Could Your Employees Be Leaking Your Business Secrets?

Tim (0:00)

This is the Morning Drive, the arrest of Germany's former intelligence chief, August Hanning, over allegations involving classified documents has sent shockwaves through the security world. And it's a stark reminder that the biggest threat to confidential data isn't always a sophisticated cyberattack. It often is, but it isn't always. Often, it's internal leaks and human error. So how can businesses protect their trade secrets, safeguard sensitive data, and stop information slipping into the wrong hands? Ayman Gomaa is telecommunications and cyber security expert. He's the founder and CEO of Acacia Innovations Technology. Joins us this morning. Ayman, welcome to the show.

Ayman Gomaa (0:48)

Good morning, Tim, how are you?

Tim (0:49)

Good, thank you. Good to have you with us. Can we set the stage? The story that this kind of stems from is a super high-profile case. It involves Germany's former intelligence chief.

I'll just run through the backgrounds of this quickly. This is an heiress in Germany, Christina Block. She's on trial for hiring a security team to kidnap her children from her ex-husband in Denmark. There's a fierce custody battle.

She denies involvement, claiming the security team acted on its own. So while investigating an earlier attempt to retrieve the children, police raided the home of August Hanning, Germany's former intelligence chief, who had helped to arrange the heiress' security. During the search, investigators accidentally uncovered thousands of leaked classified documents. That's essentially the story. But why should everyday business leaders be paying attention to a story like this, Ayman?

Ayman Gomaa (1:55)

Tim, that's a really good question. When you look at people from the end, usually companies or businesses or any organization deals with a lot of information, they put a lot of firewalls, they put a lot of cybersecurity methods to protect their company. But rarely do you look at the inside. And in this case, the biggest risk was not a hacker, was not somebody from the outside. Basically, it was somebody from the inside who has access.

Looking at this case in particular, people looked, obviously people never expected this is to be coming from the head of the intelligence. But it seemed like he, it's an allegation, so we cannot say this is for sure.

It's confirmed or not that obviously all the indications shows this actually happened.

Looking at companies from the inside, a lot of business leaders don't look at their own employees, don't assess what kind of access their employees have, and don't even assess. A lot of employees not doing it intentionally. A lot of employees will be doing it like people post things on LinkedIn. People post things on Facebook, they are on vacation, they move in, they got promoted. People are proud of what they do, and they post this information online. And you can look at it as a puzzle. You take all of these small pieces, you put it together, and you can put the large picture. But again, businesses don't see it from that perspective. They usually hire a lot of security firms, they do red teaming, they do ethical hacking to see if they can be hacked or not, not seeing actually what leaks can be done from the inside.

Tim (3:45)

I mean, that's the thing, isn't it? You spend billions on firewalls, antivirus, software, whatever. But when we talk about information leaks, it's often individuals who already have access, they have authorized access, and they pose a far greater risk, I guess, in many cases than external hackers.

Ayman Gomaa (4:05)

True. Again, they look at, can we protect ourselves from the outside? It's like you are in a house, and you put a really good lock on the door in your house, you might even put an alarm system, you put cameras, you put a dog, but you're not looking at who else have access to the alarm system keypad.

It could be the person who installed the alarm system for you. It could be somebody inside your house. It could be a maid. And if you look at that, if you take this analogy and you apply it to your company, it could be somebody in your company. It could be, you know what?

The cleaners. They might have access to your office. You might have paperwork played around. It could be an employee that you decided or you thought, or he thought, or she thought, that you're going to fire them. They start gathering information. And we did actually work in a case similar to this a few years ago, where a big telecom company purchased a small telecom company. And obviously the big company started firing a lot of employees. And a lot of employees, as soon as they knew there was an acquisition, a merger and acquisition happening, the employees of the small company felt they were at risk. So they started gathering information that they can sell, they can blackmail, they can use. So again, a lot of companies look at, or business leaders look at, can I be hacked?