equipment or network after being discharged and then escorted off the premises. If an employee is being terminated all accounts are to be frozen and their electronic equipment should be physically seized immediately. Clearly you do not have application white listing in place if you and or your employees are installing AOL Instant Messenger. Although it is not supported anymore the TOC and TOC2 protocol was open source by AOL.
Joe Stanganelli
0%
100%
Joe Stanganelli,
User Rank: Ninja
12/27/2015 | 2:11:31 PM
Re: Confidentiality Agreement Documentation
Acceptable Use Policies and the like will inform, but in general simply storing something on a company server will not make it the company's property. (Otherwise, AOL Instant Messenger would have become open source 12 years ago!) *Creating* it with company equipment while at work, however, can be a different story.
Page 1 / 2   >   >>
Printers: The Weak Link in Enterprise Security
Kelly Sheridan, Associate Editor, Dark Reading,  10/16/2017
20 Questions to Ask Yourself before Giving a Security Conference Talk
Joshua Goldfarb, Co-founder & Chief Product Officer, IDDRA,  10/16/2017
Why Security Leaders Can't Afford to Be Just 'Left-Brained'
Bill Bradley, SVP, Cyber Engineering and Technical Services, CenturyLink,  10/17/2017
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Security Vulnerabilities: The Next Wave
Just when you thought it was safe, researchers have unveiled a new round of IT security flaws. Is your enterprise ready?
Flash Poll
The State of Ransomware
The State of Ransomware
Ransomware has become one of the most prevalent new cybersecurity threats faced by today's enterprises. This new report from Dark Reading includes feedback from IT and IT security professionals about their organization's ransomware experiences, defense plans, and malware challenges. Find out what they had to say!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.