The Inside Story: A Disgruntled Employee Gets His Revenge

In a time when computer viruses and worms continue to steal the media spotlight, it isn't surprising that many companies have already implemented the security defenses required to protect against these external threats. In fact, antivirus software and firewalls are the two most common security technologies used in all organizations. While these threats certainly deserve our attention, too much focus on external threats can cause us to overlook the most dangerous and costly threat of all - the disgruntled company insider. Although the number of external and internal threats is fairly equal, the cost associated with either type of attack is significantly different. The average cost of an attack originating from outside an organization is $57,000, while the average cost of damages incurred from an insider attack is an astounding $2.7 million dollars! In this paper, I will present the fictional story of a disgruntled employee who exacts revenge on his employer by stealing sensitive customer information and posting it on a public website. While the character is fictional, the security risk he represents is quite real. I will describe his motive for attacking his employer's network, analyze the tools and techniques that he used to circumvent existing security measures, and detail the steps involved in the attack process.