Financial Break-in

SCENARIO: A routine financial audit reveals that several people receiving paychecks are not, and have never been, on the payroll. A system review indicates they were added to the payroll approximately one month prior, at the same time, via a computer in the financial department. What is your response? INJECT: You confirm the computer in the payroll department was used to make the additions. Approximately two weeks prior to the addition of the new personnel, there was a physical break-in to the finance department in which several laptops without sensitive data were taken. OPTIONAL INJECT: Further review indicates that all employees are paying a new “fee” of $20 each paycheck and that money is being siphoned to an off-shore bank account. Having this additional information, how do you proceed? Discussion questions • What actions could you take after the initial break-in? • Do you have the capability to audit your physical security system? • Who would/should be notified? • Would you able to assess the damages associated with the break-in? • Would you be able to find out what credentials may have been stored on the laptop? • How would you notify your employees of the incident? • How do you contain the incident? o Optional Inject question: How do you compensate the employees?

RECOMMENDED: [SOLVED] Financial Break-in