According to the U.S. Department of Labor, Bureau of Labor Statistics the unemployment rate in the U.S. is 6.7% – up two (2) percentage points in the past year. In the United Kingdom, the BBC reports that nearly ten (10) million working age people are “not in paid employment. This includes the 1.8m unemployed, plus another 7.9m who are deemed to be ‘economically inactive’.” That is Britain’s highest rate in 11 years. Europe’s largest economy, Germany, is expected to contract by up to 3% in 2009. Japan’s unemployment rate is also on the rise (3.9%) with the number of unemployed estimated to be 2.56 million.
Unfortunately all forecasts for at least the next year show the jobless and layoff trends increasing.
It is a sad but true fact that disgruntled employees can pose one of the greatest risks to a company’s sensitive information and resources. Is your company laying off people? Does it have a procedure to terminate physical and logical access to systems immediately upon termination? Is it being followed?
Are you sure and are you willing to bet your company’s future on it?
An overwhelming majority of those who are laid off do not do anything that would be dishonest but it only takes one employee to cause a problem as we saw in the Terry Childs case earlier this year.
In order to appropriately protect critical information it is important to know exactly what it is and more importantly where it is located? When was the last time you cataloged all of your company’s critical information? Is it located in a central location, isolated pockets, or scattered all over the network and user workstations? Who has access to that information?
I once worked in a company where each division stored their information (that which wasn’t saved to individual user desktops of course) in division level folders on shared network drives. All of the information within these folders was available to anyone within that division. When we migrated the network operating system from Novell over to Microsoft Active Directory, my boss and I recommended tightening the access controls on the information. We were shot down. To paraphrase one Vice President at the time: “We often collaborate across multiple groups so our people need to be able to get access to everything – besides nothing bad has ever happened before so why change things now?”
Of course she was right, nothing bad had ever happened. At least to the best of their knowledge nothing bad had happened. Another way to look at this is that the company decided to accept the risk. This is all well and good but three years later things were another story. (I had left the company for greener pastures the year before the incident.)
You see they had laid off an employee just before they had to recomplete a rather large contract. The company was a shoe-in to win the work; the recomplete was just a formality. It was a formality until they lost the recomplete to a company that had never done that sort of work before. Apparently they were underbid by almost 25%.
It wasn’t until someone remembered that the laid off employee had gone to work for the company that won the contract that they put two and two together. The problem was that they couldn’t prove anything. The laid off employee never worked on that project and in by all accounts should never have had access to the projects information. The problem was that EVERYONE had access to the information. Not only did everyone have access but auditing access to information was thought too obtrusive by senior management so it wasn’t authorized.
Did the laid off employee walk out with critical information that caused the company to lose the bid? Who knows for sure? In my mind it would be a mighty big coincidence if he didn’t but that doesn’t mean anything.
Was the employee’s account disabled when he was terminated? That I don’t know for sure. Knowing how that operation worked I’d venture to say that if the account wasn’t deactivated that day then it was the very next one. It all depended on if notification had been sent by HR at the appropriate time. I do know that he had plenty of forewarning that layoff’s were coming and the time in which to copy the information. (According to my sources)
While it is very important to terminate both physical and logical access of an employee upon termination, it is equally important to take steps to protect and control access to information and critical services before you get to the point where you’re terminating people. Some of the activities that I recommend are:
- Information Categorization;
- Position Categorization;
- Auditing access to critical information; and
- Establish a log management program.
As I said earlier, you need to know the characteristics of your critical information and where it resides. That really is the basis of a solid risk based approach anyway. Secondly you need to develop a program that assigns a risk designation to all positions based upon their access to and control over critical information. (The program should also include screening criteria but that is another post.) Third you need to audit access to critical information once you know what you need to be watching and who has the right to access it. (You can’t realistically watch everything so limit your scope). Fourth you need a way to manage all of this additional information so that it can be useful and not simply a waste of time and money.
One final note – don’t forget or neglect to put these controls in place for your IT staff. They often have access to most, if not all, of the critical information in any organization simply due to the nature of their jobs. While a disgruntled sales person may make off with a list of customers, a disgruntled member of the IT staff can cause far greater damage as was illustrated by the aforementioned Terry Childs case.
Layoffs aren’t pretty and while we feel for those who are laid off we are still responsible for protecting our company’s information. We shouldn’t blind ourselves to the risk posed by those unfortunate enough to be laid off. Remember it’s not personal, just business.
Entries (RSS)