category filters go here

Avoiding security risks with leavers.

Employees who are leavers can potentially create security risks. A high-profile example of this occurred back in 2017 when President Trump’s Twitter account disappeared for 11 minutes – apparently due to actions of a Twitter employee on their last day! From deleting important data to publishing confidential information the potential for leavers to cause reputational damage or other security risks is huge. We have listed below some practical steps which employers can follow to mitigate the information security risks and avoid damage by leavers.

It’s good practice to have an off-boarding procedure or checklist which your managers can work through. This ensures no technical risks are missed and can include some non –technical items such as return of keys and fobs. Our tips for areas you should cover are listed below. Several important items on the list require the employer to have detailed knowledge of what systems the employee had access to and what physical items they had in their possession. It is good practice to create an Access Control log for each employee during their on-boarding which would contain all of this information and is updated during the course of their employment. This document is a key reference point during the off-boarding process.

Areas you should cover include:

  • Return of company owned property – this would include laptops, mobile phones, hard-drives, USB sticks etc.
  • Terminate Network Access – close down the access and eliminate the user identity if possible. Remember to include any third party cloud-based systems.
  • Change passwords – if the user had access to company passwords, they need to be changed. This could be for social media accounts etc
  • BYOD – if your company has a BYOD policy then be sure to remove all company data and programs before they leave. Remote wipe is possible but brings risk of deleting personal data.
  • Forwarding – set up email and call forwarding to colleagues
  • Door code change – if your company uses pin codes for entry access to the building or between departments then these need to be changed

A robust off-boarding process is a key element of the ISO 27001 Information Security standard.  RedMosquito is an ISO 27001 accredited organisation. We provide expert advice to our IT Support customers throughout the UK. This includes what their company off-boarding process needs to cover. If your company needs help with this contact us today to learn more about our consultancy or IT Support services.

Introducing MyGlue – our password management tool

Storing passwords on a post-it note stuck to your screen is never a good idea! Yet, if you allow your employees to make their own decisions on how they remember corporate passwords – then can you really be sure this isn’t happening within your workplace?! Bad habits around password management can create security risks and […]

Insider Threat Detection

One of the National Cyber Security Centre’s recent Weekly Threat Reports details the damage inflicted on a PPE company by a disgruntled ex-employee.  Interestingly, the departing Vice President managed to embark on his campaign of destruction even though the employer had followed good IT protocols for dealing with leavers. The employer had revoked the employees […]

microsoft logo windows 2008

SharePoint or OneDrive for Business?

As one of Glasgow’s key Microsoft partners, we are often asked to advise our IT Support customers on which Microsoft business platform best meets their need. SharePoint and OneDrive are a common example of this, with similar (but not the same) features, it can be difficult for SMEs to know which is the best fit. […]