The company has taken legal action against the member of staff, who is alleged to downloaded thousands of pages of sensitive company data on to two USB sticks, which she then claimed were lost.
According to newswire reports, initial legal action against the member of staff revealed that the data from the USB sticks had been copied to a computer, although after analysing the data, Computershare says that it did not include any customer information.
According to Finextra, the employee worked as internal auditor for the firm and is being pursued through the US courts in connection with allegations relating to violations of the Computer Fraud and Abuse Act.
“The suit is ongoing, after the company discovered that the employee… siphoned the data from her laptop to two separate USB drives”, says the newswire, which adds that the auditor claims that she lost the USB sticks.
Computershare, meanwhile, says an analysis of her personal laptop indicates that the USB sticks were in use throughout the period she maintained that they had been misplaced.
Commenting on the case, David Gibson, director of technical services with Varonis Systems, says that it is classic situation that could have been prevented with good data governance.
“The case – which is still ongoing – highlights what can happen when an organization does not know who is doing what and when with a given element of information at all times”, he said.
Gibson adds that, with more than two-thirds of company data being stored in unstructured formats that are not audited or locked down, conventional IT methods cannot always keep track of the very large sets of information involved.
Put simply, he argues, if `Joe’ from accounts is copying company client files to a USB stick from a file share on a Friday afternoon, appropriate alarm bells need to start ringing.
And, he says, whilst this may happen for some applications and databases, if Joe is copying from a server it is impossible for most organizations to know exactly what data he is really copying.
This, Gibson explained, is an extreme example of the many thousands of times that data is copied every working day in a large organization, so keeping track and automatically risk-assessing each data transaction – which may involves gigabytes of unstructured data – is a major task, even for specialist security software.
“And this is where our data governance technology enters the frame, as it can track all the data, all the time. Had the international share-dealing company had our data governance software installed on its platform, then the appropriate alarm bells would have been ringing when she started copying the company files to her desktop, USB stick or similar portable storage device she apparently used to move the data out of the company's offices”, he said.
“Good data governance software does this automatically and in the background, only alerting appropriate members of staff when something unusual happens, and if the data change/copying is really suspect, then the breach can be stopped and those data files locked down pending an urgent investigation”, he added.