News
Comment from Christian Toon, Iron Mountain: The latest high profile incident of corporate espionage from an ex-Microsoft employee demonstrates just how critical it is to foster a culture of information responsibility within organisations.
March 2014 by Christian Toon, head of information risk at Iron Mountain
This particular incident is a classic example of an employee taking confidential information in revenge for feeling wronged by the company they work for. Having received a poor performance review in 2012, Alex Kibkalo threatened to resign if it was not amended and subsequently passed trade secrets to a blogger.
This highlights a particular failing in many information security strategies – where firms underestimate the risks staff pose to company data, especially if that member of staff has a grievance or is leaving their job. And it’s not limited to this high profile incident; our research* has shown that a worrying 11 per cent of employees in Europe would deliberately remove confidential or sensitive information from the office when feeling wronged. In fact, the study of office workers across the UK shows a surprising number are motivated to lash out against employers when either they’ve been held responsible for something they believe wasn’t their fault (21 per cent) or treated unkindly (19 per cent).
When it comes to employee behaviour towards information, it’s often a case of heart over minds, with personal feelings of disgruntlement leading to data revenge. Companies need to realise that responsibility for information security goes beyond guidelines and processes; it is also about improved people management and training. Organisations must foster a culture of information responsibility that includes trust for employees and respect for the value of information that belongs to the employer.
* Research by Opinion Matters for Iron Mountain. Sample: 5021 employed adults in the UK, France, Spain Germany and the Netherlands.
