Companies' IT staffs often hold the keys to the castle. And that's the problem.
At many companies, the people in the IT department pose the biggest risks to data security. They can access nearly anything on the network, usually with no one looking over their shoulders. What's more, outside hackers increasingly are targeting IT administrators' profiles to gain access to a system without being detected.
To combat this threat, more companies are taking extra care to screen their IT staff and make sure there are checks and balances in place once they're on the job. Some organizations are using monitoring software that tracks the network activity of the staff, quickly flagging anything unusual. Some are even using new technology to look at the language of their IT staff's emails to determine whether their behavior or mind-set has changed.
"It has gotten to the point where we have to monitor everything everybody does, especially those working with sensitive data like the IT staff," says Stacey Gregerson, senior database security analyst at ATM maker Diebold Inc. "If something goes wrong, the first person you look at is the person with the highest amount of access."
Who Gets Hired
Companies put IT professionals under the microscope even before they've joined the outfit. Many organizations perform tougher background checks on potential IT employees than on others, making sure the job candidates can be trusted to carry out critical security tasks.
And once candidates are hired, their actions typically are scrutinized more closely than those of others on the network. Many companies do this using technology that analyzes network traffic and alerts them to anything abnormal-such as employees opening files they don't normally access or going on the network at odd hours.
"If someone works 9 to 5 and all of a sudden their privileges are used at 3 in the morning, it needs to set off an alarm within the company," says Chip Tsantes, a Washington, D.C.-based principal at Ernst & Young who advises financial-services firms about security and other issues.
Companies are also employing a newer class of technology that allows them to examine how the language used in communications among IT staff changes over time. That helps the organization figure out who might have motivation for stealing data or sabotaging the network.
"If you start to feel differently about the company you work for and the people you work with, you'd be surprised how your language changes," says Ed Stroz, co-president at digital-risk-management firm Stroz Friedberg LLC, New York. The company, like other consulting firms such as Ernst & Young, makes technology to examine linguistics.
Common red flags include a dramatic change in the length of a person's emails. For example, someone may start writing emails of half a dozen words when their messages used to read like novels. Other tip-offs: a rise in the number of anger-related phrases, greater use of the word "me," and signs of more-polarized thinking, like the words "never" and "always."
Deluxe Corp., a check printer and marketing-services provider based in Shoreview, Minn., uses technology that scans emails for patterns typically associated with security problems, and the IT staff receives the highest level of scrutiny. The company looks for triggers such as vulgar words, messages marked as high priority and privileged information such as credit-card numbers. While an employee may be sending a credit-card number to a family member, they just as easily could be trying to email the personal data of a customer.
"You wouldn't believe the number of people who don't think twice about putting a Social Security number or credit-card number on an email," says Daniel Ritari, Deluxe vice president of enterprise information risk management.
Monitoring the Monitors
Monitoring takes place on a huge scale at the Department of Health and Human Services-which encompasses the Food and Drug Administration, Medicare and the National Institutes of Health, among others.
The department's Computer Security Incident Response Center looks for anomalies or odd behavior in more than 10 billion computer-system security logs a day from within the HHS and its component organizations. Each organization has its own network and security operations centers, but they all share their security and audit logs with the HHS computer security center.
In addition, no one systems administrator or security analyst has complete control, as HHS makes sure the more critical security functions and tasks performed by one individual are checked by a peer.
The checks and balances represent "best practices in network security," says Daniel Galik, HHS chief information-security officer.
Without such safeguards, he says, system administrators with special privileges would be able "to cover their tracks if maliciously accessing systems."
"It's like the nuclear bomb scenario, where no rogue general can push the button on his own," he says.
"Where people are given more responsibilities and have authority to perform actions or grant privileges," Mr. Galik says, "a little more attention has to be paid to those individuals."