Cybersecurity defense starts in your office

CYBERSECURITY- While most might imagine data breaches and cyber threats as diabolical actions, performed in remote locations and encompassing large-scale criminal masterplans, the vast majority of breaches in the United States are caused internally. In addition to watching for attacks from across our borders, we also should focus on what is happening in the next cubicle. Employees — poorly trained and not aware of the risks, or disgruntled and seeking revenge, or departing and simply looking for a competitive edge — are the weakest link in your data security plan.

The first step in minimizing internal threats is to limit access to sensitive data, placing boundaries on employees both during and after the term of employment. Your employees (and business partners as well) should have access (including physical access) to company data on a “need to know” basis. Controlling the flow of information will reduce the risk. Internal agreements and policies are key components to managing risk.

Pre-employment, background checks can help detect those who are a higher risk. Post-employment, written agreements can emphasize the employee’s duty to maintain company confidences. Defining what you view as “confidential” and prohibiting – in writing — the use of this information for any unauthorized purpose is key. Your company’s written employee handbook should confirm the company’s ownership of intellectual property created during employment and require the return of all company materials upon termination.

Employment agreements should also clearly prohibit a terminated employee from competing with the company for a reasonable time and the solicitation of customers or employees. Further, company policy should set up exit interview procedures designed to remind departing employees of these obligations.

With these tools in place, you are poised to take quick actions in the event that an inappropriate use of data by a former employee is discovered. Your company can file an emergency court action seeking the immediate return of data. Post-employment restrictions and policies protecting company information will be important evidence. There is, however, no “one-size-fits-all” approach. Your legal counsel can help you to prepare enforceable policies.

By now, all organizations should have at least started the process to complete a data breach response plan. No matter how small or large, your business can affordably put into place a well-thought-out plan and ongoing security program. Experts, including lawyers and security professionals, are eager to help. And there are several free resources available from the federal government and nonprofit organizations.

Read more: Cybersecurity defense starts in your office