People steal from their employers if they feel they've been wronged, if they feel unappreciated, and for other reasons that have nothing to do with money. You're right; finances are not the only reason why people commit crimes. In certain cases, like whistleblower scenarios, they may feel it's something they're morally compelled to do. In some, they want to strike back at a company or manager they feel treated them unfairly. People are complicated.

Don't most studies show that data loss is the result of employee mistakes, not employees proactively trying to steal information? Although just one employee stealing vital data would be enough, I'm sure.

@syedzunair,

"there are a lot of dishonest employees who want to gather extra money doing illegal business"

Money may not be the only motivation behind employees' illegal activities in the entreprise. It might as well be carelessness or negligence.

@syedzunair:  I support the right level of security.  For some organizations, simply due to corporate culture security may have to take a different route.  For example, let's say everyone uses BYOD, even though they shouldn't.  The I.T. security team explains the risks, but major players in the organization refuse to play by the rules, making it moot. 

In that case, perhaps the compromise is that BYOD is restricted to those who allow I.T. to install security software onto those devices, or increased monitoring is approved.  If the major players can't compromise though, the organization deserves all the damage it will eventually get down the road.

@smkinoshita: 

True. An organization might not need external media or writable devices if they have a strong network. Still employees could do away with the old fashioned technique of mailing information to themselves. 

I support your idea of using the highest level security. Though I wonder what measures you could take against a dishonest employee.

@Alison:

Piracy and stealing confidential information is an organizations worst nightmare. Like the author says, there are a lot of dishonest employees who want to gather extra money doing illegal business.  

I think it's really a matter of using the right level of security.  There's no point in slowing productivity or morale for the sake of the tightest security possible (and everything can be circumvented anyway with enough planning), but there's also no point in being careless.

I personally don't see the need for external media or writable devices for the regular staff -- not when there's a good network in place, right?

Amazing that this is still such a big problem -- with big results -- years after the WikiLeaks story.