Wasp Barcode Technologies: The Barcode Solution People

IT Security Considerations for Departing Employees

Today’s guest post is brought to us by Alan Wlasuk, CEO of 403 Web Security. Employees leave for any number of reasons; but regardless of the reason, they have spent time in your company’s environment where they have had access to at least some level of the company’s IT systems.  Security should be a top priority for every business. No one needs to be reminded of the almost daily, high profile media reports of security breaches and the devastating effect these breaches have on the targeted companies. Less known, is the fact that a large majority of security breaches come from within a company, either by malicious employees or a naive staff member who has fallen for social engineering scams. If current employees are a potential security risk (purposely or naively), consider the larger risk that a departing, potentially disgruntled, employee might be. Whatever company loyalty an existing employee might have had (perhaps out of the concern of losing a job) soon disappears when the employee is gone. Especially in this time of ever increasing security risks, continued company layoffs, and economic turmoil, it is important to make sure you have your IT backs covered against the mischief a departing employee might cause. Here are a few items that should be part of your on-boarding and departure thinking:

• Make a list of employee IT assets the employee has in his possession (i.e., keys, fobs, computers, security devices) and keep it current.
• Record all login access to all internal IT systems with the employee’s login name. Don’t forget external system (web based) like email, phone systems and bank accounts.
• Record login access to all external IT systems that the employee has access to. Don’t forget ‘softer’ systems such as company social networks (i.e., Facebook, LinkedIn, Twitter). Many companies use a single login for these social systems and share it throughout the company; as a result, these systems are often hacked months after an employee leaves. Consider employee specific logins or change the passwords when an employee leaves.
• Inform external (and internal) IT vendors of the employee’s departure to avoid unauthorized usage. Did the employee have access to external vendor systems? If so, your company would be liable for any problems created by your former employee.
• Check the employee’s computers and all computers the employee had access to for key loggers and malware. These spyware systems are easily installed, almost never considered, and can be sending company information to a hacker on a daily basis.
• If the employee had administrator access to IT systems, check for alternative logins and back-doors that the employee might have set up for unauthorized access. Remember, there are many ‘hidden’ systems and devices that require login access (i.e., routers, firewalls, intrusion prevention systems, WAF) that provide the basis of your perimeter (network) security. It is essential that you remove the departing employee from access to these systems and devices.

Departing employee IT security starts well before an employee is ever hired. The keys to employee IT departures success are well-established processes, check lists, and attention to detail. Remember, trust is a wonderful trait, but it only takes one unhappy employee to wreck havoc. About the Author: Alan Wlasuk is CEO of 403 Web Security, a full service, secure web application development company. Alan’s a Bell Labs Fellow award-winner with 18+ years of experience building secure web applications. To learn more about 403 Web Security, please visit: http://www.403.wddinc.com.