Data theft is a growing phenomenon primarily caused by system administrators and office workers with access to technology such as database servers, desktop computers and a growing list of hand-held devices capable of storing digital information such as USB flash drives, iPods and even digital cameras. Since employees often spend a considerable amount of time developing contacts and confidential and copyrighted information for the company they work for, they may feel they have some right to the information and are inclined to copy and/or delete part of it when they leave the company, or misuse it while they are still in employment. Alternatively, an employee may choose to deliberately abuse trusted access to information for the purpose of exposing misconduct by the employer. From the perspective of the society such an act of whisteblowing can be seen as positive and is in certain situations protected by law in some jurisdictions, such as the USA.
While most organizations have implemented firewalls and intrusion-detection systems very few take into account the threat from the average employee that copies proprietary data for personal gain or use by another company. A common scenario is where a sales person makes a copy of the contact database for use in their next job. Typically this is a clear violation of their terms of employment.
Data theft methods
The phrase data theft is actually a misnomer, since unlike theft the typical data theft methods typically do not deprive the owner of their data, but rather create an additional, unauthorized copy.
Thumbsucking, similar to podslurping, is the intentional or undeliberate use of a portable USB mass storage device, such as a USB flash drive (or "thumbdrive"), to illicitly download confidential data from a network endpoint.
A USB flash drive was allegedly used to remove without authorization highly classified documents about the design of U.S. nuclear weapons from a vault at Los Alamos.
The threat of thumbsucking has been amplified for a number of reasons, including the following:
- The storage capacity of portable USB storage devices has increased.
- The cost of high-capacity portable USB storage devices has decreased.
- Networks have grown more dispersed, the number of remote network access points has increased and methods of network connection have expanded, increasing the number of vectors for network infiltration.
- Pod slurping
- Data breach
Investigating data theft
- Schneier, Bruce (10 June 2013). "Government Secrets and the Need for Whistle-blowers". Schneier on Security. Retrieved 15 February 2015.
- "Do you know who is sucking data from your computer?". Retrieved 15 February 2015.
- http://rawstory.com/showoutarticle.php?src=http%3A%2F%2Fwww.time.com%2Ftime%2Fprintout%2F0%2C8816%2C1612912%2C00.html Zagorin, Adam "A breach in nuclear security."] Time, April 19, 2007. Retrieved April 21, 2007