It's a CIO's worst nightmare: you get a call from the Business Software Alliance (BSA), saying that some of the Microsoft software your company uses might be pirated.

You investigate and find that not only is your software illegal, it was sold to you by a company secretly owned and operated by none other than your own IT systems administrator, a trusted employee for seven years. When you start digging into the admin's activities, you find a porn website he's been running on one of your corporate servers. Then you find that he's downloaded 400 customer credit card numbers from your e-commerce server.

And here's the worst part: he's the only one with the administrative passwords.

The code of secrecy

Think it can't happen? It did, according to a security consultant who was called in to help the victim, a $250m US retailer. You never heard about it because the company kept it quiet.

Despite the occasional headlines about IT staff gone rogue (remember Terry Childs, the network administrator who held the San Francisco's network hostage?), most companies sweep such situations under the rug as quickly and as quietly as possible.

An annual survey by CSO magazine, the US Secret Service and CERT (a research centre at the Software Engineering Institute at Carnegie Mellon University) routinely finds that three quarters of companies that are victimised by insiders handle the matter internally, says Dawn Cappelli, technical manager of CERT's threat and incident management team. "So we know that [what's made public] is only the tip of the iceberg," she says.

By keeping things quiet, however, victimised companies deny others the opportunity to learn from their experiences. CERT has tried to fill that void. It has studied insider threats since 2001, collecting information on more than 400 cases. In its most recent report, 2009's Common Sense Guide to Prevention and Detection of Insider Threats, which analyses more than 250 cases, CERT identifies some of the most common mistakes companies make: inadequate vetting during the hiring process, inadequate oversight and monitoring of access privileges and overlooking of red flags in behaviour.

Detecting problems

But threats from privilege-laden IT employees are especially hard to detect. For one thing, staffers' nefarious activities can look the same as their regular duties. IT employees routinely "edit and write scripts, edit code and write programs, so it doesn't look like anomalous activity," Cappelli says. And they know where your security is weakest and how to cover their tracks. You can't rely on technology, or any single precaution to protect yourself from rogue IT people. You have to look at the big picture.

"It requires not only looking at what they are doing online but also what's happening in the workplace," says Cappelli. "People really need to understand the patterns here, the story behind the numbers."

PC Advisor's sister title Computerworld went looking for some of those stories behind the numbers, incidents that have not been widely reported. Though the victimised companies wouldn't talk, the security consultants who helped clean up the messes would. Although each story has unique circumstances, together they show some of the typical patterns that CERT emphasises. Employer, beware.

NEXT PAGE: Pirating software and worse

  1. One rogue employee
  2. Pirating software and worse
  3. The cost to the company
  4. Outsourcing incenses employees
  5. Preventative measures
  6. A firing gone very wrong
  7. The best defence is multipronged