Walter Powell, an ex-employee for Baltimore Substance Abuse Systems, recently received a two-year suspended prison sentence and 100 hours of community service for hacking his former CEO’s PowerPoint presentation. Now that wasn’t all he did but certainly the most embarrassing part for the company. Powell, who was an IT support manager for BSAS, inserted porn into his old boss’s PowerPoint presentation which he consequently presented at a rather large meeting on a 64 inch monitor. He also accessed the CEO’s email account, forwarding confidential emails to others and composing and sending a further fictitious email to a public distribution list. On top of that he was able to steal passwords from other employees and access the company network. It ended up costing BSAS $80,000 for audits and better security.

Incidents like this happen more often than we like to think. Every company has their share of disgruntled employees, both current and former. These things can be avoided though by having your IT organization spend a little more time on detail. Rogue IT staffers such as this can be stopped and should be stopped before being able to perpetrate such attacks. The retort is usually, “well we can’t monitor everything.” While that may true, a little more due diligence can save you money and embarrassment in the long run. In BSAS’s case, how was Powell able to gain access to employees’ passwords? Was he granted that access because of his position? Should he have had lower level clearance? Maybe there was a weak control in place somewhere that made this access possible. If that is the case, perhaps an internal audit may be necessary. These are all questions that can be answered, leading to improvements in your IT information security. Obviously though the idea is to proactively prevent them and not get stuck in firefighting mode. Bottom line: don’t gloss over the minor details in your IT organization or be prepared for bigger, potentially more embarrassing problems down the line.