Standing guard in tough times against computer saboteurs

on April 30, 2009 at 6:00 AM, updated April 30, 2009 at 6:12 AM
Gary Kessler is a professor of informational security at Champlain College in Burlington, Vt.

Don't underestimate the wrath of a disgruntled ex-employee.

As the downturn forces businesses to shed jobs, employers should watch for computer sabotage by laid-off employees, says Gary Kessler, a computer forensics expert.

Just one vengeful act can cost a company thousands of dollars in repairs and lost productivity, and he said that these days it probably happens more often than many employers realize.

"The time is much more fertile for this kind of activity," said Kessler, a professor of informational security at Champlain College in Burlington, Vt. "A lot of people do things they wouldn't do in calmer times. It's like their last act of defiance."

In a global survey by CA, an information technology management software company that released the results last week, seven of every 10 companies said they believe layoffs have increased the internal threat to their information technology systems, and 40 percent said they planned to increase their security budgets.

History shows the damage can be devastating. Three years ago, for instance, a Bergen County man was convicted of creating a cyber-bomb that crashed hundreds of servers and computers at UBS PaineWebber offices across the country in 2002, costing $3 million to repair.

Kessler, 55, has spent 15 years helping companies devise policies on information security. He also has been a member of the Vermont Internet Crimes Task Force for nearly a decade. He recently spoke about averting cyber-disasters.

Q: What kind of companies are most vulnerable to cyber-attacks?

A: Small companies tend to treat their employees better than big companies, yet in many ways they're most at risk against a disgruntled employee. In some ways, when you get laid off from a big company, you don't feel as betrayed as you do when you get laid off from a small company. Most small companies also don't have really strong internal polices or procedures, so it might be easier for someone to get access to something.

A lot of their data is more centralized, so it's easier for one person to do more damage. When big companies let someone go, they remove their network access and they may even change passwords. A small company may not want to do that. They may say, "I'm not going to just throw someone out on the streets. I'm going to give them two weeks' notice." But it may be best to just give someone two weeks' severance and let them go immediately.

Q: How much damage can one person do?

A: One person can do a fair amount of damage if they have access. A disgruntled IT manager, for example, could not only destroy your data but also your capability to retrieve backups.

Most people can destroy current data sets, which could take a business a week to get back. If I have access to the database, I can just go in and start randomly changing data -- alter phone numbers, account numbers, prices, quantities. I don't have to do it to all of the data, just to the point where the company thinks all the data is suspect. In a small company, the damage could certainly be thousands or tens of thousands of dollars.

Q: How can a company prevent this from happening when it lays off an employee?

A: To tell someone, "You're fired -- and by the way, we're walking you out of the building," seems cruel, but you have to at least consider it. A small company needs to think about things objectively without thinking about the personalities of the people.

Put yourself in the position: If I were in a particular person's position working here, what kind of damage could I do to the company? If you're going to keep them on for two weeks, give them notice, give them the money, but tell them they can't have access to the network, maybe not even the building. What you're doing is removing temptation.

Q: What can companies do differently now, ahead of any layoffs?

A: A good rule of thumb is that people should only have access to the things they need to have access to -- no more and no less than what they need to do their job.

It's reasonable to maintain logs to see where people are going on the internet and to make sure they're doing appropriate things. Everyone ought to know upfront what policies and procedures are in place.

When people are terminated, other people ought to know. If someone is fired and escorted out, it shouldn't come as a surprise. If you don't know someone's been laid off, and they call you up asking for help, you'll assist them because you didn't know any better. There needs to be an atmosphere of openness.

-- Leslie Kwoh may be reached at or (973) 392-4147.