When I first read about Jack Teixeira, the airman accused of leaking classified files I shook my head and wondered how something like this could happen. The following excerpt from a NY Times article this morning makes me ponder this question even further:
“In an 18-page memo, released before a detention hearing scheduled for Thursday in a Massachusetts federal court, the department’s lawyers argued that Airman Teixeira needed to be detained indefinitely because he posed a “serious flight risk” and might still have information that would be of “tremendous value to hostile nation-states. Prosecutors pointedly questioned Airman Teixeira’s overall state of mind, disclosing that he was suspended from high school in 2018 for alarming comments about the use of Molotov cocktails and other weapons, and trawled the internet for information about mass shootings. He engaged in “regular discussions about violence and murder” on the same social media platform.”
Teixeira joined the Massachusetts Air National Guard in September 2019 so this questionable “state of mind” information was available prior to his being employed. Did they do a background check? And if this could happen at a “secured” government agency, what about our companies?
Regularly monitoring employees' personal lives, such as checking their social media activity, can be considered an invasion of privacy and potentially damage employee trust and morale. This type of activity should be transparent and conducted in a manner that respects employee privacy rights and should be conducted in compliance with applicable laws and regulations. However, preventing employees from accessing confidential company information is critical to maintaining the privacy and security of your organization's sensitive data. Here are some best practices to consider:
Develop clear policies and guidelines for accessing confidential information, including who has access and under what circumstances. Make sure employees understand these policies and are aware of the consequences of violating them.
Implement role-based access control (RBAC) to ensure that employees only have access to the data necessary to perform their job duties thereby limiting the risk of unauthorized access to sensitive information.
Enforce strong password policies that require employees to use complex passwords and change them frequently. Use multi-factor authentication for added security.
Provide regular training on data security and the importance of protecting confidential information helping employees understand the risks and how to prevent security breaches.
Monitor employee access to sensitive information and use alerts to notify management of any unusual activity.
Limit the use of external devices such as USB drives, external hard drives, or personal mobile devices that could be used to copy or transmit confidential information.
Hire an independent party to conduct regular and surprise monitoring to ensure employees follow policies and procedures for accessing confidential information. The greatest policies are useless unless they are being adhered to.
By implementing these best practices, you can help protect your organization's confidential information and reduce the risk of data breaches.
For more information or assistance with controls implementation or monitoring please contact me at ken@yormarkconsulting.com.
Comments