Add a simple, but telling, illustration to the volumes of analysis that is being written about Société Générale's $7 billion trading scandal. Two risk management firms, armed with 20/20 hindsight, offer an interesting take on the Jerome Kerviel saga, identifying six red flags that went unnoticed by company officials.
The companies, SailPoint Technologies and Enterprise Management Associates, created a timeline depicting Kerviel's actions, and the alleged internal control failures that followed. The experts who created the timeline point to identity and access data risks as the culprits, which makes sense because Sailpoint offers fixes to those problems. EMA is an IT industry research and consulting firm.
Nevertheless, if the timeline is correct, the warnings signals that SocGen's missed point to a breakdown in seemingly rudimentary internal controls. For example, after switching jobs within SocGen, Kerviel retained access to systems that he no longer needed; trading system user names and passwords were easily compromised; and user activity logs were not monitored.
Perhaps pulling off the biggest trading scam in history was relatively simple. Which makes me think that I should stop complaining about my company's IT security protocol of changing passwords at regular intervals. It's the least I can do to thwart a billion dollar scandal.
|
Video
){kind=link}