When someone leaves the company, HR or IT is quick to get their laptop and key fob.  But what about passwords for VPN access or cloud-based company applications and services, such as SalesForce, PayPal, QuickBooks and SharePoint? Employees also need to be deprovisioned from these applications upon dismissal, but that usually doesn’t happen.  This makes former employees a real risk to your business.

 

Here’s how to protect your company from one of the biggest threats to cybersecurity: former employees.

 

According to a 2014 Intermedia Rogue Access study, former employees retaining access to private company information is a very common problem.  Following are some statistics from the study:

 

2014 Intermedia Rogue Access Study

2014 Intermedia Rogue Access Study

 

These stats prove former employees can be a massive danger to your company and bottom line.  If you look back on your former employers, you’ll probably realize that you could steal some seriously important information if you really wanted to.  Hopefully, you have no desire to do so, but not everyone is so trustworthy.  In September 2014, the FBI and Department of Homeland Security issued an alert saying, “there has been an increase in computer network exploitation and disruption by disgruntled and/or former employees…. they pose a significant cyber threat to US businesses due to their unauthorized access to sensitive information and the networks businesses rely on.”  

 

It gets worse.

 

Victimized businesses could spend up to $3 million to recover from former/disgruntled employees maliciously using previously granted access.  These costs include stolen secrets, lost data, regulatory compliance failures, data breaches, legal fees, and more.  That reason alone should be enough to convince your company to put protection measures and processes in place.

 

To ensure any previously given access is not abused, we recommend these 5 tips:

 

1) Make Cybersecurity Education Part of Your Culture

Education is a great starting point.  An alarming majority of employees do not understand the risks of sharing access credentials.  Provide general awareness security training to make sure your employees know how certain behavior can result in a data breach and why they should care.  You should also provide training to your IT department.  The Department of Homeland Security offers an online independent study course called Protecting Critical Infrastructure Against Insider Threats.

 

2) Eliminate Potential Methods of Access Immediately After Termination

IT should collaborate with trusted team members to ensure that all potential methods of access are covered.  VPN access, cloud-based file storage programs (Google Drive, Dropbox), USB drives, and access to other cloud-based applications (Salesforce, Paypal, Quickbooks) and 3rd party tools should be revoked before the ex-employee has a chance to exfiltrate any data.

 

3) Conduct Periodic Audits of Employee Access

Check all accounts on a regular basis to see who still has access. Corporate employees have an average of 15 passwords, so it can be tough to document and remember all of the applications they’ve used.  Regular reviews ensure that nothing slips through the cracks.

 

4) Utilize Threat Detection and Centralized Logging

In the event that a former employee does access your system, threat detection tools will notify you of potential security exposures, such as system compromise, malware infections, common rootkits, and rogue processes.  Make sure your IT department is using centralized logging to detect data exfiltration.  Gartner predicted that, through 2016, more than 80% of organizations will fail to develop a consolidated data security policy across silos, leading to potential security breaches.

 

5) Adopt Enterprise Password Management Software

Prevention is always the best solution. Password management tools allow you to instantly deprovision former employees upon dismissal, securely update and share passwords, and enforce strong passwords so they are more difficult for former employees to remember.  You can try Keeper’s enterprise password manager free for 30 days.

 

How does your company keep former employees from walking out with credentials?