This is a tale of the hole in Goldman’s Socks as told by Warren Axelrod.
The New York Times and the Wall Street Journal (July 7, 2009) reported the recent insider theft of key intellectual property from Goldman Sachs in the form of 32-megabytes of program code. Goldman Sachs is a company with a reputation on the Street for its tight security. The alleged perpetrator of the crime is a former Goldman employee Sergey Aleynikov.
Apart from the realization that protecting against insider threats is a challenge for even the most talented and capable of information security departments, there seemed nothing much different in this case from many others. Then I read an Op-Ed piece written by oyster farmer Michael Osinski in the July 17, 2009 issue of the New York Times. The title of the article is “Steal This Code,” which is clearly a play of words on the title of Abbie Hoffman’s book “Steal This Book.”
Mr. Osinski , by his account a successful computer programmer for 20 years, claims to have written some of the programs that he believes contributed to the mortgage meltdown of 2008. Mr. Osinski declares that “it [stealing code] is done all the time”. Regardless of whether his opinion is accurate or pervasive, it is exactly this attitude that makes it difficult to enforce security policy and procedures.
He also contends that a programmer “bonds” with his code. Well, putting the bonding aside, the programmer shouldn’t be deluded into thinking that he/she owns the code. Unfortunately, there are many insiders, such as Mr. Osinski, who just don’t get it. Intellectual property, which you develop on the job, belongs to your employer - period! In many companies, including Goldman, you sign agreements, stipulating you understand and accept this policy as a condition for continued employment. Employees are often able to technically copy computer-based intellectual property with relative ease, but that doesn’t mean that they have a protected right to do so.
Mr. Osinski gives the impression that he condones such behavior and suggests, as in some of the original newspaper reports, that the program code actually stolen was probably of little use in and of itself. The obvious question is: How do they know that potential buyers of the program code would not have the capability of using it? Are we to believe that Mr. Aleynikov would be so ignorant or naïve as to steal useless program code. Secondarily, why would Goldman have gone to the trouble of having him tracked down and arrested, knowing full well that the exploit, once made public, would have a considerable negative impact on their reputation?
While controls are in place in most large modern companies, everything cannot be completely locked down, otherwise nobody could do any work. You have to be able to copy software and data from one place to another, but it should be done in compliance with the policy and procedures mandated by the company, and also required by legislation and regulations.
What's the moral to this tale - should Goldman have mended the hole in the sock? The issue for security professionals is that Goldman appeared to have detected the unauthorized transfer of the computer programs after the fact and had to engage in a forensics exercise that took about a month to complete. Wouldn't it have been better if the theft had been detected in near real-time and even prevented at the outset? Goldman could have avoided the adverse publicity and we would have been spared the misguided comments from those who reject the fact that it was wrong in the first place.
Intellitactics helps companies prevent data loss with real time correlation of security events with a state of the art security information and event management (SIEM) solutions. Collecting logs from anything located anywhere and transforming them into actionable reports and just in time alerts is easy and affordable with Intellitactics.
I loved the type ad commenting system very clean and very efficient.
Love to read more from you on the topic above
Posted by: seattle house cleaners | October 26, 2009 at 06:03 AM