Preventing Data Leakage Through Email and Instant Messaging

From: The Essentials Series: IT Compliance - Volume II

By: Rebecca Herold

Incidents Occur Easily and Often

Incidents continue to accumulate and hit the daily headlines. Many of them involve the loss of sensitive information through some type of messaging activity. The losses can have devastating impacts to business.

A large financial organization I once did work for was going through downsizing. They notified their systems administrators 2 weeks in advance of their impending layoff, but allowed them to continue performing their job responsibilities as usual until their last day. Indeed this was not a good idea; 2 weeks following the last day, one of the terminated administrators accessed the internal Web site remotely using the admin ID he was once responsible for, changed the passwords for all the remaining admin IDs, then sent messages to all the other email accounts with a very explicit rant about how horrible the company’s security was in addition to posting copies of all email messages on the email server to multiple Internet sites. Although this incident happened several years ago, copies of the email messages still continue to pop up on miscellaneous sites from time to time, much to the embarrassment of the organization, which estimated significant lost customers and associated revenues as a result.