*Picture this: Your IT team locks down all internal devices and networks, your employees perform top-tier data security protocols, and secure file sharing business tactics are baked into the behavior of your company. Though your day-to-day practices are up to snuff, you forget to consider a comprehensive plan for removing access for terminated employees, both internal and contractors.
Unfortunately, employees or contractors leaving with proprietary data is more common than you’d think. According to a 2015 survey from Biscom, 87 percent of employees take data that they created and 28 percent take data that others created. Among that 87 percent of employees, 88 percent took corporate presentations or strategy documents, 31 percent took customer lists, and 25 percent took intellectual property.
What risk does this pose for your organization’s sensitive data? How are you supposed to prepare for this? Let’s explore important signs to look for when employees or contractors may be leaving, significant risks to lost company data, and how to ensure the best file sharing collaboration protocols for your organization.
Signs To Look For When Removing Access for Terminated Employees
While many organizations may recognize that protecting company data from theft after, or even before, an employee or contractor leaves, it can be tricky to know it’s even happening without knowing exactly what to look for. Unless your organization has the proper technology in place to alert you to potential stolen data, it could be happening under your nose without you ever knowing it.
Downloads Increase
Employees and contractors that have access to company materials while they work for your organization may show signs of downloading assets for future personal use before they have even left your organization. In fact, employees who anticipate the end of employment or contractors coming to the end of a project may start heavily downloading materials 30 days prior to leaving. This can include not only the work they have contributed, but also, if they have access to files other than their own, the work of others throughout the company. These are scenarios in which removing access for terminated employees will come too late, and files will already be shared unsafely unless secure file sharing business tactics are applied.
Access Requests
While there are a wide range of signs that your data is under risk of theft from current or former employees, one of the most common is unusual or excessive attempts to access company platforms. This includes excessive attempts to access data management systems or other file storage platforms for which multiple login credential retries have been logged. Removing access for terminated employees is essential in these circumstances, as your file sharing technology will alert you to excessive attempts to access company data.
Unusual File Transfer Load
Former employees or contractors may be made aware that their access to protected company files will be removed after the completion of their work, and with this knowledge, they may not attempt to log in to your secured data management system. They may, however, try to access your data store at strange hours or from strange locations in an effort to remain “unseen” to traffic monitoring. After analyzing your data flows, you may notice that an uncommonly high percent of your network traffic is taking place in the middle of the night from a location in another country, especially if your company contracts with global freelancers. To properly implement the information flow tracker, you need file-level logs even as they are accessed at the end-points and workstations.
Risks of Employee Data Loss
Intellectual Property Loss
Intellectual property is oftentimes the bread and butter of a successful company. Your employees are in valuable IP files daily, and without proper knowledge on the best way to share CAD files, you’re risking irreversible intellectual property loss. Let’s take that one step further and think about employees that leave. If you don’t have a secure procedure for removing access for terminated employees they could be walking away with data that can be sold to your competitor, severely hurting your competitive advantage. Oftentimes, employees think that they are the rightful owners of IP that they helped create, making them think they can take it with them when they leave.
Personal and Sensitive Information Loss
Your human resources department is a hub of private information: Employee reviews, salary information, medical information, and internal complaints. Without proper protection, terminated employees could walk away from the job with personal information of employees, as well as extensive company and client data.
Breaking Compliance Laws
Businesses are held to a rigorous standard when it comes to data security and reporting. Depending on the industry, companies often not only need to comply with security compliance regulations in their own countries, but also the countries within which their clients and supply chains operate. Turnover is a natural part of day-to-day operations for any organization, which is why it’s crucial to have a clear, complete off-boarding policy that is heavily monitored. Companies that fail to comply with governing data security regulations can not only suffer destruction of their reputations, but face serious fines and loss of business licensure.
How to Prevent Data Theft
Be Proactive in Your Policies
Having good cybersecurity and data protection policies baked into your organizational culture is the first step in avoiding data loss. Consider applying policies surrounding personal devices and networks, especially if your employees work remotely. Rather than allowing contractors and remote employees to conduct their work by using personal devices and accounts, provide company resources to ensure data access takes place only through business. While this may appear to be an unnecessary cost, providing laptops and other resources for employees and contractors, the risk of financial loss through unsecured devices can be exponentially greater. Companies are at risk of data theft from employees under even the best of circumstances, by not restricting accounts and devices, you open your organization up to data loss exponentially.
A strategic way to limit file-sharing is by utilizing one of two access controls: role-based or attribute-based access controls. Role-based access control is a security approach that denies or allows access to internal assets based on the user’s respective role within their organization. This means that users only have access to the data that is necessary to their position. Attribute-based access control functions quite differently as it has a much larger number of variable controls. This is an approach to data security that takes the user, as well as object, action, and environmental attributes into consideration. By abiding by either of these control types, you are able to not only assign permissions with the click of a button, but you can revoke them just as easily.
The last major way to proactively avoid data loss due to a terminated employee or contractor is to act on suspicious behavior. As we reviewed earlier, there are signs that might indicate that an employee will be leaving your team. By staying vigilant, and keeping an eye out for these signs, you can stop the damage from happening before it starts.
Steps Toward Data Protection
Data loss is a serious threat to your organization’s reputation and success. Now that you know signs to looks out for and some proactive steps you can take, here are our trusted next steps when it comes to locking past employees out of unauthorized data:
- Change the employee’s password: This is a simple step to ensure that the terminated employee cannot access internal information.
- Remove all access: Easily remove all previous access with one-click, halting their role- or attribute-based access controls.
- Have an equipment recovery plan: It may seem simple, but remembering to collect all company-issued equipment is a way to monitor data security.
- Work with Datanchor to secure your files: Working with a dependable data security, control, monitoring and logging solution is a failsafe way to protect your data from unauthorized past employees.
The post What Do External Collaborators (Subcontractors) Do Once the Project is Over appeared first on Anchor.