Offboarding employees presents serious data security risks: 70% of intellectual property theft occurs within the 90 days before an employee’s resignation announcement.
Are you concerned about the damage a terminated employee could cause with access to your sensitive corporate information, account passwords, and other proprietary data? Follow these 5 data security tips to protect your sensitive data against insider threats when offboarding employees.
FREE WHITE PAPER
How to Keep Data Safe
When Offboarding Employees
Concerned about the damage a terminated employee could cause with access to sensitive corporate information, account passwords, and other data?
Click the button down below to learn the best practices for managing insider threat risks & gain access to a checklist of key items you must include in your offboarding process.
The greatest risk is the theft or loss of sensitive corporate data. Disgruntled employees have a higher motivation to steal sensitive data and sell it to competitors or threat actors. The personally identifiable information (PII) of customers can readily fall into the wrong hands following a less than amicable termination.
The risks of data theft are pervasive throughout an organization, particularly for roles with elevated privileges. A survey by security firm Cyber-Ark found that 88% of IT workers would take sensitive data with them if they were fired and 72% of CEOs in a Code42 report admit they’ve taken valuable intellectual property (IP) from a former employer.
A formal offboarding process is critical for protecting sensitive data. An Intermedia study found that 89% of employees were able to access sensitive corporate applications well after their departure. Without a formal deprovisioning process these accounts can be readily abused, leading to a costly data breach. Despite these risks only 29% of organizations have a formal offboarding process.
The data types that are most likely to be targeted for theft are those with significant financial value. The 2019 Verizon Data Breach Investigations Report found that 71% of data breaches are motivated by money and only 25% of breaches are motivated by espionage or attempts to gain a strategic advantage.
The most valuable categories of data are confidential data such as trade secrets that can be sold to competitors or personal information that can be used for identity theft.
The offboarding process needs to be thoroughly planned. Following an employee offboarding checklist that is tailored to your company ensures that critical data security steps aren’t forgotten or overlooked.
Mitigating risks during termination includes a mix of administrative and technical considerations. When determining the steps that will be included in your offboarding checklist, involve relevant stakeholders from HR, IT, and management to ensure that each component is addressed.
Human resources, direct managers, and IT need to work cooperatively to protect data during termination procedures. Providing IT personnel with advanced notice ensures that they are ready to immediately deprovision access to corporate accounts and monitor employee computer activity for suspicious behavior leading up to the day of the termination.
When the time is appropriate, you should also notify current staff members of the termination. This will not only help prevent rumors, it will ensure that employees do not fall victim to social engineering tactics. Unaware staff may grant the former employee with unauthorized access to company assets.
During the offboarding process you will need to collect all company assets from the employee. Upon departure an accurate inventory will ensure that laptops, computers, USB storage devices, key cards, and other assets are accounted for. This inventory must be consistently maintained so it can be safely relied on to keep track of loaned assets.
The days leading up to the employee’s departure are an opportune time for data theft and other high-risk behavior. The computer usage of departing employees must be closely monitored for suspicious activity.
Monitoring the computer activity of departing employees provides an opportunity to detect instances of attempted data theft before the data is breached. This process can be made less resource intensive by configuring context-sensitive alerts in your data loss prevention and employee monitoring programs.
Deprovisioning is an integral step of employee offboarding. While this step can be done manually, automating the process with an Identity and Access Management (IAM) solution will reduce the time it takes to revoke user privileges and ensure that the employee no longer has access to their former accounts.
Employees that are disgruntled by an upcoming termination pose a significant threat to data security. Their dissatisfaction can motivate them to steal sensitive data and sell it to competitors or threat actors. By carefully managing the offboarding process, auditing employee computer activity, and retaining control over access to sensitive data you can mitigate these offboarding risks.
FREE WHITE PAPER
How to Keep Data Safe
When Offboarding Employees
Concerned about the damage a terminated employee could cause with access to sensitive corporate information, account passwords, and other data?
Click the button down below to learn the best practices for managing insider threat risks & gain access to a checklist of key items you must include in your offboarding process.
Cookie | Duration | Description |
---|---|---|
__cfruid | session | Cloudflare sets this cookie to identify trusted web traffic. |
cookielawinfo-checkbox-advertisement | 1 year | Set by the GDPR Cookie Consent plugin, this cookie is used to record the user consent for the cookies in the "Advertisement" category . |
cookielawinfo-checkbox-analytics | 11 months | This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Analytics". |
cookielawinfo-checkbox-functional | 11 months | The cookie is set by GDPR cookie consent to record the user consent for the cookies in the category "Functional". |
cookielawinfo-checkbox-necessary | 11 months | This cookie is set by GDPR Cookie Consent plugin. The cookies is used to store the user consent for the cookies in the category "Necessary". |
cookielawinfo-checkbox-others | 11 months | This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Other. |
cookielawinfo-checkbox-performance | 11 months | This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Performance". |
JSESSIONID | session | The JSESSIONID cookie is used by New Relic to store a session identifier so that New Relic can monitor session counts for an application. |
LS_CSRF_TOKEN | session | Cloudflare sets this cookie to track users’ activities across multiple websites. It expires once the browser is closed. |
OptanonConsent | 1 year | OneTrust sets this cookie to store details about the site's cookie category and check whether visitors have given or withdrawn consent from the use of each category. |
viewed_cookie_policy | 11 months | The cookie is set by the GDPR Cookie Consent plugin and is used to store whether or not user has consented to the use of cookies. It does not store any personal data. |
Cookie | Duration | Description |
---|---|---|
__cf_bm | 30 minutes | This cookie, set by Cloudflare, is used to support Cloudflare Bot Management. |
_zcsr_tmp | session | Zoho sets this cookie for the login function on the website. |
Cookie | Duration | Description |
---|---|---|
_calendly_session | 21 days | Calendly, a Meeting Schedulers, sets this cookie to allow the meeting scheduler to function within the website and to add events into the visitor’s calendar. |
_gaexp | 2 months 11 days 7 hours 3 minutes | Google Analytics installs this cookie to determine a user's inclusion in an experiment and the expiry of experiments a user has been included in. |
Cookie | Duration | Description |
---|---|---|
_ga | 2 years | The _ga cookie, installed by Google Analytics, calculates visitor, session and campaign data and also keeps track of site usage for the site's analytics report. The cookie stores information anonymously and assigns a randomly generated number to recognize unique visitors. |
_ga_GY6RPLBZG0 | 2 years | This cookie is installed by Google Analytics. |
_gcl_au | 3 months | Provided by Google Tag Manager to experiment advertisement efficiency of websites using their services. |
_gid | 1 day | Installed by Google Analytics, _gid cookie stores information on how visitors use a website, while also creating an analytics report of the website's performance. Some of the data that are collected include the number of visitors, their source, and the pages they visit anonymously. |
CONSENT | 2 years | YouTube sets this cookie via embedded youtube-videos and registers anonymous statistical data. |
Cookie | Duration | Description |
---|---|---|
_opt_expid | past | Set by Google Analytics, this cookie is created when running a redirect experiment. It stores the experiment ID, the variant ID and the referrer to the page that is being redirected. |
IDE | 1 year 24 days | Google DoubleClick IDE cookies are used to store information about how the user uses the website to present them with relevant ads and according to the user profile. |
NID | 6 months | NID cookie, set by Google, is used for advertising purposes; to limit the number of times the user sees an ad, to mute unwanted ads, and to measure the effectiveness of ads. |
test_cookie | 15 minutes | The test_cookie is set by doubleclick.net and is used to determine if the user's browser supports cookies. |
VISITOR_INFO1_LIVE | 5 months 27 days | A cookie set by YouTube to measure bandwidth that determines whether the user gets the new or old player interface. |
YSC | session | YSC cookie is set by Youtube and is used to track the views of embedded videos on Youtube pages. |
yt-remote-connected-devices | never | YouTube sets this cookie to store the video preferences of the user using embedded YouTube video. |
yt-remote-device-id | never | YouTube sets this cookie to store the video preferences of the user using embedded YouTube video. |
yt.innertube::nextId | never | This cookie, set by YouTube, registers a unique ID to store data on what videos from YouTube the user has seen. |
yt.innertube::requests | never | This cookie, set by YouTube, registers a unique ID to store data on what videos from YouTube the user has seen. |
Cookie | Duration | Description |
---|---|---|
_dc_gtm_UA-6494714-6 | 1 minute | No description |
_gaexp_rc | past | No description available. |
34f6831605 | session | No description |
383aeadb58 | session | No description available. |
663a60c55d | session | No description available. |
6e4b8efee4 | session | No description available. |
c72887300d | session | No description available. |
cookielawinfo-checkbox-tracking | 1 year | No description |
crmcsr | session | No description available. |
currentware-_zldp | 2 years | No description |
currentware-_zldt | 1 day | No description |
et_pb_ab_view_page_26104 | session | No description |
gaclientid | 1 month | No description |
gclid | 1 month | No description |
handl_ip | 1 month | No description available. |
handl_landing_page | 1 month | No description available. |
handl_original_ref | 1 month | No description available. |
handl_ref | 1 month | No description available. |
handl_ref_domain | 1 month | No description |
handl_url | 1 month | No description available. |
handl_url_base | 1 month | No description |
handlID | 1 month | No description |
HandLtestDomainName | session | No description |
HandLtestDomainNameServer | 1 day | No description |
isiframeenabled | 1 day | No description available. |
m | 2 years | No description available. |
nitroCachedPage | session | No description |
organic_source | 1 month | No description |
organic_source_str | 1 month | No description |
traffic_source | 1 month | No description available. |
uesign | 1 month | No description |
user_agent | 1 month | No description available. |
ZCAMPAIGN_CSRF_TOKEN | session | No description available. |
zld685336000000002056state | 5 minutes | No description |