Dude, Where’s My Data(base)?
I have seen two articles in the last couple of months highlighting (ex-)employees taking data with them when they leave their job.
IT Ethics and the Recession asked the question “…if you were fired tomorrow what information would you try and take with you?”
A whopping 52% responded that they would take the Customer and Contacts database. And 35% would take access and password lists. HR records were favored by 28%.
Concerned yet?
A similar study by the Ponemon Institute (yes, I know it sounds like Pokemon) indicated that departing employees would take e-mail lists (63%) and customer or contact information (39%).
Looking at just these two articles it appears that your company’s high value targets are:
- Customer & Contact Databases
- HR & Employee Records
- Product Information
- Plans & Proposals
And how does all this valuable information leave your premises? Actually a lot of is probably already outside your office in the way of laptops, USB drives and remote access to your computers.
The favored means of removing data from your business appears to be the ubiquitus USB drive or memory stick followed by burning a CD/DVD although a large number of respondents (61%) in one survey took paper and hard copies.
And course there is always the iPod and smartphones — and 25% of the participants in the Ethics survey simply e-mailed the information to themselves.
More on securing your data next time.
OK, that is a little scary. How do you keep a salesman from getting the contact list when they need it to do their job? If he is smart (and why would I hire him if he wasn’t?), then he will have up-to-date copies on hand just in case he is let go and removed from the system immediately.
The short answer is “you really can’t”. But you can limit your exposure. For reps that have a territory alignment, grant them access only their set of prospects and customers.
Another way might be to provide access to the the database via Terminal Services / Citrix / Web and locking down the ability to export or copy data.
Technology can only do so much – and in this area it is both friend and foe. There are as many ways to get to the data as there are to protect it.
In the end it comes down to hiring practices and having the accountability necessary to know when trust has been violated.