Insiders: Security Risk No. 1
Banks Are Failing at Setting Internal Risk Controls
Organizations, financial institutions included, get too comfortable, and they forget about checks and balances. No one wants to think a member of the team could steal from the company, or worse, from a customer or client. But it happens, as the teenaged McDonald's employee so quickly proved.
See Also: Live Webinar | Software Security: Prescriptive vs. Descriptive
Let's also not forget that internal fraud can be unintentional. Sometimes, employees just make mistakes.
Employee education is paramount. Most employees want to do the right thing; they just need to be told how.
The Social Security number breach at Wells Fargo comes to mind. The privacy breach has spurred attention from the Connecticut attorney general, who's asked Wells executives to explain why the bank released Social Security numbers in copies of subpoenas it mailed to state officials and customers named in the subpoenas. [See Wells Questioned About Privacy Breach.]
Wells has been very apologetic. But the damage is done.
So what steps could Wells and McDonald's have taken to avoid the internal hiccups that resulted in massive customer privacy breaches? An employer can't monitor the actions of every staff member 24/7. But basic policies and procedures that clearly define what is acceptable could have made a big difference.
Internal policies about security and the need for corporate and client or customer privacy are critical. Employees often don't understand or appreciate how and when a customer's identity can be compromised, or a corporation's internal systems can be breached. Employee education is paramount. Most employees want to do the right thing; they just need to be told how.
Clearly written policies and procedures set expectations, and establish a culture of high standards. It takes more than technology. Organizations need employees monitoring each other. Well thought-out policies ensure staff members feel comfortable blowing the whistle when they see another employee bucking the rules.
With a little forward thinking, most of the internal breaches from which businesses suffer today could be thwarted, or at least severely diverted before massive financial and reputational casualties result.
