Wayne Sumida brought this story to my attention...thanks Wayne!

The Honolulu Advertiser reported on Saturday a case of a trusted FBI employee leaking sensitive information to drug traffickers.  This is a good example of the need for organizations to implement practices to help ensure trusted insiders can still be trusted.  In this case a secretary with the FBI had authorized access to the same information to which the FBI agents had access.  She  apparently subsequently gave this confidential information to her husband, who then passed it on to members of a drug ring.

This illustrates one of the many ways in which trusted insiders can present huge risks to confidential and sensitive information, and supports the findings of the annual CERT/Secret Service insider threat results. 

When you have trusted insiders with access to sensitive information, seriously consider doing the following, in addition to your other precautions, to help address the accompanying risks:

• Give individuals access to only the information they need to perform their job responsibilities.
• Establish formal grievance procedures and additional forums for employees to voice concerns about work practices; dissatisfied employees are the most likely to compromise security. 
• Train management, and really all personnel, how to identify red flags associated with personnel who experience negative work-related events.
• Provide ongoing awareness messages to personnel about the need to protect the sensitive information to which they have access, and remind them of the possible sanctions for information leaks.
• Provide ongoing targeted training and awareness for personnel with access to sensitive information.
• Perform regular background, criminal and credit checks on personnel with access to particularly sensitive information.
• Implement access logs to keep track of the individuals accessing sensitive information, and when they are accessing it. 

Of course, some people with trusted access will do bad things regardless.  However, being vigilent in your information security and awareness efforts will help to reduce the likelihood of such incidents.

Technorati Tags
information security
drug traffickers
FBI
insider threat
computer crime