(Potential) door slamming, cardboard boxing, silent goodbyes; it can be a bit dramatic when an employee leaves the business. Even on good, moving-on-to-better-things terms, it can take its toll. Writing up job descriptions, endless interviews, the empty desk. There’s lots to do when the ex-employee closes the door. And that’s all well and good, but what about the IT side of things? It’s not simply a case of handing over a laptop and starting anew. Without realising it, you would be watching not only a good friend walk out the door, but a security breach too. A walking, talking security breach. Imagine the nightmare. With BYOD becoming more and more popular, you don’t know what devices they were using to work or what data they have stored where. Let’s be honest, if it wasn’t a stressful situation before, the recent enforcement of GDPR has only made it worse. And it’s not like you can ask them to take out all of their devices and go through all of their files, contacts and photos. The desk would be covered in personal and company phones and laptops, USBs, the company iPad and the slightly sicky, sort-of cracked personal iPad that has every indication of a child being given it to play with during a moment of parental weakness. There would be drama for the water cooler. Or, as we call it in the UK; the Hallway Stop n’ Chat. So, what should be done when a user leaves?
Regardless of how an employee leaves, they’re going to walk away with something. Whether it’s your business practices, how you like your coffee, or behind what book Lorna hides her chocolate, something’s going to go. In this scenario, it’s a case of looking at what’s sensitive and what’s not (Lorna needs a hiding place rota regardless). Back in the day, people would slip files into their briefcases and quickly waltz out the door, whereas nowadays it’s quick and easy just to copy a digital file, and none will be the wiser.
Before there’s even chats about Having Been Here Too Damn Long or the more popular I’ve Wasted My 20s At This Desk, it’s best to prepare for the worst. And even more so if you have, or are thinking of establishing, a BYOD policy at work. Start with an extensive, written BYOD policy. Sounds easy, but I promise you that it’s not.
Treat it more like a software development project- compile ‘what if’ scenarios. Include some ‘beta testing’; a period of time to review real-life situations before handing in the final copy. A few things to consider, since there is 100% going to be the office eejit that will take the mickey; ‘acceptable business use’ is just as important as the limits of ‘acceptable personal use’- you just know some yob is going to be playing Candy Crush if they find even the tiniest loophole. Decide what kind of apps you don’t mind being downloaded, and what apps you most certainly do. What company resources (think email, calendars and so on) is acceptable to have access to on a personal device? Obviously, harassing people on company time on a company device is a no-no, just make sure everyone else knows. Same goes with texting or emailing while driving. Sounds obvious, but you’d be surprised how much it isn’t to some people. Think security; what security requirements are needed before being allowed to connect to company networks? What happens of the device is lost or stolen? At this point, you may as well bookmark this post to come back to after doing the above. I’ll wait. Now that you have your policy defined – how do you enforce it? We use Citrix XenMobile and Citrix ShareFile to provide a centralised, single point of management for our mobile devices.
Right, with that niggly bit out of the way, let’s look at monitoring. Not the breach-of-privacy looking-over-shoulders kind of monitoring that will definitely end in tears and a lawsuit, monitoring where your data is going. That sounds much less dramatic. It is time for your IT department to shine. Set up shared company file servers for starters. There are plenty on the market, but I can say from experience that Citrix Sharefile is the best one (that’s mostly because it’s so simple even I can use it). With these file servers, make sure to set up protocols, such as who can access what files and how. With ease, IT can now monitor who is accessing those files and when. Likewise, copying anything from the company server onto a company or personal device is logged. Local devices are cool, until they’re riddled with company data. A big help in not letting too much data get downloaded is knowing the ins and outs of the applications and services that your users use. What kind of liberties do these apps allow? A central repository that can be monitored is a really good idea, adding a layer of security to company networks.
According to a report from Osterman Research, 67% of organisations don’t know if they can detect whether an employee is still accessing corporate resources. Think that’s bad? A whopping 76% can’t tell if a third party (like a contractor) has stopped working on their organisation’s systems and data. If that’s not scaring you, the thought of the fine for breaching GDPR because of some eejit who sees their chance and takes it should. But I’m not here to panic you (only a little, or you wouldn’t be reading all the way to the bottom). Like all well-established organisations, Cetus has had its fair share of employees leave for one reason or another (although thankfully far lower than the average tech company). Thankfully, we’re a team of experts that know exactly how to deal with it. If you haven’t sorted out some policies to prevent your sensitive data from walking out the door, make sure to have a chat with one of our experts. They’re only a phone call away and they’re sure to help you eliminate some of that stress.
We’ve helped hundreds of organisations to implement their mobility strategies and we’d love to share our experiences with you. We can provide everything to get you started from Business Case analysis (at no cost) to high level designs and implementation…
Missy Beaudelot – Digital Marketing Executive
With a background in journalism and an interest in all things tech, Missy keeps our social media in check while monitoring our websites and developing our digital presence.