Vulnerabilities / Threats
12/23/2015
11:30 AM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Survey: When Leaving Company, Most Insiders Take Data They Created

Most employees believe they own their work, and take strategy documents or intellectual property with them as they head out the door.

Employees feel a sense of ownership over the data and documents they create on the job -- so much so, that 87 percent of them take data they created with them when they leave the company, according to a new survey.

Secure communications company Biscom surveyed individuals who previously left a full-time job -- voluntarily or otherwise. While only 28 percent of respondents stated they took data they had not created when they departed, the vast majority walked off with copies of their own work.

"I think the biggest driver was that sense of ownership," says Biscom CEO Bill Ho. Of those who took data they created, 59 percent said they did so because they felt the data was theirs. Seventy-seven percent said they thought the information would be useful in their new job.

The good news is that none of the respondents said they did it to harm the organization. (Although 14 percent admitted that they'd be more likely to nab data on the way out if they were leaving under "negative circumstances.")

"There may be a concept in their mind that it's not malicious because they're not trying to harm anyone," says Ho, "but I think deep down they know it's wrong."

The other good news is that none of the respondents stated they took data protected by privacy regulations. Yet 88 percent of respondents took company strategy documents and/or presentations, 31 percent took customer contact lists, and 25 percent took intellectual property (IP).

"IP is a really, really big problem," says Ho. "It's [a company's] differentiator. It's what gives them their competitive edge."

The vast majority of respondents, a whopping 94 percent, said that weren't aware of any protections their organization had in place to prevent employees from removing data and documents. Only 3 percent admitted that they knew of these protections and ignored them. Another 3 percent said they knew of them, and couldn't get around them.

Biscom researchers say that it's doubtful 94 percent of the organizations had no policies or procedures in place to prevent insider data leaks/theft. The trouble, therefore, was that companies were doing a poor job of educating employees on the existence of these policies, procedures, and security technologies.

"If there were tools and technologies in place," says Ho, "it wasn't stopping them."

The most common method respondents used to take data was moving it to a Flash or external drive (84%). Other tactics were emailing it to their personal accounts (47%), printing hard copies (37%), loading it onto a shared drive (21%), or saving it to a sync and share service like Dropbox (11%).

Although some respondents said they were more likely to abscond with data if they left the company under negative circumstances -- like being fired or laid off -- security teams are better equipped to handle those situations. They know the bad news before the employee does, and can protect the company by quickly revoking access privileges and having people escorted out of the building. However, the employees who quit are a step ahead of the security team, and can begin the process of exfiltrating data long before they give their two weeks notice.

So how to dissuade that type of behavior? One, which may seem counterintuitive, is to provide users with better, easier, more secure file-sharing tools that the organization can monitor, Ho says. 

"If the employees don't have the tools to share, they're going to use what they can," he says. Technologies like DropBox and Google Drive are free and easy to obtain. "Companies should probably serve their own employee" better.

Ho also recommends technologies to monitor user behavior -- like behavioral analytics and data exfiltration monitoring -- and regular security awareness programs that inform users about the company's policies about data removal and the tools they use to enforce them.  

"The people who are really determined, they'll probably find a way," he says. "It's the people who are on the edge ... who you can potentially change their behavior."

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Page 1 / 2   >   >>
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
12/29/2015 | 9:55:55 AM
Re: Confidentiality Agreement Documentation
@Joe. Silicon Valley S2....just kidding. This makes sense. The argument could be made that utilizing company resources during creation were pivotal to the point that the product could not have been created otherwise.
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
12/29/2015 | 9:53:23 AM
Re: DropBox and Google Drive are free and easy to obtain.
@Dr.T, (personal email at work). That's fine but it should still be monitored for sensitive data. DLP can monitor not only SMTP but webmail as well.
Dr.T
100%
0%
Dr.T,
User Rank: Ninja
12/28/2015 | 2:37:56 PM
Re: Confidentiality Agreement Documentation
I agree but I do not know if data created by an employee would be owned by that employee. If that was the case the company would not have owned any data, it would be all employees' data, which is not the case as we know it.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
12/28/2015 | 2:35:12 PM
Re: For decades
Agree. We would need to trust and respect the employees and expect that is mutual. If employees want to share data with third parties, there is no policy or system that can prevent from that. One can easily memorize the information needed before leaving the company.
Dr.T
100%
0%
Dr.T,
User Rank: Ninja
12/28/2015 | 2:32:15 PM
Re: Confidentiality Agreement Documentation
Agree, acceptable use policy is already covering basic information that company's customers' data could not be shared with third parties.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
12/28/2015 | 2:30:24 PM
Re: DropBox and Google Drive are free and easy to obtain.
It can be blocked but you need tools and services for that. Some companies do not want to restrict employees' options to use personal email at work, that that creates a risk of losing data without knowing it of course.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
12/28/2015 | 2:24:25 PM
Re: Confidentiality Agreement Documentation
That is something certainly interesting to know. The norm is that you do not take company's customer list and share with somebody else. 
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
12/28/2015 | 2:22:12 PM
Data or insights?
I would doubt that anybody individually would own the data in an organization, it will be like customers' data being taken and released to other companies no customers would like that. If it is insights gained from data then I would think the person who created the insights would own it and he/she can take it, if it is not directly related with the customers I would say.
theb0x
100%
0%
theb0x,
User Rank: Ninja
12/28/2015 | 10:32:23 AM
Re: Confidentiality Agreement Documentation
True, an Acceptable Use Policy will not stop an employee's actions whether they be intentional or unintentional. However, this can and will be grounds for immediate termination of employment if enforced appropriately.

I am referencing to electronic data created/stored that pertains to one's job function in best interest of the Company. And if it wasn't something an employee created that does not give them the right exfiltrate data on the Company's equipment or network after being discharged and then escorted off the premises. If an employee is being terminated all accounts are to be frozen and their electronic equipment should be physically seized immediately. Clearly you do not have application white listing in place if you and or your employees are installing AOL Instant Messenger. Although it is not supported anymore the TOC and TOC2 protocol was open source by AOL.
Joe Stanganelli
0%
100%
Joe Stanganelli,
User Rank: Ninja
12/27/2015 | 2:11:31 PM
Re: Confidentiality Agreement Documentation
Acceptable Use Policies and the like will inform, but in general simply storing something on a company server will not make it the company's property. (Otherwise, AOL Instant Messenger would have become open source 12 years ago!) *Creating* it with company equipment while at work, however, can be a different story.
Page 1 / 2   >   >>
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
The Changing Face of Identity Management
Mobility and cloud services are altering the concept of user identity. Here are some ways to keep up.
Flash Poll
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7445
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

CVE-2015-4948
Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

CVE-2015-5660
Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

CVE-2015-6003
Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

CVE-2015-6333
Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio
Archived Dark Reading Radio

The cybersecurity profession struggles to retain women (figures range from 10 to 20 percent). It's particularly worrisome for an industry with a rapidly growing number of vacant positions.

So why does the shortage of women continue to be worse in security than in other IT sectors? How can men in infosec be better allies for women; and how can women be better allies for one another? What is the industry doing to fix the problem -- what's working, and what isn't?

Is this really a problem at all? Are the low numbers simply an indication that women do not want to be in cybersecurity, and is it possible that more women will never want to be in cybersecurity? How many women would we need to see in the industry to declare success?

Join Dark Reading senior editor Sara Peters and guests Angela Knox of Cloudmark, Barrett Sellers of Arbor Networks, Regina Wallace-Jones of Facebook, Steve Christey Coley of MITRE, and Chris Roosenraad of M3AAWG on Wednesday, July 13 at 1 p.m. Eastern Time to discuss all this and more.