Data Theft

MI5 chief Jonathan Evans recently warned businesses to not underestimate the level of industrial espionage taking place across the world. In today’s digital and global world, information is as valuable as cash. In fact corporate espionage costs UK businesses more than 800 million pounds each year. However companies of all sizes tend to neglect one of the most common perpetrators of data theft: their employees.

Who is the Typical Data Thief?

In order to assess this often underestimated threat, Symantec recruited leading forensic psychologists to examine various factors leading to insider data theft, focusing on the behavioural and environmental issues that can cause theft of corporate data. The results, published on Symantec’s website, conclude that the average data thief is first – a current employee; second – male, third: 37 years old. The typical perpetrator  of data theft usually serves in technical positions such as programmer, engineer or scientist.

What are the Common Methods?

Digital documents are portable, easy to copy and can be stolen easier by employees than paper documents. This fact not only applies to the ease with which electronic files are stolen, but also to the sheer quantity taken.
According to a survey conducted by the Ponemon Institute, 29% of thieves say they steal corporate data when they leave a company. 24% of thefts were done using USB devices (sticks, MP3 players) and 18% used email. Smart phones – dangerous combination of storage, data access and ubiquity – are an ideal method of stealing data, but surprisingly most companies do not address this threat at all. The same goes for Instant Messenger services and FTP connections.
All of the methods described above cover intentional data theft by employees. However, an employee may also inadvertently expose confidential data by installing software on their computer. Over half of all respondents to the Ponemon Institute’s survey admitted to downloading personal internet software to their company computers. Many of these programs could contain a Trojan horse or other malware, which seeks out confidential data and copies it to data caches on the Internet for retrieval by unauthorised individuals.

How Can Businesses Prove Data Theft?

While policies and technology will prevent casual data theft, determined employees will still steal data. If this occurs, the company will have to prove two things: that the employee took information without permission and that the theft caused harm. This is where computer forensics steps in. Computer forensics experts can find and document instances of an employee’s improper conduct using specialised software, hardware and techniques.
Our top choice of contemporary forensic software is Internet Evidence Finder (IEF), developed by Magnet Forensics. IEF recovers data in more areas than any other solution, which include:

• Entire logical or physical drives
• Unallocated space/deleted data
• Selected files including live RAM captures, network PCAP files, pagefile.sys, hiberfil.sys files (with full decompression) and more
• Entire user-selected folders and subfolders
• Special areas of the NTFS file system

Internet Evidence finder is easy to use and able to recover cloud artefacts, social networking pages, webmail applications, instant messenger clients, P2P file sharing applications, web browser artefacts. For more information about IEF please click here.