Employee data theft controls should start before departure, firm says

What happened

Forensic Discovery has urged employers in online guidance to address employee data theft before a worker’s final day, rather than waiting until the exit interview to secure information.

The digital forensics provider, which published the guidance on its website, recommends combining access restrictions, targeted monitoring and early preservation of digital records. The supplied article has no publication date and describes preventive measures, not a specific theft, arrest or court case.

Its central concern is the period when a departing employee still has legitimate access to sensitive material. Engineers may know where source code is stored, sales staff may have access to customer lists, and executives may hold confidential strategy documents.

The firm says departure arrangements can introduce further gaps. Permissions may be withdrawn gradually, approvals can take time, and exceptions made for handovers can temporarily widen access.

Personal cloud storage, private email forwarding and messaging applications provide possible routes for removing information, according to the guidance. It gives examples including copying a code repository and exporting customer relationship management records into a spreadsheet for transfer to a personal drive.

The recommendations address both preventing unauthorised transfers and establishing what happened if concerns arise. Digital forensics—the collection and examination of electronic records—can help investigators distinguish suspicious activity from legitimate work, the firm says.

The background

The guidance starts with identifying valuable information and mapping who can reach it. Its examples include source code, product plans, pricing models, customer records and documents relating to mergers and acquisitions, with controls adjusted to the sensitivity of each category.

Forensic Discovery recommends limiting access to what a person needs for their work and making some permissions temporary. It also proposes weekly removal of obsolete group memberships and access tokens, rather than leaving that housekeeping until someone resigns.

Data loss prevention tools, which detect or restrict transfers of sensitive information, should consider file labels, content patterns and the volume being moved, the firm says. Suggested alerts include code archives or customer exports being sent to personal webmail, uploaded to personal cloud storage or copied to USB devices.

Device controls form another part of the approach. The guidance recommends blocking unrecognised removable storage by default, permitting approved devices and marking sensitive documents to make handling expectations clear.

For accounts, it proposes strong multi-factor authentication, which requires more than a password to sign in. Other recommendations include ending persistent signed-in sessions when resignation notice is received and blocking permissions granted to untrusted connected applications.

Cloud monitoring should cover bulk exports, sharing with outside domains and downloads from unusual internet addresses, according to the firm. On software development platforms, it recommends watching for unusual copying or duplication of code repositories.

These recommendations reflect the distinction between disabling a main account and closing every route to company information. Earlier guidance from LeadingIT on revoking former employee access also addressed connected applications, shared files and business data held on personal devices.

Forensic Discovery recommends preserving a targeted record of activity when an employee gives notice or moves into a role involving competitor-facing work. This could include device logs, browsing history relating to corporate services, command-line activity and lists of recently accessed files, with the scope and approvals documented.

For higher-risk roles, it suggests taking copies of code access logs, customer-system audit records and cloud activity covering the preceding 30 to 90 days. Exported records should be protected against alteration and given digital fingerprints, known as hashes, to help establish their integrity.

The firm also recommends recording who authorised and collected the evidence, which tools were used and where the material was stored. This chain of custody documents how evidence has been handled; comparing later activity with the initial record can help test whether an alert indicates misconduct.

What people are saying

Forensic Discovery says responsibility should be shared between human resources, IT, security and legal teams. Its guidance assigns HR knowledge of departure timing, IT responsibility for systems, security the assessment of alerts and legal teams oversight of obligations and investigative decisions.

The publisher recommends an agreed escalation process specifying who can approve an investigation, what information may be collected and how employees should be notified. It proposes a standard process for routine departures and additional monitoring and forensic collection for higher-risk cases, subject to clear approval.

The firm says employees should understand what monitoring takes place, its purpose and how the resulting information is used. Its recommended policies explain that business records belong in approved locations rather than personal accounts.

Where staff use their own devices, the guidance recommends separating corporate information into a managed area. Consent for remote deletion should be limited to that corporate area, rather than extending to the employee’s personal content.

It also recommends collecting only information needed for security and compliance, setting deletion schedules for investigative records and restricting access to sensitive enquiries. Where legal counsel directs an investigation, the firm advises documenting privilege and limiting circulation of the material.

The publisher says departure communications should explain property-return requirements and continuing confidentiality duties without suggesting that the employee is suspected of wrongdoing. Training should use practical examples, including how forwarding meeting notes to personal email can breach policy.

What happens next

The article sets out measures employers can implement rather than announcing a forthcoming investigation or policy change. Its proposed starting point is an inventory of access to the organisation’s five most sensitive data stores, followed by removal of permissions that are no longer needed.

It also recommends enabling bulk-download and external-sharing rules in three principal cloud software platforms, then testing them through a simulated adversarial exercise. For code repositories and customer-system exports, it proposes retaining activity logs for 90 days and periodically preserving protected copies.

For the departure itself, the firm recommends withdrawing access to code and data stores before email, chat and other collaboration services. The process should also disable credentials used by automated processes or personal devices, not just the employee’s ordinary login.

Equipment collection or remote deletion should be arranged before the final day, according to the guidance. Employers should verify that work has been returned to shared repositories, remove external sharing arrangements and transfer ownership of documents and cloud assets to a manager or service account.

After departure, the firm proposes reviews at seven and 30 days to look for unusual activity associated with retained credentials or synchronised personal devices. A short checklist integrated into HR workflows is intended to make those steps consistent and assign responsibility.

The handling of retained records remains a separate consideration from ending access. Earlier ISACA guidance on former employee data covered protecting archived information and documenting searches while balancing business requirements with privacy rights.