Model Employee = Insider Threat?

Today, I read a survey by CareerBuilder detailing the new statistics regarding employees and vacation time. A quick run down:

• 35% of workers are not taking a vacation this year
• 71% of those say they can’t afford it
• One in five workers said they are either afraid of losing their jobs if they go on vacation or feel guilty being away from the office
• Half (50%) of employers say they expect employees to check in with the office while they are away

Several blogs and articles have discussed the increasing reluctance of employees to take vacation time, even if it is mandatory. While reading these articles, I can’t help but notice a lack of discussion about the security implications of this.

Internal investigators will tell you that a employee refusing to take vacation time, or refusing to take a large amount of time at once can be a red flag. Why? An employee committing embezzlement, fraud, stealing data or otherwise manipulating books or records needs to have continuous control over those systems to maintain the theft and avoid being caught.

In fact, many aspects of what we consider to be “model” employee behavior can actually be a red flag:

• Volunteers often for new projects and duties; particularly in security, finance, or record keeping duties. Often these duties, like processing receipts for reimbursement, are the least desirable duties. After a few volunteer projects, a manager might find that least privilege and separation of duties policies may be being circumvented.
• Early in, late out. First in and last out employees have access to files, computers and offices with little or no security or monitoring measures. The employee offering to make coffee in the morning maybe up to something more than making sure the office is perky.
• Constantly remaining in touch while on vacation, doing work while on vacation, and working overtime before and after vacation. These may all be attempts at communicating with someone in collusion with the fraud, or at maintaining control over the work product. If your employee insists that he or she completes all work before going on vacation instead of handing over the materials to another employee, this could be cause for concern.

You can see that many people would exhibit this behavior normally during a time of economic crisis when they are particularly concerned about job security. This is why it is important to have a good vacation policy, regular internal audits and reviews, and strict separation of duties and least privilege policies. Managers and executives can set a good example by taking their vacation time in large chunks, and remaining truly on vacation. Encourage employee work-life balance and well being, and insist that they really “leave the office behind” while on holiday. Not only will you have happier and more productive workers, but you can avoid a simple security pitfall in the process.

I would like to say a special thanks to Mark Warner, who spoke on these issues at the Oregon Chapter of the Association of Certified Fraud Examiners lunch meeting in Portland, OR March 2009.