Threats and Vulnerabilities: Payroll Problems The problem in the payroll department last year may be due to a process that is flawed or by an employee who did not follow the process. The Sr. VP Dale Connor is attempting to bring to Jacket-X an atmosphere were security is an important part of every job at the company. He also realizes this is new thinking for Jacket-X and it will take the employees some time to adapt to the new culture. The need for cyber security is greater now than ever. In 2011, The Ponemon Institute published the Second Annual Cost of Cyber Crime Study. In the study, the institute reports that the median cost of cybercrime in a survey of 50 organizations was $5.9 million annually. Jill Peters is the VP of Human Resources and the payroll function falls in her sphere of responsibility. Jill knows the payroll function but is not a fan of the automation that IT can provide to her department. Jill feels that security can hamper the productivity of her department. The need for security that Dale is trying to foster does not seem to have a champion in Jill. The fact that Jill feels that she and Dale have a good dialogue is encouraging but security will be a hard sell to Jill. The payroll function occurs on the company intranet and the intranet has connectivity with the internet. Cybercriminals may be able to find a way into the company payroll and divert money from the employees into their own pockets. Jacket-X may not have the security in place to repel an attack on their intranet. In 2009, the Giant grocery store chain had their payroll corrupted by a cyber- attack. PayChoice is the company that handles Giant’s payroll and their network was hacked. Several of PayChoice’s customers had their payroll files manipulated to include Giant (Krebs, 2009). The problems that PayChoice experienced could happen at Jacket-X due to poor practices and processes that do not follow best security practices. The payroll process consists of eight different steps that have distinct purposes. The steps can be rather clumsy and do not adequately serve the purpose of making the payroll process more reliable and less confusing. Table 1.1 below defines the eight steps and the multiple sub-steps in the payroll process and the potential issues with each step in the process.

Eight Steps of the Payroll Process Potential Issues with the Process 1. Payroll specialists and administrators can add employees to payroll Employees complete timecards Supervisors enter attendance details into system from timecards Supervisors may view timecards for all employees assigned and not assigned to them Supervisors can alter time card and an audit trail is created Supervisors can enter leave for an absence


Bogus employees get added to payroll master file


False timecards can be created


Payroll specialists can alter payroll details in the validation phase


Payroll administrators can create falsified checks


Specialists and administrators can access management metrics that they should not be allowed to

on a particular day, the timecard must flag employee as absent 2. Payroll specialists and administrators can add independent contractors to the payroll once verified by human resources in the system process Payroll specialists merge independent contractors payroll data to the server through a software process that prevents direct modification Payroll specialists validate payroll data within the system Payroll specialists follow up errors in payroll data and rectify it


False timecards can be created


Bogus employees get added to the payroll master file


Payroll administrators can delete payrolls that are important for audit requirements


Payroll administrators can create falsified checks
3. Payroll specialists validate time entries through a system process which flags any irregular entries Payroll specialists refer any errors back to supervisors who correct the entries in the system and notify the payroll specialist


Payroll administrators can delete payrolls that are important for audits


Payroll administrators can create falsified checks


Paycheck generation records are not being stored for audit purposes


Specialists and administrators can access management metrics that they should not be allowed to


Employee wages can be redirected to other accounts
4. Post-validation the payroll administrator runs the payroll generation process The administrator can roll back generated payrolls Deleted payrolls are not recorded as part of the audit trail Payroll generation payments that do not process at the employee or organization


Payroll administrators can create falsified checks


Paycheck generation records are not being stored for audit purposes


Payroll administrators can delete payrolls that are important for audit requirements


Payroll administrators can divert payments that do not process properly level are automatically transferred to the suspended account. Further action on the payment is subject to non-payroll executive approval in the system


Payroll specialists can alter in-house payroll data
5. The payroll administrator runs a paycheck generation process The administrator validates the generated checks, voids checks with errors, and nulls them in the system E-mail based alerts are sent to management whenever the system generates paychecks


Specialists and administrators can access management metrics that they should not


Payroll administrators can generate falsified checks


Export Excel files can be viewed and data stolen


Paycheck generation records are not being stored for audit purposes


Bogus independent contractors can be created on the payroll master file
6. Payroll specialists and administrators can generate reports Reports can be exported as Excel files with open viewing and editing privileges Management has access to report generation processes Managers can generate reports according to privileges


Exported Excel files can be viewed and data stolen


Specialists and administrators can access management metrics that they should not


Employees can be assigned leave without their consent


Payroll administrators can create falsified checks


Paycheck generation records are not being stored for audits
7. Payroll specialists and administrators can generate federal and state government reports Finance personnel must approve or review reports before they can be issued to the IRS Reports can be exported as Excel files but these reports are locked with passwords set by the recipient


Payments can be issued twice through direct deposit and paycheck


Bogus independent contractors can be created on the payroll master file


Payroll administrators can divert payments that do not process correctly


Exported Excel files can be viewed and data stolen

 Employee wages can be redirected to other accounts
8. Payroll administrators authorize direct deposits to employee accounts Administrators can enter employee account details. Entries are verified by reports to the employee Employee accounts cannot be edited without employee involvement Direct deposit and paycheck generation systems are not directly linked


Payroll administrators can create falsified checks


Paycheck generation records are not being stored for audits


Payroll administrators can divert payments that do not process correctly


Payments can be issued twice through direct deposit and check generation


Employee wages can be diverted to other accounts
Table 1.1 Eight Steps of the Payroll Process and Potential Issues with each Step
Dale and Jill often have differing opinions on the importance of the processes reviewed in the table. The processes are lock stepped and must be done in order to fully and accurately process a pay roll run. The fact that there have been issues in the past should compel the leadership to review the payroll processes and how to best use technology to improve the process. Threats and Vulnerabilities: Bringing Trouble Home from Abroad Steve, VP of sales, would be one of the least you would expect of a serious breach of network security. Steve traveled outside of the United States on a business trip taking his company laptop with him. Steve used his laptop to connect to a cybercafé to perform personal business and corporate business as well. The activity Steve participated in is dangerous in several ways. In February of 2013, a worm known as Dexter began causing problems for the on-line payment industry. The worm directly communicates with the command and control server

delivering information ranging from cardholders names, card numbers, and addresses. The use of cybercafés for commercial or financial transaction is dangerous because there is no way of knowing if the connection is monitored or by whom (Shetty, 2013) The possibility of acquiring malware is greater from an environment like a cybercafé. These cafes operate with the minimal or non-existent security and there are possibilities of physical security issues as well. Even in industrially developed countries, theft of personal computer is a danger. There is no mention if the hard drive on Steve’s computer was encrypted. Using a worst-case scenario, any proprietary corporate or customer information stored on the computer is accessible by the thief. Steve did not stop there. He loaned the laptop to his son after returning from his trip. There is no description of what the son did with the laptop so everything regarding the topic from this point is conjecture. McAfee conducted a survey of the most visited web sites by American 13-17 year old teenagers. As demonstrated below the top two sites are social networking sites. These sites are well-known delivery vehicles for malware of many types.

Steve did not follow company policy regarding connecting to the company network. Policy dictated that Steve have his laptop scanned for malicious software before inserting it into the network. By not following policy, Steve placed the company network at risk