Could an insider stealing money with malicious code have been spotted?

Sometimes, from the side effects rather than the intent. Spain's INCIBE has published a real case in which an employee introduced malicious code and stole a million euros. Cases like this rely on access the person already has, so prevention lies in process: separation of duties for payments, approval by a second person, code review for changes to financial systems, and prompt removal of access when roles change. Technical signs can still appear: a workstation contacting an unfamiliar outside server, new connections to the payment or ERP system from a machine that never used it, unusual uploads. NetSenX watches devices and connections, never people: it can flag that behaviour on the network, on every plan, but it does not judge intent and does not see what happens inside an application. Investigating a person is a matter for HR and lawyers, and for the works council where one exists.

← All 60 questions on Incident responseAll topics