[{"innerBlocks":[],"name":"core\/freeform","postId":126067,"blockType":{"name":"core\/freeform","keywords":[],"attributes":{"content":{"type":"string","source":"raw"},"lock":{"type":"object"}},"providesContext":[],"usesContext":[],"selectors":[],"supports":{"className":false,"customClassName":false,"reusable":false},"styles":[],"variations":[],"apiVersion":3,"title":"Classic","description":"Use the classic WordPress editor.","category":"text"},"originalContent":"Companies spend a lot of time talking about staff retention, when perhaps they should be equally concerned about data retention. Most employers would be surprised to learn that departing internal employees can pose a much bigger threat to their business\u2019s data security than external hackers.

Alarmingly, 87 percent of employees who leave a job take with them data they created at that job, and 28 percent take data that others had created, according to a <\/a>survey from Biscom<\/a>. Eighty-eight percent take corporate presentations or strategy documents, 31 percent take customer lists and 25 percent take intellectual property. A survey by Osterman Research<\/u> also found one in five ex-staffers uploads these sensitive and confidential files to an external cloud service specifically for the purpose of sharing them with others.

The former employees\u2019 motivations range from simply wanting to keep a copy of their work to wanting to use the data destructively, or to gain a competitive or financial advantage. Earlier this year, for example, Tesla reported<\/a> that an ex-employee stole gigabytes of data and shared some of it with various news outlets, causing Tesla to suffer losses in business and profits, as well as damage to its reputation.

The hard reality is that the majority of your departing employees will try to take company data with them, but there are<\/i> proactive steps companies can take to ensure their data is safe after the staffers leave.

Know your data<\/b>
You can\u2019t protect what you don\u2019t know you have. So, the first step is to perform a detailed inventory of your organization\u2019s data and where it\u2019s stored. This involves a thorough audit of the files within your company, which may include in-depth questionnaires for every employee or department. The end result should be a data \u201cmap\u201d that details where all of your data is kept, who has access to which files, and when those files were created and modified.

Secure your data<\/b>
Once you\u2019ve completed an inventory of your company\u2019s data, take a multi-layered approach to locking it down. This can be achieved by:Revising employee contracts to include legally binding confidentiality clauses about sensitive and trade-secret data. <\/li>
Restricting current employees\u2019 access to vulnerable data so they can see only what\u2019s needed to perform their defined duties. <\/li>
Requiring two-factor authentication for sensitive files.<\/li>
Using an encryption platform to increase file security. (The average cost of fully encrypting data may seem high at $235 per computer, but the average amount lost due to data exposure is $4,650 per device, according to the Ponemon Institute<\/a>.)<\/li>
Configuring laptops and mobile devices to ensure you have the ability to remotely wipe every device that may contain company data.<\/li>
Introducing policies to frequently reinforce to employees that data belongs to the company and that their use of company equipment and files may be monitored. <\/li><\/ul>
Have a final-day checklist <\/b>
When an employee resigns or is let go, company managers should take responsibility for always ticking off this checklist on the last day of employment:
Remind the employee of the agreement they signed in their employment contract regarding sensitive and confidential information. <\/li>
Gauge the risk of a data leak by asking the employee about their future plans and employment. <\/li>
Retrieve the staff member\u2019s company-supplied devices, including computers, phones, external hard drives, backup discs and thumb drives.<\/li>
Make forensic copies (see below) then clean up or completely wipe any personal devices that had access to company-related files.<\/li>
Disable the employee\u2019s access to all networks and systems, cloud and CRM platforms, and phones and voicemail.<\/li>
Retrieve keys and tags for building and parking access, as well as any company credit cards. <\/li><\/ul>
4. Go forensic<\/b>
In case you later suspect a former employee has stolen data, your company will benefit from having forensic copies of their devices so you can look for suspicious activity such as:File transfers involving a large volume of confidential material being moved to another device or cloud account. <\/li>
A significant increase in outbound emails.<\/li>
Proprietary files residing locally (a downloaded customer list from your CRM, for example).<\/li>
Unusual after-hours, weekend or holiday activity.<\/li>
Software that was recently added or deleted, or upgraded or downgraded.<\/li><\/ul>
So, before reissuing the ex-staffer\u2019s computer, tablet or phone to another employee, ensure that a forensically sound copy of the device\u2019s hard drive has been made. Taking this step will significantly improve your company\u2019s ability to prosecute any IP theft in the future, but it\u2019s important that it be done only by licensed, certified personnel or by an external vendor. The process is called \u201cimaging\u201d because it makes a \u201cbit-for-bit copy\u201d of the entire device\u2019s storage to minimize the risk of spoliation or unintentionally compromising the files.

Imaging goes far beyond what an ordinary IT backup can do. The process not only copies active files, but also deleted files and fragmented files, log files and other activity records, and it preserves unallocated space on the drive \u2013 all while maintaining metadata information.

A write-only hardware device called a write-blocker should be used to safely acquire information from the hard drive, and imaging should include hash-verification and logging of encrypted and password-protected files. The procedure should be completed on all of a departing employee\u2019s devices and platforms including emails, application files, databases and cloud locations plus internet browsers, social media, messaging apps, games and more.

Depending on your needs, your forensic team may be able to retrieve deleted files, recover temporary files that were copied to another storage device and even expose hidden data. If you have serious concerns about an employee and want a snapshot of the organization at the time of their departure, you may also want to consider removing server backup tapes from rotation so they are not overwritten.

Confront data thieves<\/b>
Regardless of a former employee\u2019s motives for removing data from your business, if you confront them with evidence of the file-copying, many times they will simply delete or return the files to settle the matter without the need for further action. But if the situation escalates and requires litigation, you\u2019ll want your forensic team to be affiliated with an eDiscovery company so they\u2019ll be able to easily facilitate the entire process of collecting, analyzing and reviewing data to support your case.

Invest in cybersecurity<\/b>
When you have the peace of mind from knowing that a departing employee hasn\u2019t taken data with them, or the evidence to confront them if they have, you\u2019ll be glad you invested in the data security and forensic measures described above. Remember, though, that your investment is only truly worthwhile if teamed with the appropriate staff training, policies and procedures.

It makes good sense to protect your organization\u2019s data, and almost nine in 10 companies plan to increase cybersecurity spending<\/a> this year, according to the 2018 Thales Data Security Report. Many of those businesses, however, will spend their money trying only to fight off external hackers, while failing to adequately protect themselves from the threats within. After all, who knows your company\u2019s data better than its employees?","saveContent":"Companies spend a lot of time talking about staff retention, when perhaps they should be equally concerned about data retention. Most employers would be surprised to learn that departing internal employees can pose a much bigger threat to their business\u2019s data security than external hackers.

Alarmingly, 87 percent of employees who leave a job take with them data they created at that job, and 28 percent take data that others had created, according to a <\/a>survey from Biscom<\/a>. Eighty-eight percent take corporate presentations or strategy documents, 31 percent take customer lists and 25 percent take intellectual property. A survey by Osterman Research<\/u> also found one in five ex-staffers uploads these sensitive and confidential files to an external cloud service specifically for the purpose of sharing them with others.

The former employees\u2019 motivations range from simply wanting to keep a copy of their work to wanting to use the data destructively, or to gain a competitive or financial advantage. Earlier this year, for example, Tesla reported<\/a> that an ex-employee stole gigabytes of data and shared some of it with various news outlets, causing Tesla to suffer losses in business and profits, as well as damage to its reputation.

The hard reality is that the majority of your departing employees will try to take company data with them, but there are<\/i> proactive steps companies can take to ensure their data is safe after the staffers leave.

Know your data<\/b>
You can\u2019t protect what you don\u2019t know you have. So, the first step is to perform a detailed inventory of your organization\u2019s data and where it\u2019s stored. This involves a thorough audit of the files within your company, which may include in-depth questionnaires for every employee or department. The end result should be a data \u201cmap\u201d that details where all of your data is kept, who has access to which files, and when those files were created and modified.

Secure your data<\/b>
Once you\u2019ve completed an inventory of your company\u2019s data, take a multi-layered approach to locking it down. This can be achieved by:Revising employee contracts to include legally binding confidentiality clauses about sensitive and trade-secret data. <\/li>
Restricting current employees\u2019 access to vulnerable data so they can see only what\u2019s needed to perform their defined duties. <\/li>
Requiring two-factor authentication for sensitive files.<\/li>
Using an encryption platform to increase file security. (The average cost of fully encrypting data may seem high at $235 per computer, but the average amount lost due to data exposure is $4,650 per device, according to the Ponemon Institute<\/a>.)<\/li>
Configuring laptops and mobile devices to ensure you have the ability to remotely wipe every device that may contain company data.<\/li>
Introducing policies to frequently reinforce to employees that data belongs to the company and that their use of company equipment and files may be monitored. <\/li><\/ul>
Have a final-day checklist <\/b>
When an employee resigns or is let go, company managers should take responsibility for always ticking off this checklist on the last day of employment:
Remind the employee of the agreement they signed in their employment contract regarding sensitive and confidential information. <\/li>
Gauge the risk of a data leak by asking the employee about their future plans and employment. <\/li>
Retrieve the staff member\u2019s company-supplied devices, including computers, phones, external hard drives, backup discs and thumb drives.<\/li>
Make forensic copies (see below) then clean up or completely wipe any personal devices that had access to company-related files.<\/li>
Disable the employee\u2019s access to all networks and systems, cloud and CRM platforms, and phones and voicemail.<\/li>
Retrieve keys and tags for building and parking access, as well as any company credit cards. <\/li><\/ul>
4. Go forensic<\/b>
In case you later suspect a former employee has stolen data, your company will benefit from having forensic copies of their devices so you can look for suspicious activity such as:File transfers involving a large volume of confidential material being moved to another device or cloud account. <\/li>
A significant increase in outbound emails.<\/li>
Proprietary files residing locally (a downloaded customer list from your CRM, for example).<\/li>
Unusual after-hours, weekend or holiday activity.<\/li>
Software that was recently added or deleted, or upgraded or downgraded.<\/li><\/ul>
So, before reissuing the ex-staffer\u2019s computer, tablet or phone to another employee, ensure that a forensically sound copy of the device\u2019s hard drive has been made. Taking this step will significantly improve your company\u2019s ability to prosecute any IP theft in the future, but it\u2019s important that it be done only by licensed, certified personnel or by an external vendor. The process is called \u201cimaging\u201d because it makes a \u201cbit-for-bit copy\u201d of the entire device\u2019s storage to minimize the risk of spoliation or unintentionally compromising the files.

Imaging goes far beyond what an ordinary IT backup can do. The process not only copies active files, but also deleted files and fragmented files, log files and other activity records, and it preserves unallocated space on the drive \u2013 all while maintaining metadata information.

A write-only hardware device called a write-blocker should be used to safely acquire information from the hard drive, and imaging should include hash-verification and logging of encrypted and password-protected files. The procedure should be completed on all of a departing employee\u2019s devices and platforms including emails, application files, databases and cloud locations plus internet browsers, social media, messaging apps, games and more.

Depending on your needs, your forensic team may be able to retrieve deleted files, recover temporary files that were copied to another storage device and even expose hidden data. If you have serious concerns about an employee and want a snapshot of the organization at the time of their departure, you may also want to consider removing server backup tapes from rotation so they are not overwritten.

Confront data thieves<\/b>
Regardless of a former employee\u2019s motives for removing data from your business, if you confront them with evidence of the file-copying, many times they will simply delete or return the files to settle the matter without the need for further action. But if the situation escalates and requires litigation, you\u2019ll want your forensic team to be affiliated with an eDiscovery company so they\u2019ll be able to easily facilitate the entire process of collecting, analyzing and reviewing data to support your case.

Invest in cybersecurity<\/b>
When you have the peace of mind from knowing that a departing employee hasn\u2019t taken data with them, or the evidence to confront them if they have, you\u2019ll be glad you invested in the data security and forensic measures described above. Remember, though, that your investment is only truly worthwhile if teamed with the appropriate staff training, policies and procedures.

It makes good sense to protect your organization\u2019s data, and almost nine in 10 companies plan to increase cybersecurity spending<\/a> this year, according to the 2018 Thales Data Security Report. Many of those businesses, however, will spend their money trying only to fight off external hackers, while failing to adequately protect themselves from the threats within. After all, who knows your company\u2019s data better than its employees?","order":0,"get_parent":{},"attributes":[],"attributesType":{"content":{"type":"string","source":"raw"},"lock":{"type":"object"}},"dynamicContent":""}]

Tips for protecting your data when losing an employee

More for you