To: steve who wrote (19751 ) 1/26/2001 2:44:49 AM From: steve Read Replies (2) | Respond to of 26039 More to fear from staff than hackers Survey finds that seven out of 10 times, a company's intellectual property is stolen by its own staff By Edmund Tee , Straits Times 26 Jan 2001 Technology may have made things more efficient, but it has also helped turn industrial espionage into an industry in itself. But employers have more to fear from their own staff stealing information than from malicious hackers, or crackers, on the outside. According to a survey done by the US Computer Security Institute and the Federal Bureau of Investigation last year, about seven in 10 of all security attacks came from within. These attacks amounted to some of the most serious financial losses for the companies polled. It included the theft of proprietary information, such as client and contact bases to financial and marketing information, worth about US$66.7 million (S$115.4 million). The companies polled also reported losing about US$56 million to financial fraud. Earlier this month, two lawyers here were charged for allegedly copying confidential computer data from their former employer, law firm Lee & Lee. Mr Rajesh Sreenivasan, a partner at law firm Rajah & Tann, which specialises in information technology, said companies should be extra vigilant when an employee resigns. This is because the temptation to take proprietary information is especially high just before an employee leaves for good. He added: 'Digitisation has made it quite easy to replicate confidential information. It's much easier to slip a diskful of it out than to lug tons of documents.' To protect its rights in court, an organisation should spell out at the time it hires a person what belongs to it, and what a worker can or cannot take, he said. 'The advice we've given to employers is for them to get as specific as poss- ible from Day One, and to give due notice to all employees where the lines are drawn.' An IT security specialist, who declined to be named, said legal measures should be backed up with technological protection, such as network applications that restrict access to sensitive information. He said: 'An employee with the know-how can be more dangerous than someone on the outside. He knows where all the valuable things are stored, and can do damage more easily than a cracker, who has to first probe.' Some organisations are so protective of their intellectual property that they even require their employees who resign to surrender the name cards they have collected in the course of their work, said Mr Mark Teo, a human-resource consultant. 'These companies are those that are typically in cut-throat industries, or where contacts mean everything, like stock trading and travel.' But Mr Rajesh added that there were instances STYL not found Invalid measure Invalid font where an employee who resigns might be able to take his contact list with him, even if he had signed an agreement not to do so. This would apply only in highly-specialised fields, such as neuro-surgery, where the person is so specially trained, he is unable to do anything else. Mr Rajesh said: 'The court may then deem it unreasonable for his employer to withhold that list from him.' it.asia1.com.sg steve