UBS Painewebber Code Of Ethics Violations

In March of 2002, the company UBS PaineWebber lost 3.1 million dollars due to intentional computer sabotage by one of its employees. Roger Duronio, a 63-year-old systems administrator was convicted of sabotaging close to 2,000 company servers. Mr. Duronio was due for a salary bonus of $50,000. When the seasoned systems administrator received the bonus, it was $18,000 less than what he expected. Roger was extremely upset about being shortchanged and decided to do something. Roger Duronio retaliated against the company by writing a malicious code. When Duronio completed the coding, a logic bomb was placed in the system to cause significant damage (Gaudin, 2006).

For those who are unfamiliar with a logic bomb, it is a type of malware that

They were not aware that he could shut their whole business operation down completely. The unfortunate thing about the company is that if they would have given Duronio the promised bonus, he was expecting, they would not have lost 3.1 million in the process. Working in the IT field, especially cybersecurity, a strict code of ethics must be understood and practiced by all IT professionals. Money should never be the driving factor when working in an organization like this one because it only leads to prison time if you commit a crime. This individual was sentenced to a little over eight years for the

If management felt that this individual could become a threat, controls to mitigate such threats should have been in place. The problem, in this case, is that the employee quit the job, after sabotaging everything. There was no way to see this coming. Practicing good OPSEC will always mitigate some type of threat and in some cases, eliminated it. This case was very different than most cases because the person was the system administrator. This person already had the highest administrative rights to carry out his work, so how could management mitigate this unique threat if they did not suspect any danger? Knowing employee capabilities is one way because if management knew what Mr. Duronio was capable of, they would have known how to address the threat. In general, some good OPSEC ideas would be to identify what is being protected, what is important information about the item being protected, then protecting that information with encryption, restrict access to that information by using the principle of least privilege and monitor individuals who do have access. Another example would be to not discuss critical information with