It seems nearly every day I hear someone talk about the stress of the unknown. Today, it was about an employee resigning from the organization and a long discussion about what they had access to and how/if we can get the information back. What if they take it to a competitor? While we could go on for days about insider threat protection, what struck me about this was the length and depth of the conversation without any real discussion of the risk of these specific circumstances.
Don’t get me wrong, I strongly encourage insider threat controls, but this post is more about problem-solving. It’s not uncommon for us as human beings to get caught up in the moment and apply more brainpower to a problem than what may be required. I’ve heard countless talks and read more than my fair share of books that refer to time as our most finite resource. If we accept that as true, or true enough, then what’s next becomes pretty easy.
Step one of almost every problem-solving process I have been educated on is to define and evaluate the problem. A critical part of this step is to determine if the problem is one we should focus on. How big of a deal is this really? Is this going to crash my plane right now or can it wait until we land by normal operating procedure? Take a breath, a step back, and really consider if this is where you should be spending your most finite resource (it’s “time” if you skipped the first paragraph).
This is not a post asserting that your problems aren’t real and that you’re wasting your time. I have no doubt that you face real problems that need solving every day. This is a post reminding you that in a sea of possible problems, it’s more critical than ever to not skip the first step and jump right into solving every problem that pops up.
So back to today’s problem. An employee in sales uses a personal laptop (not company issued, monitored, or maintained) to conduct business every day. They are leaving the company and the group is worried about getting the data back, not losing continuity of any in-process deals and future deals on the books. The conversation quickly started to dive into how do we hold this person legally liable, how do we get everything back, and how will we know if we actually get everything back?
While this MAY have been an appropriate course of action, what would I have done differently? Spend 5 minutes evaluating. What did they have access to and if they have copies of it all, how much do we (the business) care? Is their laptop the only place the information might be or might co-workers have hands-on that information as well, turning our focus more on having them delete the data than us getting it back?
My take away from today? Breath, evaluate, and focus on the most important things based on the available information when making that decision. It was a timely reminder for me today, and I hope it is for you as well!
Cheers and have a great day!
Matt Farry ~ Risk Management Director at SideChannel
