Computers Aren't as Devious, or Smart, as Us
On Thursday, January 24, a leading French Bank announced that it had uncovered $7.2 billion in losses that officials attributed to the actions of a 31-year-old "rogue trader." The trader, named Jérôme Kerviel, had "managed to evade multiple layers of computer controls and audits for as long as a year, stacking up 4.9 billion euros in losses for the bank," The New York Times reported.
Print
Executives called Kerviel's actions "pure fraud." The loss is believed to be the biggest in history by a trader. Société Générale executives said that Kerviel had an "intimate and perverse" knowledge of the bank's auditing capabilities and back-office operations that enabled him to cover up his unauthorized trades. A French banking governor commented that Kerviel was a "computer genius" and had been able to breach "five levels of controls" at the bank.
Of course, the most pressing and interesting questions—how was he able to evade any detection by other employees or Société Générale's trading and auditing systems? if there were controls in place, how is it possible he could have done it alone, as the bank claims? and why did it take the bank so long to discover the fraud?—remain unanswered right now.
Christophe Mianné, the newly installed head of global equities and derivatives at Société Générale, told Risk magazine on Thursday that Kerviel "was very clever, but that's not an excuse, because we have to be more clever." He also notes that Société Générale executives are still "puzzled" by Kerviel's deceit. "We are almost 100 percent sure he didn't benefit [financially] at all," Mianné says.
For those in the financial services industry, this latest incident draws comparisons to the 1995 case in which Nick Leeson, a Singapore-based trader, ran up $1.4 billion in losses on more than $27 billion bad bets in the Japanese financial markets.
For what it's worth, Société Générale is no Mom-and-Pop bank. It's a highly respected institution that was founded in 1864 and has 120,000 employees and 22.5 million customers. Which makes the incident even more vexing and reprehensible: Where was the oversight? Where were the checks and balances? Where were the risk controls?
But it's not just the financial services industry that has had info-security and risk management problems (though with trillions of dollars in play every day, it's bound to bring out the best and brightest crooks). It seems that in today's interconnected world, it doesn't matter if the culprit is on the inside or outside, or if a company has the minimum or maximum level of controls—people are too devious and too clever and too resourceful, and they will always find ways to outsmart their computing counterparts.
To put together a short list of recent examples in which all types of corporate controls were lacking isn't that difficult to assemble: TJX's customer data breach, which ranks as the largest ever; HP's spying and pretexting scandal; a Transportation Security Administration hard drive containing 100,000 names, Social Security numbers, dates of birth and bank account data of current and former employees (including federal air marshals) that was stolen; a vengeful Florida woman intentionally deleting $2.5 million worth of files off her company’s computer server.
I could go on. I won't. The point is that where there's a will, there's a way, and not even the most ardent, expensive and well-thought-out info-security systems, auditing controls or encryption schemes can stop dangerous and highly capable minds.
Bruce Schneier, a cryptography and security expert, writes
Previous Post: What Are the Best IT Urban Legends You Have Heard?Next Post: Bill Gates and I Both Say No to Facebook
Most Discussed Posts
Cloud computing has emerged as one of the most significant game changers to hit the technology landscape in the past 20 years. With this massive expansion of the cloud, the perception of the IT organization is shifting from a utility player to a change agent. This eBook breaks down five ways progressive organizations are using cloud-based IT Management solutions to help drive innovation and become more strategic, including: adding visibility and analytics, speeding up time-to-value, lowering costs, improving prioritization, and providing a blueprint for future cloud deployments.
Read the white paper to see how IBM helped Citigroup deliver new services and enhancements to their 200 million customers faster.
There are 3 ways to modernize legacy applications: rewrite completely, acquire packaged solutions or migrate existing code. This paper explains why it's best to migrate and how IBM® Rational® software can help.
Accommodating specific lines of business can result in a hybrid ecosystem of applications and servers. The resulting complexity of this architecture makes for an environment that is costly to maintain and difficult to change when addressing new challenges.
This whitepaper will help you to define a mobile device passcode policy. Security managers must attempt to reconcile two opposing goals. They must: 1) create a passcode policy that is strong enough to protect the device if it is lost or stolen, while: 2) not annoying users with needless length or complexity.
This whitepaper, authored by The Radicati Group, looks at the key reasons organizations should consider moving to a cloud-based archiving solution. Email archiving solutions enable organizations to store, monitor, and collect electronic data exchanged by their users to comply with internal policies and regulations.
ATERNITY will showcase a 30-minute demo on how Fortune 500 companies are leveraging its award-winning FPI Platform to deliver a user-centric approach to Proactive IT Management.
For businesses to move forward and tap into the ever-expanding universe of Internet users and network-enabled devices, it's critical to learn how to make the transition to IPv6. Learn the critical steps your organization must take to make a seamless transition-and keep your business world connected.
Learn how IT teams can protect against spear phishing tactics. Harry Sverdlove, chief technology officer of Bit9 offers a frank discussion about spear phishing - the most common technique used in today's advanced attacks.
Learn how to build a solid business case for your migration to Red Hat Enterprise Linux so you can run leaner, innovate faster, be more flexible and own the New Now.
Social media isn't about you; it's about everything around you. As you consider how your customers want to communicate with you, social media is something that can't be ignored. But what should your strategy be? Is social media "just another channel?" What kind of a plan makes sense for your contact center and for your customers? Join our experts as they share their insight and research results.
Hardware tokens were a popular method of strong authentication in past years but the cumbersome provisioning and distribution tasks, high support requirements and replacement costs have limited their growth. The additional log-in steps that hardware tokens require and the resulting user frustrations have limited adoption and make them impractical for larger scale partner and customer applications.
Sponsored Links
