Prevention
Detection
Recovery
There can be several ways to look at it. You are describing an insider threat scenario so there are multiple angles to look at:
1) How did you find out about the incident? Tests your incident detection/response, auditing, and role separation policies.
2) How long has the event been going on? Was it a one-time dump of info? Was the person slowly siphoning off and using the info?
3) What was the motive? Financial gain? Company ruin?
4) Is this an isolated incident? Are there more people doing it?
5) How would you prevent it in the future? Data Loss Prevention rules/policies/actions being improved?
6) What did you learn?
You will have to lay out your process and then look for anywhere a person could inject fraud into the equation.
1) Do you do background checks on your employees? Do certain employees with certain roles, i.e. finance, HR, procurement, etc. get special checks for credit problems/issues?
2) Could this not just happen to HR, but other departments as well? At one agency I worked at we had requirements that anyone that accessed a certain system had to have a background check, but they forgot about IT administrators who could take over those employees accounts. They didn't require it for them (until I got there and pointed this out). Don't forget that IT employees often have the keys to the kingdom, so inject that possibility into your situation.
3) Think outside the box. I heard a story of an HR manager who couldn't believe his bad luck of hiring for a particular role. He had to keep firing people for theft for this one particular role. All of the newly hired employees swore that they were not stealing, but got fired anyway. A hidden camera investigation, combined with a "fake" hire, proved that they were right. A current employee would wait until someone was hired into that role and then start stealing. When they were fired, she stopped stealing and waited for them to rehire a person for the role, and then would start stealing again. When mentioning his bad luck of hiring to a friend, the friend suggested a sting operation where they "hire" him and install hidden cameras to catch the real thief.
I can tell of several insider threats that I have experience with.
1) We had separation of duties policies/practices where one person created an award and a separate person approved it. We were defeated by a mother & son combo who worked together (he was an award creator and she was an approver). The son would receive a death notice and instead of terminating the award, he changed the bank account information on the award and then the mother approved the change to the account. They were caught because they used the same bank account for 6 different people. It was noticed during an audit that 6 people had the same bank routing and account numbers (This would be a VERY unlikely situation). Fraud detection method (auditing of bank accounts searching for duplicates, red flag/anomaly detection) Post detection improvements were made to look at the create/approval patterns to look for patterns, and change in rules to prevent relatives from working the same cases.
2) We had one person who was able to order their own supplies. During audits for very high usage of some expendable items and some missing equipment audits, the employee claimed that other employees had come in and stolen those items and since those employees were in a "protected" class (and no it was not due to race but type of employee) that management was not going to do anything about it. It turned out the employee was selling the stuff on eBay. They were caught because they took photos of the equipment for sale on the carpet of the office and the office carpet had a VERY distinct pattern. An employee, who just happened to work in the same office building, who was browsing eBay joked to their wife that the carpet in those pictures looked "Just like the carpet at work!" Turns out it was the same carpet. When bringing up the story (and later the website) at work, someone who was involved in the audits overheard it and combined with the type of inventory that was mentioned, came over and inquired and then put the information together and was able to successfully prosecute the employee. Fraud detection method (observation and luck, combined with auditing) Post detection improvements were a tightening up on audit intervals, closer inspection of orders and better inventory management.
3) The company ran several gas station/convenience stores (this was before the prepay at the pumps was instituted and you could turn the gas pumps on just by lifting the handle). We had one particular cashier who claimed to have a high level of "drive-offs" during her shift. A "drive off" would be someone who pulled up to the gas pump, pumped some gas into their car, and then instead of heading inside to pay for it, would just drive off. She seemed to have an abnormally high number of these events when compared to other cashiers. So a hidden camera investigation was set up and she was caught. She had figured out that the cash registers had a subtotal button that would print out a receipt, but not finalize the sale. Someone would come in and pay for $20 in gas, she would hit the subtotal button so a receipt would print out, which she would give to the customer. Then when they went outside she would hit cancel on the order and pocket the cash. The gas pumps would still work so the customer didn't know she was pocketing the cash. To everyone working there it looked like a totally normal transaction.
Fraud detection method (Abnormality of an adverse event, auditing of losses, video evidence to confirm suspicions). Post detection improvements - Elimination of the subtotal button function. Changed rules around "drive-offs". Ended the "trust the customer to come in and pay" policy on the gas pumps and transitioned to prepay only.
Criminals are innovative and think differently than "normal" people do, so you must try to think like they do. Read some true stories about corporate espionage and criminal activities to get some ideas of how people work around the system. This may help give you some ideas to use in your scenario. Then, if you really want to take it to the next level, think about this. There are also different levels of criminals. The beginner level is what we call "smash and grab". They usually choose the quickest way to get money (usually small amounts). They go for the quick win. In your scenario it might be one big dump of employee data and then try to sell it. The "middle tier" usually go about it in a slower, but not perfect manner to avoid detection and go for more money over a longer period of time. So your insider might start using identity theft of one person at a time and try to keep it under the "get noticed" threshold and try to make more money over a long period of time. Then you have the "big-time, or planners" type of criminal. They think through the crime, take time to plan it out, try to learn the detection algorithms or "how security works at this place". Think Bernie Madoff. These people usually try to go for the big score. Get the company to wire large amounts of money to a back account type of stuff. Could your HR insider trick the CEO or CFO into wiring money to a fake bank account?
I know this is long but, hopefully this helps.
