This is certainly the worst case scenario - your security officer installing remote access software on developers machines, stealing bitcoins from production, then selling the company source code, access credentials and access to the internal network to a Russian hacker.<p>Building a security system to handle this level of attack is a whole level beyond stopping even determined external attackers. Are there any best practices guides on this?<p>One thing that the article showed is the importance of external security review to deal with the threat of internal incompetence or evil.