How to Keep Data Safe When Offboarding Employees

Warning Signs of Insider Data Theft

Organizations need to be diligent in monitoring employee computer activity for anomalous behavior. The 90 days leading up to an employee’s resignation or termination require particularly stringent monitoring for warning signs of data theft.

The following events may indicate that a departing employee is attempting to bring company-owned data with them:

• Unexpected spikes in data transfers to USB devices, cloud storage accounts, and other data egress points.
• Anomalous fluctuations in email activity such as a higher volume of emails, emails sent to unfamiliar accounts, and an increased prevalence of attachments.
• Anomalous timing of logins to corporate accounts or interactions with files, including after standard office hours or other periods where the employee would typically be inactive.
• Attempts to connect unauthorized and/or unfamiliar USB devices to company-owned devices.
• An increase in web activity to cloud storage sites such as Dropbox or Google Drive, particularly if these services are not typically used for work-related purposes.

1. Maintain Collaboration Between HR & IT

While the offboarding process is generally spearheaded by the human resources (HR) department, it is paramount that information technology (IT) staff are proactively involved as soon as possible. 

As soon as the employee’s resignation notice is submitted, human resources and information technology staff need to begin their respective offboarding processes. This ensures that as the ex-employee is leaving the premises they are also leaving your network. 

If IT is not informed of the resignation or termination, the ex-employee may be able to access sensitive corporate systems well after their departure. This provides ample opportunity for a disgruntled ex-employee to steal corporate data or harm its integrity.

2. Implement Automation Wherever Possible

An Osterman Research study found that 89% of employees were able to access sensitive corporate applications well after their departure. ⁹

Automating the deprovisioning process reduces the possibility for human error and ensures that deprovisioning processes are properly executed. Reliance on manual processes increases the possibility that offboarding items are missed, incomplete, or not executed in a timely manner. 

The use of an identity and access management (IAM) solution allows for the automation of deprovisioning and ensures that the ex-employee’s access to all corporate assets is revoked simultaneously. The access logs created through these tools also provide a valuable audit trail of employee account activity. 

Services that cannot be managed via IAM must be thoroughly documented to ensure that the ex-employee’s access is revoked as any level of access to corporate accounts has the potential to escalate into a security breach.

3. Adhere to the Principle of Least Privilege

The principle of least privilege dictates that employees should only be provided with the minimum access privileges that are required for their role.

Adhering to this principle reduces the risk of threat actors gaining unauthorized access to critical systems through low-level accounts, devices, or applications.

This includes not providing employees with administrative privileges, having IT personnel use non-privileged accounts when admin credentials are not required, and restricting access to network drives on as-needed basis. 

This principle not only applies to corporate accounts; it also includes applications, data, functions, and other resources or permissions related to the role.

By proactively adhering to the principle of least privilege a disgruntled ex-employee will have limited opportunities to steal data or vandalize critical systems prior to their departure.

Throughout the employee lifecycle it is critical that security teams are cognizant of access creep – the tendency for employees to accumulate varying levels of access over their career without being deprovisioned when that access is no longer required.

To prevent access creep the levels of access that a given employee has must be audited during role changes and other events that require modifications to access permissions.

4. Have Separate Accounts for Each User

Permitting the use of shared accounts reduces visibility and control over the access that individual users have to corporate resources.

Shared accounts are easier to breach by attackers as they cannot be readily secured with multi-factor authentication (MFA). The abuse of the account’s resources also cannot be definitively traced to an individual employee.

As each user shares the same credentials it is impossible to know how many current and former employees (or attackers) have access to the accounts. 

5. Monitor and Control the Flow of Data

To enforce the principle of least privilege an organization needs to limit an employee’s access to data according to their legitimate work-related needs.

This includes:

• Data access control systems
• Restricting the use of unauthorized portable storage devices
• Enforced encryption standards
• Web filtering software to block unauthorized cloud storage use
• Monitoring all data-related activities of employees

The monitoring of employee computer activity is critical for detecting data theft attempts. An employee’s computer activity must be closely monitored during the 90 day period before their departure as this is the period where data theft is most likely to occur. 

To automate the data risk monitoring process, organizations can implement data security software such as data loss prevention (DLP) and security information and event management (SIEM) solutions that trigger alerts when high-risk activities are detected. 

6. Perform a Digital Forensics Investigation

A formal digital forensics investigation is not necessarily required for every terminated employee. However, in the event that a breach of protected data is suspected professional services may be required to analyse the root cause of the breach.

If anomalies in an employee’s behavior warrant further investigation by a digital forensics professional, it is a best practice to turn off their computer and have it forensically imaged to maintain the integrity of the evidence.

Digital forensics investigators will analyze the artifacts that are present on the ex-employee’s computer. These digital artifacts may serve as valuable evidence of data exfiltration.

Common artifacts they will search for include evidence of the use of unauthorized USB devices, anomalous interactions with sensitive data, and suspicious web browsing activity.

7. Implement Risk-Based Authentication

Even with a well-documented employee offboarding process there is the potential for items to be missed during deprovisioning.

Risk-based authentication provides an added layer of security by varying the degree of authentication required to access a given resource. If the context of the authentication request is moderate-to-high risk the solution will request additional factors for authentication such as biometric data, one-time passwords, or a PIN number.

The robustness of the requested authentication measures is based on a variety of risk factors, such as:

• The geolocation data of the request
• Previous high-risk account activity
• The general risk level of the individual account
• The sensitivity of the resources being accessed
• The type of device requesting access

In the event that an ex-employee attempts to regain access to corporate systems the risk-based authentication solution will log the access attempts for further investigation.

Implementing risk-based authentication helps balance security and productivity by requiring less stringent authentication for low-risk activity, which improves employee experiences with the organization’s security measures while providing sufficient authentication measures for data that needs to be kept confidential.

8. Limit (Or Eliminate) BYOD

Bring Your Own Device – also known as BYOD – is the practice of allowing employees to use their own personal devices for work-related tasks. 

As a best practice, employee-owned devices should not be provided with access to systems that contain sensitive data. An employee’s personal device simply cannot be monitored and managed with the same degree of granularity as company-owned devices.

In the context of offboarding an employee-owned device may retain company data well after the device has been remotely wiped and blocked from use in the company. 

Devices that are used for personal activities are also more likely to participate in high-risk web browsing, file downloads, and software usage than a device that is exclusively used for work-related purposes. For optimal data security, employees should be provided with devices that are owned and controlled by the company.

The ownership of company-owned devices should be intimately tracked with an IT inventory management system so terminated employees can be held accountable for returning these assets prior to their departure.

9. Maintain and Validate Backups of Critical Data

To maintain the integrity of data it must be regularly backed up to both on-site and off-site locations. These backups must be regularly validated to ensure that business continuity is possible should an ex-employee engage in malicious data deletion, the destruction of data storage devices, or other acts that would compromise the integrity of critical data.

While data backup programs may include automated validation checks it is a best practice to test the entire data recovery process manually. This verification process must include testing the operational functionality of the data once it has been restored.

10. Combine Technical & Administrative Safeguards

Employee training is a critical component of insider threat prevention. Employees must be trained to recognize the warning signs of insider threats and provided with a channel to anonymously report suspected threats.

Furthermore, company policies such as an acceptable use policy, cybersecurity policy, and non-disclosure agreements ensure that employees are aware of their duty of care to sensitive data. Policies also provide a precedent for litigation should an employee exfiltrate company-owned data prior to their departure.

To maximize the effectiveness of company policies, employees must be kept aware of their data security obligations and their employer’s intellectual property rights throughout their careers, especially during the offboarding process.

Human Resources & Administrative Controls

1. Remove mentions of the ex-employee from internal documentation such as authorized contacts lists and organizational charts.
2. Remove any mentions of the ex-employee from company websites to prevent social engineering attacks.
3. Have the ex-employee sign statements acknowledging that all company-owned assets have been returned and that their access to company systems has been revoked.
4. Announce the ex-employee’s departure to relevant parties, including clients and vendors that the employee worked with. Ensure that IT personnel are aware of the departure in advance so they can monitor employee computer activity for evidence of data theft and revoke access to the company’s resources and facilities. 
5. Perform an exit interview that assesses potential risk factors. Overview all policies that the employee has previously agreed to such as non-disclosure agreements and intellectual property rights.

Account and Access Deprovisioning

1. Provide designated individual(s) with access to the ex-employee’s files following their departure.
2. Revoke the employee’s access to any corporate accounts and assets, such as social media accounts, remote access tools, and identity and access management (IAM) systems.
3. Suspend or disable the employee’s accounts on all platforms (SaaS, domain logins, etc). Make any required backups of their account data, then delete the account after a predetermined retention period.
4. Change passwords on any shared accounts and take steps towards removing the need for shared accounts in the future.
5. Disable the employee’s email access. Forward their emails to a designated individual and place their mailbox on Litigation Hold if there is a need to preserve all mailbox content, including deleted items and original versions of modified items.
6. If the employee was the owner of any systems, ensure that ownership is transferred to the IT department and that the employee’s access methods are revoked. Take steps towards removing the need for employees to have ownership over corporate systems in the future.
7. Ensure the employee’s telephone is not forwarded to any external numbers they can access, such as their cell phone.
8. Delete the employee’s voicemail account and/or change their voicemail password.
9. Modify physical access control devices such as door codes to prevent the ex-employee from physically accessing the premises.

Information Technology Asset Management (ITAM)

1. Obtain custody of company assets including computers, mobile devices, external storage devices, security access cards, and company credit cards. Update IT inventory databases with any relevant information.
2. Before reimaging the employee’s computer, consider making a complete backup and retaining it for at least 30 days. 
3. Backup and wipe any corporate data that is stored on employee personal devices.
4. Take an inventory of all of the files and projects the ex-employee was working on and ensure that any related materials have been returned. 
5. Ensure that any files that have been stored outside of primary file repositories are moved to a designated secure location. Take steps to mitigate improper data storage practices in the future.

Employee Monitoring, Compliance, & Auditing

1. In the event of a suspected data breach, retain a forensic image of the employee’s computer for an appropriate length of time as determined by relevant laws, policies, and regulations.
2. Review access logs for firewalls, VPNs, and network servers for any suspicious or high-risk such as anomalous access of sensitive data, higher frequency of access, or accessing files that are unrelated to their position. Continue monitoring access logs on an ongoing basis.
3. Monitor employee computer activity during and after employment, including web usage (visits to unauthorized cloud storage sites, suspicious search engine queries, etc), file downloads, and USB activity (large file transfers, exfiltration of sensitive data, the use of unauthorized devices, etc.).
4. Review network printer activity for the anomalous printing of sensitive files.
5. Monitor emails that are being sent to personal email accounts and scan file attachments for evidence of sensitive data.

About CurrentWare

CurrentWare’s data security software solutions are advantageously priced, simple to use, and scalable for organizations of all sizes. Want to learn more? Contact our team by phone, email, or live chat.

• Monitor & control USB devices to protect against illicit transfers
• Monitor employee internet use for evidence of high-risk web browsing
• Block dangerous websites to improve the security of your network

Ready to protect data against insider threats?