Here is another example of an actual insider threat...how an employee with access to customer funds used this access to commit fraud...

"The Bangalore police have arrested one 24-year old Nadeem Kashmiri, on charges of having leaked confidential customer data from a BPO of HSBC, resulting in a loss of almost 233,000 pounds (Rs 1.95 crores) to the bank's UK-based account holders.

HSBC says it takes its data protection responsibilities very seriously, and that hence it has initiated legal action against Kashmiri, who until earlier this month was an employee at HSBC's Bangalore global service center.

Kashmiri was an employee of HSBC Electronic Data Processing India (HDPI), an offshore unit of the multinational bank. The bank approached the police on June 22, once it was convinced about his involvement. The police had been on the lookout for him since then.

Meanwhile, Kashmiri is accused of passing-on confidential information pertaining to certain HSBC customers in the UK that was used to access the bank accounts of the victims through telephone banking services. Impersonating genuine account holders, the fraudsters extracted funds out of these accounts. They also carried out fraudulent transactions through the ATM and debit cards of the victims. It is reported that a gang of scamsters in the UK had paid Kashmiri for carrying out this fraud.

The fraud was uncovered by HSBC's own security teams, when some customers complained to the bank about discrepancies in their accounts, ultimately leading to Nadeem Kashmiri's suspension in April pending HSBC's investigations.

HSBC, convinced that Nadeem Kashmiri had perpetrated the fraud, terminated his employment, and reported the crime to the Bangalore police. HSBC is assisting the Indian police in their investigations, and the bank intends to pursue Kashmiri's conviction as vigorously as possible.

The Bangalore police will be in touch with their UK counterparts to solve the case; and HSBC is in touch with affected customers who have been assured of full re-imbursement of losses."

Points out the need for good information security controls along with audit logs and the ability to monitor access to sensitive data.  There will always be personnel who will do bad things if they have the opportunity.  However, effective detective controls along with preventive controls will help to address the insider threat.

A good case study for an information security awareness or training exercise.

Technorati Tags
information security
IT compliance
corporate governance
awareness and training
cybercrime
insider threat
bank fraud
privacy