Companies unaware of moles.

In a podcast interview released recently on www.infosecurityadvisor.com, Peter Wood Member of the ISACA Conference Committee and founder of First Base Technologies reveals the ease with which criminals are able to steal data and gives 3 critical steps organisations can take to block them.

Wood reveals how he and a colleague walked unchallenged into an insurance company and were able to steal all their data as part of a security exercise. And he is not the only one to get away with stealing data; very often companies unwittingly hire people whose sole purpose is to steal data. Wood goes on to explain "some people in the banking community have quietly and anonymously said to me over the last year that they have found employees who have been placed in their company by criminal gangs and they have been operating as moles over that period."

Companies also make the mistake of storing sensitive and confidential data in one place which makes it very easy for criminals to steal data.

Wood says, "intellectual property or large credit card data bases are probably the primary targets and someone told me, a Japanese company in fact, that they could store all their key data, all their intellectual property and the stuff that really differentiates them on a thumb drive, as a result one hit there is more than adequate to give the criminal what they want."

"The physical attack is sometimes the easiest and probably the way of the future for a lot of criminal gangs", however according to Wood "you don't have to be onsite, remote control attacks through email phishing, spear phishing, emailattached Trojans or even web drive-by attacks are increasing in popularity and someone receiving an email that directs them to a site that appears innocent and then quickly installs something on their PC is just as vulnerable"

However there is a light at the end of this very dark and dangerous tunnel of information security breaches. According to Peter Wood there are three critical steps an organization could take to protect themselves.

* Good quality vetting of staff and third parties

* An awareness campaign that is intelligently designed and has a strong focus to encourage and inform people

* Conducting regular meetings with HR, physical security, IT security and the business to provide a holistic defence against an attack.

For more information on Peter Wood's comments, listen to his podcast at www.infosecurityadviser.com/podcasts