TECH INTELLIGENCE: Desperate times, desperate measures

Recent massive tech company layoffs have sent shockwaves through the industry and companies of all sizes in all sectors can learn an important lesson from the experience: Desperate times may spur people to take desperate measures. Cybersecurity managed services providers, however, can provide protection.

Start by considering how some laid-off employees see it: they did everything right — they met or even exceeded their job requirements, yet they were still caught when the job ax swung. Then, think about their financial situation: year-end bonuses may account for up to 40% of the salary of many tech and financial employees and, depending on the timing of the layoffs, those bonuses may have gone up in smoke.

Many employees based their household budgets on their bonuses, taking out loans or making other commitments under the assumption that they would receive “X” compensation, only to suddenly find that it will only be 60% of “X.” What happens when they get that first Past Due notice, and then a second or third one? Many will enter the “bill-pay lottery,” where they must decide which charges to pay off and which get deferred. It can lead to a feeling of despair and then to a feeling of anger; and as the bills mount, they may be tempted to act against the former employer.

The notorious criminal Willie Sutton was once asked why he robbed banks. According to the FBI, his reply was concise, “Because that’s where the money is.” But that is only half of it. Bank robbers, cyber criminals, and others go after banks and other institutions because they think they can get away with it. Today, any employee with inside knowledge of a company’s security system is a potential thief — and in the case of a terminated employee, the odds can rise exponentially.

Even when an employee departs voluntarily, he or she may be tempted to use their knowledge against their former employer. That happened last year, when an IT professional at a financial services company – who was responsible for administering the company’s computer network and assisting other employees with computer and technology problems – left the firm, then used his former employer’s credentials to access the company’s configuration settings on its website, misdirecting web and email traffic to computers unaffiliated with the company, which incapacitated the company’s web presence and email. He then prolonged the outage for several days by taking a variety of steps to keep the company locked out of the website. When he was finally nabbed, the ex-employee admitted he caused the damage in a bid to convince the company to hire him back at a higher salary.

The cyber threat posed by departing employees – voluntary or otherwise – is real, but businesses can take some simple steps to guard themselves. One basic move is to limit the person’s exposure to sensitive data by getting them out the door quickly. Say an employee announces he or she has found a new job and gives two weeks’ notice. Instead of keeping them on board, it may be worthwhile to congratulate them but say, “There is no need to stay; you can leave now, and we will pay your two weeks of severance.”

If that is not an option then, while they are still at the company, closely monitor their activity and preserve all the data that they engage with. And, whether they stay for the two weeks or not, all of the files they work with as well as all of the systems they access should be tracked. Further, cyber alerts should be set up using digital data loss prevention tools that search for unexpected use of keywords, credit card numbers, Human Resource forms, Personally Identifiable Data, and other data. Once the employee leaves, of course, any passwords that they utilized should be changed.

Successful companies strive to establish and maintain very good relationships with their employees. But in business, as in personal relationships, even the best associations can go South. It is better to prepare for a possible breakup beforehand, so the “divorce” is less messy.

Carl Mazzanti is president of eMazzanti Technologies in Hoboken.