Who took the cookies?

Who took the cookies from the cookie jar?

Morgan Stanley Leak Poses a Puzzle,” Wall Street Journal, January 7, 2015 C1. Former Morgan Stanley adviser admits he downloaded the data from the account database, but denies posting that data to the web.

Why did Morgan Stanley allow a new adviser to have access to all that data?  How do you prove who posted data stolen from your database online?  It was the North Koreans, right?  Do you monitor who downloads your important data internally in real time. or only after the fact?  How much and how often and why do they need it?  Is that data “tagged” so you can prove who filched it?  Do you monitor sites where that data might show up for sale?  Target and Morgan Stanley did.  Did someone else target him for a hack?

How do you explain this to your customers, much less the Feds?

Leave a comment

Filed under Business Case, Controls, Internal controls, IT, Oversight, Oversight, Protect assets, Protect information assets, Risk, Security, Third parties

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s