The Boston Herald has details on a bank executive who resigned and then left with thousands of documents belonging to his former employer, Boston Private Bank & Trust Co.
In a suit filed in U.S. District Court on Monday, Boston Private Bank & Trust accuses former lending executive Todd Rassiger of stealing proprietary information that benefits his new employer, First Republic Bank.
The 24-page lawsuit alleges that before his resignation from Boston Private Bank & Trust Co., Rassiger attached personal USB flash drives to his bank-issued computer and downloaded more than 1,500 documents, many of which included highly confidential and proprietary information.
These days, companies need to be concerned with both external cyberattacks as well as the threat posed by insiders who have access to sensitive data. Our recent post highlights the need for endpoint security, which can block personal flash drives and keep an audit log of which files are downloaded.
We also highly recommend remote management capabilities for all portable devices like smartphones and storage devices. Kanguru’s Remote Management Console can be used to instantly revoke device access from employees who are leaving the organization. Their company-issued USB drive will be remotely disabled or deleted the next time it’s plugged in.
Much has made recently of the “insider threat” and how it can affect an organization’s data security. But which is really a bigger threat to your organization? A hacker or a disgruntled employee with access to the company’s confidential data?
The answer might surprise you. Although the intent of a hacker is generally more insidious (stealing your banking log-in, for example), the insider threat is actually more costly simply due to an employee’s access to company data.
A recent survey,“2011 CyberSecurity Watch Survey” found that, although there are more instances of cyber threats, their overall cost is less than that of an insider-caused data breach. The survey concluded that more attacks (58%) are caused by outsiders (those without authorized access to network systems and data) versus 21% of attacks caused by insiders (employees or contractors with authorized access)… however 33% view the insider attacks to be more costly.
Don’t let an unsecure flash drive cause business disruption, productivity loss, revenue loss, and fines.
Recent events in the news have demonstrated the ease with which portable devices can be used to steal confidential data.
Avoid your own personal Wikileaks by securing your USB flash drives. Kanguru’s secure flash drives and remote management capabilities provide excellent protection against data leaks.
The Kanguru Defender Elite coupled with Kanguru Remote Management Console (KRMC) give CIO’s and CISO’s an unprecedented level of control over their flash drives. Data breaches can be prevented with features such as:
Remote Disable/Delete - Remotely disable or delete devices compromised by rogue employees to protect sensitive information and prevent data breaches.
Domain/IP Control - Restrict drive usage to approved domains & IP ranges and prevent unauthorized use in external networks.
Offline Restrictions - Control whether devices can be used offline. Prevent unauthorized use in external networks.
Auditing and Reporting - KRMC enforces a full audit trail with detailed graphical reporting and the ability to export both customizable audit logs and graphs for external analysis to ensure proper compliance.
Dark Reading summarizes the annual threat report from PandaLabs. Virus writers were hard at work in 2010 and many of them were focused stealing banking and financial data.
Banker Trojans still dominate the ranking of new malware that appeared in 2010 (56 percent of all samples), followed by viruses and worms. A relative newcomer to the malware landscape, rogueware (fake antivirus software) now comprises 11.6 percent of all the malware gathered and has been given its own category.
In this BankInfoSecurity interview, a lead administrator of the ACH network discusses how cyber-criminals are targeting corporate bank accounts:
it’s a type of identity theft really in which cyber thieves gain control of business’ bank account by stealing the business’ valid online banking credentials. So these credentials are stolen through malware that is installed on a computer, and it can happen in a few different ways. So among those ways could be infected documents that are attached to an email, and the business clicks on that email that document, or a link contained within the email that connects to an infected website. Or a business could use an USB port, a flash drive, so they put the flash drive that has been infected into the USB port.
Once the credentials are stolen, the thief has access to online bank accounts and can fraudulently transfer funds out of the country. This may explain why USB autorun trojans are now the biggest malware threat worldwide according to a recent McAfee study.
Version 2.2 of the Kanguru Remote Management Console (KRMC) has a new feature that will make provisioning secure flash drives easier than ever. Administrators can now import directly from an Active Directory database and program Kanguru flash drives in an automated fashion. The drives will then be hard-coded with Employee data that can be tracked and logged including Name, Email and Phone Number.
While built-in encryption goes a long way towards securing your USB thumbdrives, KRMC goes a step further by providing control and accountability even after the drives have been distributed to employees. The logging and auditing features are extremely useful for showing compliance with HIPAA, GLBA, and a wide range of state laws that are popping up across the country.
The full press release is available at the Kanguru News website.
HSBC has been fined over £3 million ($5 million) for data security procedures that fail to meet Financial Services Authority (FSA) requirements.
The FSA said that, in April 2007, HSBC Acutaries lost a floppy disk in the post that contained 1,917 pension numbers and addresses. And, in February 2008, HSBC Life lost an unencrypted disk holding data on 180,000 policy holders - also in the post.
Costly data breaches can be avoided by remotely managing portable data. Not only is the data encrypted, but the device can be programmed to remotely delete the next time it is plugged in. The company has a log file to show the date, time and location where the data was destroyed.
Last month the FTC cracked down on a mortgage company for violating the privacy rules in the Gramm Leach Bliley Act (GLBA). A lack of information security measures is going to cost the company 10 years of audits.
Agent Genius has a good rundown on how GLBA affects financial institutions like banks, insurance companies, brokers, lenders and so on. As the author notes, “financial institution” can be broadly interpreted.
Data encryption with the ability to log and audit should be a key part of any GLBA compliance plan. Regulators want to see clear proof that information security policies are in place and are being enforced.
Nate Cote, VP of Product Management, chats with BankInfoSecurity.com at RSA Conference 2009. Nate discusses how Kanguru’s encryption and management solutions fit into the broader security and compliance architecture.
Follow us on Twitter