So, it’s a Friday afternoon at the office, just after lunch. You’re wrapping up your week and starting to think about your weekend plans when you hear a knock on your office door. You look up and Casey, who has been uncharacteristically quiet all day, asks for a second to chat. You can tell from her face that something is on her mind, and she looks nervous. She then explains that she’s putting in her two-week notice. Now what?
Of course, there are the usual steps: inform your supervisors, contact Human Resources, appropriately pass the news on to the rest of the team, and maybe even set aside time for a farewell lunch. But what about the technical side of things? That aspect seems more straightforward when it comes to onboarding someone. For example, new employees will surely inform you if they don’t get set up with payroll and benefits. Training is also specifically created to introduce a new employee to the company. Even legal documents serve as a checklist for completing the process correctly. However, this isn’t always the case when someone is offboarding. The difference? Once the employee leaves, they’re gone for good. A disorganized offboarding process can be problematic, if not dangerous, to any company.
As part of assisting in Casey’s departure, specific steps must be taken to protect the company. It is vital to keep track of Casey’s company devices like computers, phones, and external storage drives because of the intrinsic value of these items. More importantly, the company data stored on those devices and access to company resources are likely worth more than the devices themselves. Just as Casey’s keys and access cards must be collected, so must any access she has to email accounts, file shares, company resources in the cloud, or other parts of the company network that are not accessible to the public. This security measure and others we’ll suggest in this article serve to keep control of access to all company-owned resources and data, therefore protecting your company and employees. These steps also protect people like Casey from future accusations of wrongdoing against the company.
Why is offboarding an employee properly such a concern?
Well, your employees are considered “insiders” because they have access to your company data, networks, and sensitive information as part of their job. Once they leave, you want to ensure that access to company resources is shut off. IBM reported that out of 4,716 insider threat occurrences, “2,962 were due to negligent or inadvertent employees or contractors and 1,105 were caused by criminal and malicious insiders.” This illustrates the real risk of former or current employees exposing sensitive company resources, whether intentionally or not.
Departing employees should be a security focus in every business because they have significant access to your company’s most sensitive information. They know a lot about your business, including its clientele, trade secrets, business objectives, and access to a surprising amount of data/documents. Not only should you protect your assets by performing some basic technical procedures, but you should also mitigate the risk of your sensitive information being shared through other means, even accidentally.
Unfortunately, insider threats stemming from disgruntled employees are far too common. This calls for a rigid offboarding process to improve your company’s security. But before we talk about what to do while offboarding, let’s highlight what NOT to do. Don’t:
Most folks aren’t going to have malicious intent when they leave a company. However, even when a departing employee is leaving on good terms, the potential for problems related to improper offboarding may still exist. This is an easy process to neglect. Let’s put it this way: when new employees start, they need stuff. They aren’t going to be very productive if they don’t get things like access to certain systems, a computer, and a way to get into the office. When they leave, getting all that stuff back and removing their access to things like email accounts and remote access can easily be set aside. I can’t overstate the importance of training your staff to understand the potential trouble this can cause.
Here’s an excellent example: In May 2021, Colonial Pipeline was the victim of a ransomware attack. This greatly affected everyday life in the United States. People panicked and hoarded gas, canceled flights, and disrupted the lives of millions of people. It brought cyber-related issues like supply chain risks to nearly everyone’s attention. Unless you followed the story carefully, you may not know that the entire attack could have been prevented with proper offboarding processes.
Like many other companies, Colonial Pipeline used a Virtual Private Network (VPN). While that is no small part of the story, it is not the main issue from the perspective of this article. Most relevant here is that the VPN was accessed with credentials (username and password) belonging to an inactive employee. The credentials used were reported to have been part of a data leak unrelated to Colonial Pipeline. That means the credentials to log into Colonial Pipeline via the VPN were part of a data leak from a different company. These types of data leaks frequently happen from various sources.
On a side note, this is why cybersecurity professionals advise people to avoid using the same password for different accounts. Arguably, many things besides proper offboarding processes could have prevented this attack. However, it cannot be denied that, had the proper offboarding procedures been followed, the credentials would not have worked to log into the VPN, which allowed access to Colonial Pipeline’s network, facilitating the ransomware attack, costing untold millions of dollars, and affecting the lives of millions of Americans.
Ultimately, making the offboarding process as smooth as possible will make it easier and reduce security risks for everyone involved. *Drum roll, please* The moment you’ve been waiting for. Below is a checklist of our recommended offboarding tasks:
Proper offboarding procedures are easy to skip, and it can be challenging to realize that the appropriate steps are not taking place, at least until it creates a problem. Then, it may be disaster recovery time. In 2020, the Ponemon Institute reported that the average costs associated with criminal and malicious insiders exceeded $750,000 per incident. That’s enough to put many companies out of business, especially if they lack appropriate cyber liability insurance coverage or compliance.
Reviewing the policies, procedures, and critical processes that address onboarding and offboarding processes can help highlight what your company is doing well and opportunities to reduce risk around insider threats and data loss. By assessing preparedness to detect, defend against, and recover from a cyber incident, including potential insider threats, the experts at Reveal Risk can assist your business in reducing cybersecurity risks through their people-and-process-first approach.