Companies' IT staffs often hold the keys to the castle. And that's the problem.
At many companies, the people in the IT department pose the biggest risks to data security. They can access nearly anything on the network, usually with no one looking over their shoulders. What's more, outside hackers increasingly are targeting IT administrators' profiles to gain access to a system without being detected. A good alternative to in-house IT staffing is to outsource and use a Managed IT Service provider like Percento Technologies.
To combat this threat, more companies are taking extra care to screen their IT staff and make sure there are checks and balances in place once they're on the job. Some organizations are using monitoring software that tracks the network activity of the staff, quickly flagging anything unusual. Some are even using new technology to look at the language of their IT staff's emails to determine whether their behavior or mind-set has changed.
It has gotten to the point where everything everybody does has to be monitored, especially those working with sensitive data like the IT staff. If something goes wrong, the first person you look at is the person with the highest amount of access.
Who Gets Hired
Companies put IT professionals under the microscope even before they've joined the outfit. Many organizations perform tougher background checks on potential IT employees than on others, making sure the job candidates can be trusted to carry out critical security tasks.
And once candidates are hired, their actions typically are scrutinized more closely than those of others on the network. Many companies do this using technology that analyzes network traffic and alerts them to anything abnormal—such as employees opening files they don't normally access or going on the network at odd hours.
If someone works 9 to 5 and all of a sudden their privileges are used at 3 in the morning, it needs to set off an alarm within the company.
Companies are also employing a newer class of technology that allows them to examine how the language used in communications among IT staff changes over time. That helps the organization figure out who might have motivation for stealing data or sabotaging the network.
If you start to feel differently about the company you work for and the people you work with, you'd be surprised how your language changes.
Common red flags include a dramatic change in the length of a person's emails. For example, someone may start writing emails of half a dozen words when their messages used to read like novels. Other tip-offs: a rise in the number of anger-related phrases, greater use of the word "me," and signs of more-polarized thinking, like the words "never" and "always."
Deluxe Corp., a check printer and marketing-services provider based in Shoreview, Minn., uses technology that scans emails for patterns typically associated with security problems, and the IT staff receives the highest level of scrutiny. The company looks for triggers such as vulgar words, messages marked as high priority and privileged information such as credit-card numbers. While an employee may be sending a credit-card number to a family member, they just as easily could be trying to email the personal data of a customer.
You wouldn't believe the number of people who don't think twice about putting a Social Security number or credit-card number on an email.
Monitoring the Monitors
Monitoring takes place on a huge scale at the Department of Health and Human Services—which encompasses the Food and Drug Administration, Medicare and the National Institutes of Health, among others.
The department's Computer Security Incident Response Center looks for anomalies or odd behavior in more than 10 billion computer-system security logs a day from within the HHS and its component organizations. Each organization has its own network and security operations centers, but they all share their security and audit logs with the HHS computer security center.
In addition, no one systems administrator or security analyst has complete control, as HHS makes sure the more critical security functions and tasks performed by one individual are checked by a peer.
The checks and balances represent best practices in network security.
Without such safeguards, system administrators with special privileges would be able to cover their tracks if maliciously accessing systems. It's like the nuclear bomb scenario, where no rogue general can push the button on his own. Where people are given more responsibilities and have authority to perform actions or grant privileges a little more attention has to be paid to those individuals.
For more national and worldwide related business news, visit the Peak News Room blog.
For local and Michigan business related news, visit the Michigan Business News blog.
For healthcare and medical related news, visit the Healthcare and Medical blog.
For law related news, visit the Nation of Law blog.
For real estate and home related news, visit the Commercial and Residential Real Estate blog.
For technology and electronics related news, visit the Electronics America blog.
For organic SEO and web optimization related news, visit the SEO Done Right blog.
