| S | M | T | W | T | F | S |
|---|---|---|---|---|---|---|
| « Feb | ||||||
| 1 | 2 | 3 | 4 | 5 | 6 | |
| 7 | 8 | 9 | 10 | 11 | 12 | 13 |
| 14 | 15 | 16 | 17 | 18 | 19 | 20 |
| 21 | 22 | 23 | 24 | 25 | 26 | 27 |
| 28 | 29 | 30 | 31 | |||
- February 7, 2007: New Techniques for Guarding Financial Data
- February 6, 2007: Increased Scrutiny From Card Associations in 2007
- January 28, 2007: The State of PCI Compliance 2007
- January 23, 2007: Background Checks on IT Personnel
- January 5, 2007: 100 Million Notifications of Data Breaches in US
- December 17, 2006: Inside Jobs: The Risk of Data Breach From Insider Threats
- December 12, 2006: Card Associations Step Up PCI Enforcement
- December 1, 2006: CompTIA Survey Emphasizes Importance of Security Training
- December 1, 2006: CompTIA Survey Emphasizes Importance of Security Training
- November 16, 2006: Average data breach costs $5 million
Credit Card Companies
FAQ
Helpful Sites
Inside Jobs: The Risk of Data Breach From Insider Threats
An excellent article appeared in the December 11, 2006, edition of Information Week entitled Insider Threats. The article starts with a description of the now infamous attack by an employee against UBS Paine Webber. What is surprising is the fact that UBS did not conduct a background check before he was hired nor before granting him the highest level of access to its computer systems. In this case, a background check would have revealed a criminal record. By the way, background checks to attain and maintain PCI compliance.
The article provides some interesting suggestions for reducing risks. One seemingly obvious one is to revoke a terminated employee’s access privileges BEFORE the termination. However, Dawn Cappelli, a senior member at the CERT Coordination Center at Carnegie Mellon, stated that about half of all insider attacks occur after an IT employee is dismissed but before his/her access privileges are revoked.
Another tip for IT managers is to watch for warning signs in the behavior of their employees, such as “insubordination, anger over perceived mistreatment, or resistance to sharing responsibility or training colleagues.”
The article also suggests informing IT employees that their system access will be monitored and their system changes will be tracked. Another IT policy should be to grant each IT employee just enough privileges to get his/her job done. “Usually, a person who does damage was given more access than they needed,” according to Bill Moylan, senior director of Aon Consulting’s IT risk group.
Good article — great tips — well worth reading.