The Risks of Improper Employee Offboarding

We’ve mentioned this before as one of the 10 worst business cybersecurity mistakes: Human error as a whole is one of the key things that causes cyber-attacks in businesses. When employees make mistakes like sharing their passwords or clicking on an unknown link, they open the door for attackers. While that is old news and is always the topic for most IT headlines, another major cybersecurity threat lurks that can threaten your organisation: Ex-employees.

Whether through malicious intent or simple carelessness, your former employees can cause the kind of data breaches that could ruin your company’s reputation and cost you a fortune in fines. Luckily, a few basic precautions can help significantly reduce the cyber security risks from ex-employees.

Why Deleting a Former Employee’s Digital Profile Matters? What are the risks?

Data Loss

The risk of unauthorized access to work files may not come from the most obvious party: workers that are no longer with a company but were not cut off from the corporate email service, messenger app or Google documents. As long as a former employee has access to the network and data due to poorly secured offboarding, they are an insider threat. According to this 2020 Insider Threat Report, 63% of respondents said those with privileged access pose the greatest risk to the organization.

If access to your organization’s critical data isn’t properly revoked, data breach events are a real possibility. This can also lead to the next major risk to your business.

Compromised data

Office staff tend to use the same device for work and personal use which means that information on different devices can be duplicated or become outdated, causing confusion and possible errors at work. This digital clutter may also lead to data compromise if it falls into the hands of a third party, or even a competitor. The consequences of this could take the form of penalties and lawsuits with clients, as a result of violation of a data protection legislation.

Lost Competitive Advantage

Departing employees can use stolen intellectual property to gain a competitive advantage over their former employer, such as the two former General Electric employees that stole data on advanced computer models for calibrating turbines alongside related marketing and pricing information. The ex-employees used their former employer’s trade secrets to create a competing company.

What Can You Do

Change your passwords

The most obvious way in which former employees can access company data is through the ongoing use of old passwords, so it is vital to make sure that you’ve changed the passwords for all systems and accounts that an employee had access to. This includes changing administrative passwords for servers and networks. Notify third-party services (e.g. email or customer support, vendors and partners, etc.) to update passwords as well.

Remove access immediately

Make sure that your employee offboarding procedures include steps for removing all of a former employee’s access to your network and company accounts. Even though this process can be time-consuming, but it’s critical.

As part of our IT support, Insight has procedures in place to lock employees out as soon as we are notified that they have been dismissed.

Foster good password habits among employees

Practice not using personal details or sharing them with anyone in or outside of the company. The Password Manager function in a protection product can help keep passwords secure and your confidential data safe

Keeping concise IT inventories

Inventory keeping is an important best practice for any organization and is especially relevant when it comes to avoiding data security breach risks posed by ex-employees. You’ll need to gather all company assets from the former employee and use your current inventory list (you’ve got one of those, right?) to prevent overlooking anything. At this point, everything matters – USB sticks, key cards, etc.

Create an Employee Offboarding Process

No matter what process you end up implementing, your offboarding strategy should be carefully planned and meticulously followed. By creating a checklist of steps for offboarding, you ensure that nothing is overlooked or forgotten, and risk can be mitigated accordingly. This requires a fully trained HR department that is aware of these essential steps.

Examples of a comprehensive strategy might include:

  • Conducting exit interviews
  • Revoking access to cloud services, email servers, and all corporate accounts
  • Reminding the employee of the consequences of data theft
  • Disabling Active Directory accounts, and ensuring they are deleted within a short time frame
  • Changing passwords

Examining and investing in your offboarding process can lead to a virtuous cycle of learning from your organization’s mistakes and improving them in the future. And whether your employees return with new skills or part forever as friends, offboarding can prove to your former, current, and future employees that your organization values their progression and is interested in changing for the better.

Contact Insight IT today to set up an offboarding process for your company!