Running any business means giving employees access to sensitive information. That access is necessary, but it comes with a risk, and the risk rises in the period leading up to an employee’s exit. Most people never take anything they shouldn’t. Some do, often without thinking of it as theft at all.
What type of Information is Stolen?
What data walks out the front door? Typically, senior staff take restricted company information such as strategy or pricing, developers take snippets or whole repositories of code, and staff who handle customer records may take customer information. For example, imagine a call centre operator who copies customer details and uses them to commit fraud: the access was legitimate, the use was not.
Why do Employees Steal Information?
There are many reasons why employees take information: feeling entitled to it because they worked on the project, or wanting to feather their nest in their next role outside your company. The catalyst may be a move to a competitor, a dispute with their manager or having just missed out on a promotion. Whatever the reason, the connection to the organisation has weakened, and that is when the risk to your information is highest.
Does it Matter if Employees Steal Information?
Many people believe that work they produced belongs to them, and take it with them without a second thought. Whether it is a few sensitive files or the wholesale removal of information by an exiting employee, the damage to an organisation can be significant.
In many cases, your competitors gain an immediate advantage. They may get an insight into your pricing models, win your customers or accelerate key projects. The loss of the person is bad enough, but when your sensitive intellectual property goes with them the damage is more severe. At worst, the information lost could amount to a data breach.
What are the Indicators of Theft of Information?
Information theft rarely comes out of nowhere. Some common risk indicators are:
- an increase in the amount of information a person is saving or downloading
- a noticeable change in engagement or performance
- a change to leave patterns or working hours
You might also see someone start to print much more material than usual, or send compressed files to a personal webmail account. None of these proves anything on its own; there are plenty of innocent explanations. What matters is a pattern of behaviour that doesn’t fit the person’s role and normal work.
A resignation is a well-known point of risk. People don’t usually trickle data out covertly over months; they tend to take it in large chunks in their last week or two. If it is only discovered after they have left, remediation becomes difficult, if not impossible.
How do Employees Steal Information?
The theft of information is typically unsophisticated. People use the systems they have access to and are familiar with. It often happens right under our noses, because the activity looks like ordinary work and nobody is looking at how the data is moving.
Common vectors include email, removable media such as USB drives, and file-sharing services such as Dropbox, whether installed or used through a browser. More determined people may scan documents on a multi-function printer straight to a personal email address, or connect a laptop to their home network to move large amounts of data.
What not to do
The answer is never a technical tool alone. A technology-only approach typically generates large volumes of false positives that never decrease. Can your security team cope with reviewing thousands of alerts a day, or will they simply start ignoring them?
How do you prevent data theft?
There are many ways to take information. Many can be blocked, but people need access to information to do their jobs, so blocking every avenue isn’t possible. The key is to detect these damaging events early, and to build a culture where everyone understands that this kind of activity is not ok.
In essence, the answer is proportionate visibility into how sensitive data moves, not watching people. Most risky activity is negligent or accidental rather than malicious, so the aim is to spot data leaving in ways it shouldn’t, understand the context, and respond fairly.
Most organisations already hold the activity records that provide this visibility. If you use Microsoft 365, much of it is there in your tenant. The challenge is making sense of it: ordinary rules miss data loss that looks like legitimate work, and unvalidated alerts bury your team. This is where ShadowSight helps. ShadowSight Data Leakage Prevention adds a behavioural detection layer on top of Microsoft 365 activity to catch insider data loss that native Microsoft 365 DLP rules miss, such as data moving to personal email or AI tools, and every alert is validated by analysts before it reaches you. When people know that data movement is visible and handled fairly, these events tend to happen less often.
The time to act is before your organisation suffers the financial and reputational loss that comes with the theft of information, not after. Talk to us about a Proof of Value on your own Microsoft 365 tenant.
Some key points
There are some key questions you should ask yourself, particularly when an employee has just resigned:
- Should I put that person on gardening leave?
- Does the risk of them remaining in their position outweigh their value to the business for the next month?
- Can their access be restricted to reduce the risk of information theft for their remaining time in the business?
- Do you have visibility of how the sensitive data they can reach is moving?
- Has the employee signed a legal attestation regarding the information they had access to?
CEO & Co-Founder, ShadowSight
Who is Christopher McNaughton
Chris is a proficient problem solver with a strategic aptitude for anticipating and addressing potential business issues, particularly in areas such as Insider Threat, Data Governance, Digital Forensics, Workplace Investigations, and Cyber Security. He thrives on turning intricate challenges into opportunities for increased efficiency, offering pragmatic solutions derived from a practical and realistic approach.
Starting his career as a law enforcement Detective, Chris transitioned to multinational organisations where he specialised and excelled in Cyber Security, proving his authority in the field. Even under demanding circumstances, his commitment to delivering exceptional results remains unwavering, underpinned by his extraordinary ability to understand both cyber and business problems swiftly, along with a deep emphasis on active listening.