Data breaches are a possible threat to any business, no matter how big or small and no matter what type of industry. In fact, since the Identity Theft Resource Center started tracking data breaches in 2005, almost every year has seen a record number of breaches and hacking events in everything from major retailers to mom-and-pop businesses.
One of the major contributing factors in a significant number of data breaches is employee culpability, or the fact that sometimes it’s the company’s own workers who are directly or indirectly responsible for the breach.
When an employee is indirectly responsible for the loss of sensitive data, it’s clearly referred to as an accidental breach. These accidental events happen in several different ways, though. The more innocuous accidental breach can be a simple matter of bad planning, such as having a company laptop wind up lost, especially if it wasn’t password protected and its data wasn’t encrypted. The end result is still devastating for the company, but there was no malicious intent.
Another form of accidental breach that’s been making headlines lately happens when an employee thinks he’s doing his job, but in reality he’s doing the work of scammers or hackers. The so-called “boss phishing attack” is a prime example, and it happens when scammers pose as someone higher up in the company—usually through email—and essentially trick an employee into turning over sensitive data. Again, there was no malicious intent on the part of the poor employee, but the end result is still a data breach.
But what about when the employee’s actions are far from honorable? Morgan Stanley suffered one such data breach in 2015 when an employee stole the complete account profiles for around 900 of the investment firm’s wealthiest clients, then uploaded that information to an internet site. During the criminal proceedings in the case, the prosecutors alleged that the employee was leaving the company and wanted to take his top-tier clients with him, but the defense claimed hackers nabbed the data from his computer.
Fortunately, there’s a new high-tech tool that lets companies build a safety net around their data while still preserving some respect for employee privacy. A number of software developers have created programs that will monitor a business’ network for signs of suspicious activity, then report that suspicious activity to executives before an employee can accidentally or intentionally compromise company data.
The monitoring software searches the network for noticeable changes in employees’ computer behavior. Just like software that tells you if anyone in your workforce is hanging out on Facebook during work hours or downloading unsavory videos, this software specifically looks at changes in employees’ computer habits and emails. A sudden increase in the number of emails might mean that an employee is communicating with someone about company information, and a drastic change in late night emailing might mean he’s doing it when no one else is around to look over his shoulder. Even certain trigger words in emails could raise an alert, indicating an intentional attempt to steal information or a phishing attack that’s about to occur.
Privacy experts have likened this type of network monitoring software to typical forms of employee oversight, and said that so long as employees know their computer activity is being watched and tracked, there’s really no problem. The only problem some industry watchers have had with this type of software is when it alerts an employer that someone within the company might be looking for another job based on seemingly unrelated computer activity, which is one of the features that some software titles offer.
Anyone can be a victim of identity theft, anyone can use our services, and anyone can help us help others. If you found this information useful, please consider donating to the Identity Theft Resource Center to help us keep our services free to the public.