Banking Law

Last May, we profiled the risk of rogue sociopathic employees who help outsiders steal sensitive data from banks, mortgage lenders, and other businesses. In that story, former employees disclosed passwords that were not changed after the employees left the business. According to a recent study by Cisco, a bank's current  employees pose even more of a security risk.

Employees could be to blame for one of the most prominent security concerns facing businesses today: loss of corporate information.

So say findings from a new Cisco global security study. The report offers insight into the risks employees take that could cause data leakage.

The reason is clear: With the move toward distributed business models and remote workforces, lines are blurring between work and home lives. That???s leading to more collaborative devices and applications, including mobile phones, laptops, Web 2.0 applications, video and other social media.

[...]

Security is ultimately rooted in users??? behavior, so businesses of all sizes and employees in all professions need to understand how behavior affects the risk and reality of data loss ??? and what that ultimately means for both the individual and enterprise, according to John Stewart, chief security officer at Cisco.

"Understanding this can help strengthen relationships between IT and employees, tailor localized awareness and education programs, and better manage risk," Stewart said.

The takeaway: There are opportunities for businesses to tailor risk-management plans that prevent data loss incidents locally while remaining global in scope. While some solutions are technology-based and others are policy-based, the common denominator in these programs is employee education.

"Companies need a strong set of policies and consequences for breaking them," said Michelle Drolet, CEO of IT security services firm Towerwall in Framingham. "The employees need to be clear about the rules for handling information and using technology."

An information security officer for a banking client recently told me that employees remain his biggest concern  with respect to data leaks and information security system breaches. No matter the policies and procedures, the training sessions, the education, and the penalties imposed for violating information security policies, no business has yet found the magic bullet to deal with the "dumb-ass factor" (his term, not mine). I suppose capital punishment might bring the point home, but that seems a bit harsh.

Cisco's study confirm's my client's officer's jaundiced view.

Still, even with awareness programs, employee handbooks and information security training, and appreciation, workers remain a common point of failure in the information security equation.

Employees tend to lose laptops or portable storage, store logins and passwords, share sensitive corporate information or corporate devices, and alter security settings on computers, according to the Cisco study.

[...]

"A lot of our clients are looking into ways to prevent the use of flash drives by locking the ports so they can???t use them and putting some level of protection on laptops to encrypt the data in the hard drive," said Glenn Siriano, a principal of KPMG???s Information Technology Advisory Services. "But you still see people posting sticky notes with their passwords on the desktop."

The sticky notes problem is definitely a prime example of "the dumb-ass factor" at work. Such employees need to put out to pasture. Unless, of course, he oe she is a senior officer, in which case you give him or her a bonus and a promotion.

As compliance officers of banks have long known, unless senior bank management makes the failure to comply with a policy a termination offense, and enforces the penalties consistently, all the well intentioned policies, procedures, education and training in the world aren't going to be enough to stem the tide. In addition, as the article also suggests, banks and other businesses need to invest in the necessary technology-based solutions and/or consulting engagements to minimize the risks. During a time when everyone's uncertain how bad the economy is going to become (just that it's bound to be bad), convincing banks and other businesses to make such investments is going to be a tough sell, absent regulatory sanctions or other painful experiences (hits to reputations, lawsuits, etc.) that make the risks impossible to ignore. As we've previously observed, many businesses have decided that, as things now stand, the risk doesn't justify the expense.