Any casual observer of the news knows that data breaches have become more common. What typically makes the headlines involves multi-million dollar demands from ransomware, devastating cyberattacks against critical infrastructure, and the human cost when data involving innocent people is compromised. Often these involve sophisticated attacks from outsiders.
Many incidents, however, originate from the inside. Recent studies have shown that a number of most insider breaches are unintentional, which still stresses the need to better protect data even among the most trusted employees. There are of course malicious employees—or former employees—who proactively target their organizations for no other intent than to do harm.
In these cases, the employees may seek retribution for termination, or from poor treatment at the company whether that is true or the employee perceives it to be true. While the aim is not to extort financial gain, the results can still be quite damaging.
Many insiders know exactly how to hurt the organization and where to find the information in these systems. As with any disaster, this means what took years to build can be destroyed in a very short period of time. In a recent insider data breach, one such employee did just that—and faced harsh consequences.
Insider Damage
Juliana Barile worked at a New York-based credit union as a part-time employee. However, she was terminated on May 19, 2021. On May 21, only a couple days later, Barile accessed the credit union’s file server remotely. She proceeded to wipe out 21.3 gigabytes of data—this figure includes more than 20,000 files and nearly 3,500 directories.
Among the files Barile deleted are those associated with mortgage loan applications and software the credit union used to protect itself from a ransomware attack. Furthermore, she accessed some of the company’s confidential files. This certainly was a direct attack on her former employer, but her actions directly affected many of the credit union’s customers.
Although she targeted her former employer, this added stress and tumult to the lives of many customers affected in her attack. One of the worst impacts was to the approvals and paperwork the credit union’s customers used to finance their homes. In regard to this case, FBI Assistant Director-in-Charge Michael J. Driscoll stated, “An insider threat can wreak just as much havoc, if not more, than an external criminal. The bank and customers are now faced with the tremendous headache of fixing one employee’s selfish actions.”
Barile gloated about her actions to a friend via text message, which obviously served as an admission of guilt. In a Brooklyn federal courthouse on August 31, 2021 Barile pleaded guilty to one count of computer intrusion. As of the time of her trial, the credit union had spent $10,000 fixing the mess she left behind. Barile faces a sentence of up to ten years in prison as well as a fine.
Comprehensive Data Security Solutions
The credit union that employed Barile did have some data security measures in place, as one system she attacked was its anti-ransomware software. Unfortunately, as the incident and her trial show, the system in place was nowhere near thorough enough.
One of the most important security solutions is hardware-encrypted, offline storage. The SecureDrive and SecureUSB KP models are hardware-encrypted storage devices that require PIN authentication to access the data. The SecureDrive and SecureUSB BT models also require user authentication, but are accessed via the SecureData Lock app, which may be controlled by IT administrators through Remote Management. These products make an excellent backup solution that maintains strict security. In the Barile case, with a sound, offline backup plan the credit union could have easily retrieved most or all of its lost files.
.png){kind=small}
