80% of IT Workers Would Steal Data if Fired

[Ehtyar]

Nearly 9/10 IT workers  of the 3000 interviewed said they would steal sensitive data if their employment was terminated.

A study conducted by security company Cyber-Ark indicates that a significant number of corporate IT personnel snoop sensitive data, and nearly 9 out of 10 would take company secrets and remote access credentials with them if they were fired. This could pose a serious security risk for many companies and expose them to industrial espionage and other dangers.

The results of the Trust, Security and Passwords study are based on a survey of 300 system administrators at the Infosecurity 2008 event in Europe. Of the study respondents, 88 percent admitted they would take sensitive data with them when leaving their current place of employment, and approximately one-third said that they would abscond with company password lists. That could be a serious cause for concern for companies that have complex and loosely secured technological infrastructure.

Full Story

Ehtyar.

[40hz]

88 percent admitted they would

They're not admitting - they're threatening! 

You can't 'admit' to doing something you haven't done. 

Talk about a self-serving slant in the way the "findings" were presented.

From the article:

While it's worth noting that most studies published by commercial vendors are ultimately intended to drive sales of their products, the Cyber-Ark study highlights an important issue that CTOs and IT managers should think about when cutting IT staff loose.

So the gist of the survey was that if you hit somebody they'll try to hit you back? Well who could have ever guessed that would happen.

[Ehtyar]

Your interpretation is equally slanted. Your analogy implies that the stealing of data is equal to the termination of employment. How exactly is the story self-serving? Will someone use this article as an excuse to fire all their employees?

Ehtyar.

[Renegade]

There is a vaccuum for a few products to help manage these kinds of things at the moment. But security is often low on the priority scale, so creating it doesn't mean it would succeed. Only a large company like CA with an established large customer base could manage to make a product to manage passwords effectively into a success.

When I left my last position, the only things I took were some music files I had only on my computer there and a couple files of mine. No passwords or anything. I made password lists and gave them to the person that stepped in though as they would need them.

[Josh]

If I were fired from DC, I would take with me all of mouser's credits and his broken air conditioner in hopes of salvaging it. Oh wait, I have been terminated! Mouser, your A/C is mine!

[Ehtyar]

Be sure you take MouserBot with you joshua; you never know which is more useless, a broken A/C or a broken eggie

Ehtyar.

[Josh]

heh, MouserBot is run by a disgruntled IT worker of mouser's. That is why it never works!

[40hz]

Your analogy implies that the stealing of data is equal to the termination of employment.

I'm not sure I was making an analogy, nor how you arrived at that. My comment was that people tend to to respond in kind to the treatment they perceive they have received. This perception doesn't have to be based on reality. It just has to be what's real for them: "If I think you're going to hurt me, then I am justified in planning to hurt you back." Is this news to anybody?

Re firings: Disgruntled employees are a far bigger threat to a company than a terminated one. It's never the people you get rid of that cause the biggest headaches. It's the ones that are angry but stick around that do the worst damage. Take a look at former FBI agent Robert Hansen.

The "slant" and "self-serving" I was referring to lies in the choice of wording - saying "admitted to" rather "planned on" or "threatened to." By saying 'admitted,' it implies something has already happened, which in turn ups the sense of risk.

The point I was trying to make is that any dissatisfied employee has the potential to hurt a business.  But increased security measures and risk awareness do not get to the root causes of the problem. Nor will they solve it.

Interestingly, bad customer service is usually the biggest single source of financial loss to a company. A company doesn't just lose sales revenue when a customer walks away. It also loses the sunk costs in acquiring and its expenditures for marketing to that customer. And even more seriously, its reputation in the marketplace takes a hit.

Will someone use this article as an excuse to fire all their employees?

Well, if you fired all your employees you wouldn't really have a company anymore, so I'm not sure anybody could seriously consider doing that. (Of course if they did it would definitely reduce the security risks...oh wait...they fired the security guards too!)

[Ehtyar]

I'm still not certain how this article is self-serving. The question you replied to was rhetorical, intended to highlight the ridiculousness of such a claim, though you seem to have caught on to that part...

Ehtyar.

[40hz]

I'm still not certain how this article is self-serving. The question you replied to was rhetorical, intended to highlight the ridiculousness of such a claim, though you seem to have caught on to that part...

Ehtyar.

Just trying to lighten things up a bit.

[Ehtyar]

Some more interesting questions.

Ehtyar.