Is employee data theft on the rise? I saw this blog post on the subject, but I had to take it with a grain of salt. The author works for a security software vendor, and even mentions they have software linked in the sidebar. As much as I think there are employees that steal and sell data, I don't think it's a huge problem.

Most people are fundamentally honest and I think many of them would never think of stealing data from their employees. A few pencils, a monitor, maybe some equipment, but I doubt many people even know or want to look for a place to sell a price list or a customer list.

And while I'm sure that some companies might approach an employee, I think that relatively few people are so down and out that they'd sell a list for a few thousand dollars knowing that they might face time in jail for the offense.

The problem is that there are a few people in every hundred, or hopefully thousand, that would steal data. What do you do about them? I think that a sound fundamental security plan, using built in tools, along with a well thought out auditing solution is your best defense.

Keep track of who gets large lists of data, especially on reports, and perhaps track the first time someone runs a new report. That might be a good sign that someone is investigating areas that they have no business being in.

In SQL Server, I might also try and prevent large data sets from being returned. Too often I see people trying to build reports or some other data delivery mechanism using thousands of rows. And rarely do I see anyone trying to help the person question that flood of data. Most people can't deal with more than a hundred rows of data. They might want to be able to drill into details, but in that case, have them run another report. Better targeting your reports to limit the data returned is probably your best bet in terms of preventing data theft.

Every hurdle you throw in someone's way makes them question the value of stealing the data.

Now if you have something worth millions of dollars, especially data, make sure you do protect it well and limit the access.