An account manager resigned in June and joined a competitor in September. In November a client mentioned, pleasantly and without meaning any harm by it, that he had been approached with a proposal that quoted our renewal dates. Nothing had been breached. Everything he used had been exported through a reporting screen he was entitled to use, in ordinary quantities, over about six weeks.
Our controls were built almost entirely to keep people out. We had spent years on perimeter, endpoint protection, mail filtering and privileged access, and all of it was aimed at somebody who should not be there. The quiet arithmetic is that the largest volume of data that has ever left this organisation left in the hands of employees who were fully entitled to hold it, on their way to another job, and mostly without any sense of doing something wrong. People take what they think of as their own work: the client list they built, the pricing model they wrote, the deck they are proud of.
The exit process was the other half of the problem. It was triggered by HR on the last working day, which is between four and twelve weeks after the moment the risk actually starts, and it consisted of revoking access and collecting a laptop.
I want to be careful about the remedy, because the obvious one is surveillance and I do not think a department should drift into that quietly. We did not start watching individuals. We set volume thresholds on the three systems that hold client and pricing data, agreed with HR and our legal team, described plainly in the staff policy, and reviewed by one named person rather than by any manager who gets curious. Bulk export from those systems now needs a second approval regardless of who asks. Personal cloud sync and automatic forwarding to external addresses are off. A resignation triggers a documented access review rather than nothing until the final Friday, and the exit conversation says explicitly what belongs to the company.
The most effective control was the least technical. We started saying it out loud, at the start rather than at the end.
– Serguey Shinder
