BeyondTrust

Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

How Much is Goldman’s Code Worth?

Posted December 6, 2010    Peter McCalister

The trial of a former Goldman Sachs programmer accused of stealing source code to take to a competitor has begun in somewhat of a public spectacle. The Wall Street Journal unveiled some particularly interesting details. For example, the programmer was one of the highest paid in the company with a $400,000 annual salary, but competitor Teza Technologies offered him over $1 million in total pay including a $700,000 bonus.

Greedy much?

So how does the highest paid programmer of one of the largest investment banks in the world get a nearly three-fold salary hike by a much smaller competitor? Ok, ok, he’s innocent until proven guilty, but if he is guilty, I would bet a good chunk of cash that the $1 million paycheck was the price the company was paying for Goldman’s code.

Here’s the breakdown. He was offered $300,000 in salary, $700,000 in bonus and $150,000 in profit sharing. Here’s my question to you – which portion of his pay do you think was (could be) the bribe and could the programmer have gotten more? How much is Goldman’s source code worth?

Personally I think he was drastically underpaid for the value of the code, but a clean million is plenty to motivate someone to steal data despite the actual value of the stolen property being much higher.  Unfortunately this could be construed as a case of dealing with the symptom instead of the disease.  Had a least privilege solution been instituted then he wouldn’t have had the ability to misuse privilege and accomplish the theft at any price.

Leave a Reply

Additional articles

6

A Quick Look at MS14-068

Posted November 20, 2014    BeyondTrust Research Team

Microsoft recently released an out of band patch for Kerberos.  Taking a look at the Microsoft security bulletin, it seems like there is some kind of issue with Kerberos signatures related to tickets. Further information is available in the Microsoft SRD Blogpost So it looks like there is an issue with PAC signatures.  But what…

Tags:
, , , ,
Password Game Show

Managing Shared Accounts for Privileged Users: 5 Best Practices for Achieving Control and Accountability

Posted November 20, 2014    Scott Lang

How do organizations ensure accountability of shared privileged accounts to meet compliance and security requirements without impacting administrator productivity? Consider these five best practices…

Tags:
, , , , , ,
Triggering MS14-066

Triggering MS14-066

Posted November 17, 2014    BeyondTrust Research Team

Microsoft addressed CVE-2014-6321 this Patch Tuesday, which has been hyped as the next Heartbleed.  This vulnerability (actually at least 2 vulnerabilities) promises remote code execution in applications that use the SChannel Security Service Provider, such as Microsoft Internet Information Services (IIS). The details have been scarce.  Lets fix that. Looking at the bindiff of schannel.dll, we see a…

Tags:
, , , , ,