“An employee of yours leaves the company, have you taken steps to protect the company property this employee had access to?”
It would be ideal if life always lobbed us softballs wouldn’t it? A long-time and beloved employee announces they are moving on to their next adventure in life, you thank them for their years of service, have a nice sendoff party and you tie a pretty bow on everything and life is good!
On the other end of spectrum you have the more difficult situation where perhaps a long term, or even short term employee, makes a surprise decision to leave or perhaps has been fired or perhaps “needs” to be fired and you need to ensure that the resources this person had access to have been protected and are safe.
Whether the employee relationship ends well or ends badly it’s always best to err on the side of caution, eliminate all doubt and secure the assets of the company …
Here’s the main areas of security you’ll want to be mindful of and check off your list when dealing with this situation :
#1 : E-Mail
Out Of Office Reply : You’ll need to immediately put an Out Of Office Reply on the account letting people know that this person is no longer with the company and that all emails are being forward to ???? and state the name of the person the emails are going to.
Re-direction of New E-Mail : You’ll need to designate a person internally that will receive all “new” emails being sent to the employee and forward all emails inbound to the persons account to this person
Once these first 2 steps are done this will give you the time you need to go through their archive and pluck the emails out that are critical to business continuity and forward them to the appropriate people …
Once you have harvested the emails you then it’s recommended to keep the emails for the departing employee forwarded for a period of perhaps 2 weeks and then delete the account entirely. This will give appropriate time for the outside world to know there has been a change.
Of course this policy can always be changed depending on the importance of the position and can be adjusted accordingly …
#2 : Network Access
Remote Network Access : If this person had remote access to the network then whatever method they used for outside authentication (Secure Virtual Private Network “VPN” device, Firewall login … etc …etc) will, at the very least, need to be suspended while you work through the termination process
Local Network Access : Whatever login credentials they had on the network will, at the very least, need to be suspended while you work through the termination process
#3 : Private Files
People operating in a network environment like this will often have a private file directory on the office server(s) where only they and the IT administrator have access to. Securing these files and being aware of where they are is critical.
#4 : Company Computing Resources (Desktops and Laptops)
These devices will need to be retrieved and analyzed by your IT Staff to ensure that any files kept locally on the device have been retrieved before the resource is scrubbed and reloaded and perhaps given to another staff member …
#5 : Company Smart Phones/Tablets
Depending on the circumstances of the departure many phones will have a remote wipe/delete capability that can be employed if need be but use caution when employing this method as the destructive nature of it is self evident and you’ll lose anything on the phone or tablet in the process.
There are certain circumstances where employees can go on a “slash and burn” deletion campaign if they know they are being let go and that can be incredibly destructive if you are not prepared. See our other Post entitled “Is Your Data Safe And Could You Recover From A Disaster?” for tips on properly backing things up for easy retrieval should it be needed in this kind of situation …
If you step through these items as an organization each time someone leaves, whether it’s a Good exit or a Bad exit you are well on your way towards adding a little more “Peace Of Mind” to your life …