Home > Ask the Security Experts > Security Management Questions & Answers > How to create a policy to avoid disgruntled employee data leaks
Ask The Security Expert: Questions & Answers
EMAIL THIS

How to create a policy to avoid disgruntled employee data leaks

David Mortman, featured expert EXPERT RESPONSE FROM: David Mortman, featured expert

Pose a Question
Other Security Categories
Meet all Security Experts
Become an Expert for this site


Digg This!    StumbleUpon Toolbar StumbleUpon    Bookmark with Delicious Del.icio.us   


>
QUESTION POSED ON: 26 November 2008
We recently found out that a former employee has been leaking sensitive company data during the last few weeks. What's the best way to handle such a breach, and what legal recourse can we take against this person?

>

First and foremost, talk to the company's lawyers, because the rules are different from state to state.

Ideally, the former employee signed non-disclosure agreements, because those help demonstrate knowledge and intent. If not, the process is more or less the same, but the chances of winning a court case (if it comes to that) are not nearly as good.

That being said, litigation is expensive, so decide what the goals are in applying legal pressure to the former employee. Do the executives only want the employee to stop leaking data, or do they want to pursue civil or criminal charges?

If you are planning on going the litigation route, it is important to gather the data as systematically as possible. The rules for admissible evidence are both complex and arcane, so it's important to talk to the lawyers to ensure that the processes will hold up in court. When analyzing data of a potential leak, always work with a copy as opposed to the original. As soon as a leak has been isolated, stop the analysis and let the lawyers know. Then start tracking every step: If you hand off any portion of the data to anyone, track the chain of evidence so you can demonstrate as best as possible that the data has not been altered.

In my experience most companies just want the person to be quiet. If so, then it may only take a nasty formal letter from the legal department reminding him or her of the obligation to keep company secrets confidential along with a threat of civil and/or criminal charges. This is also an appropriate precursor should the final goal be civil suit. The company can generally charge him or her for contract violations around the non-disclosure agreement and any applicable non-compete agreements. Depending on where the company is located you may also be able to sue under the Uniform Trade Secrets Act.

If the goal is criminal charges, it will be a difficult process, but the company may have recourse under legislation such as the Economic Espionage Act of 1996. However, prosecution under that law requires that the company convince the U.S. Attorney's Office to pursue this course of action, which generally requires the ability to prove a large financial loss. Similar legislation may exist in the company's state, so talk to the lawyers to determine whether involving law enforcement is reasonable.

More information:


BROWSE BY TAG
Security Management,   Information Security Laws, Investigations and Ethics,   Information Security Management,   Enterprise Data Protection,   Enterprise Data Governance,   Data Loss Prevention,   VIEW ALL TAGS

Digg This!    StumbleUpon Toolbar StumbleUpon    Bookmark with Delicious Del.icio.us   



RELATED CONTENT
Security Management
How to prepare for a FERPA audit
Why doesn't the CISSP cover information assurance and DIACAP?
Data breach notification legislation: What info must be released?
Risk management strategy for an information technology solution provider
Are there guidelines to create a HIPAA-compliant data center?
HHS HIPAA guidance on encryption requirements and data destruction
Writing a patient identifier policy to prevent common HIPAA violations
How to write technology outsourcing contracts
The requirements for being a PCI DSS-compliant service provider
The requirements needed to make an external penetration test legal

Information Security Laws, Investigations and Ethics
Melissa Hathaway urges more cooperation, government attention to cybersecurity
Cybersecurity czar candidate questions clout of new position
DHS fills National Cybersecurity Center post
FTC shutters rogue ISP for hosting malicious content, botnets
Experts optimistic of Obama cybersecurity plan
WH cybersecurity plan needs private sector guidance
Obama announces creation of cybersecurity coordinator position
Cybersecurity Act of 2009: Power grab, or necessary step?
Face-off: Who should be in charge of cybersecurity?
Feds should get private sector advice on cybersecurity

Enterprise Data Governance
Creating an enterprise data protection framework
Analyst DLP study finds maturity, ranks top DLP vendors
Voltage, RSA spar over tokenization, data protection
Twitter gets condemned by CISOs at Forrester forum
PCI DSS compliance requirements: Ensuring data integrity
Trustwave acquires data loss prevention vendor Vericept
Data has become too distributed to secure, Forrester says
Cloud-based security services should start private
Compliance in the cloud
How to write technology outsourcing contracts

RELATED GLOSSARY TERMS
Terms from Whatis.com − the technology online dictionary
CALEA  (SearchSecurity.com)
cyberstalking  (SearchSecurity.com)
FERPA  (SearchSecurity.com)
HSPD-7  (SearchSecurity.com)
I-SPY Act  (SearchSecurity.com)
Information Awareness Office  (SearchSecurity.com)
intelligence community  (SearchSecurity.com)
lawful interception  (SearchSecurity.com)
lifestyle polygraph  (SearchSecurity.com)
vulnerability disclosure  (SearchSecurity.com)

RELATED RESOURCES
2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems
Search Bitpipe.com for the latest white papers and business webcasts
Whatis.com, the online computer dictionary



Search and Browse the Expert Answer Center
Search and browse more than 25,000 question and answer pairs from more than 250 TechTarget industry experts.
Browse our Expert Advice



Find Security Solutions for Your Business
TechTarget Security Media
Information Security View this month\\'s issue and subscribe today.
Information Security Decisions Apply online for free conference admission.
SearchSecurity.com
HomeNewsMagazineMultimediaWhite PapersLearningAdviceTopicsEventsAbout Us

About Us  |  Contact Us  |  For Advertisers  |  For Business Partners  |  Site Index  |  RSS
TechTarget provides technology professionals with the information they need to perform their jobs - from developing strategy, to making cost-effective purchase decisions and managing their organizations' technology projects - with its network of technology-specific websites, events and online magazines.

TechTarget Corporate Web Site  |  Media Kits  |  Site Map




All Rights Reserved, Copyright 2003 - 2009, TechTarget | Read our Privacy Policy
  TechTarget - The IT Media ROI Experts