1,600 employees were fired per day in 2023 by tech companies globally, including India. Tech giants across the globe have had to resort to layoffs and cost-cutting measures to stay afloat.
However, these layoffs also trigger cybersecurity risks. As businesses adjust to the new reality of reduced staff and increased workloads, it is important to be aware of the potential cybersecurity risks associated with layoffs and to take proactive efforts to mitigate them.
Cybersecurity Risks Associated With Layoffs
Because of this trend, the employees may feel insecure and may cause risk to businesses.
Sensitive Data Leak:
- Employees may have access to confidential information and may misuse it or inadvertently share it with unauthorized parties.
- Furthermore, if a remote employee is laid off and does not return business-owned devices such as laptops or cell phones, the company may lose possession of that item and its stored data.
- There is a possibility that fired employees may have replicated their entire hard drive or downloaded sensitive data from the cloud.
Insider Threat:
- Layoffs can increase the risk of an insider threat because employees may feel resentment or anger towards the company. Additionally, laid-off employees may be more likely to seek employment with competitors. As a result, they may take sensitive information with them, causing potential damage to the company's business.
- Competitors may also use fear factors to lure employees to steal/leak sensitive data/intellectual property.
Asset Thefts:
- When remote employees are returning the assets, the attackers can gain access to devices during transit and steal the information.
Loss of Intellectual Property:
- Since employees may be under constant threat of layoffs, they may store proprietary code on shared repositories like GitHub, etc, which they can access later for reuse or may share with the competition. Also, if it is not protected properly, the threat actors can gain access to such code or data, or even credentials.
Mitigation
The information security team needs to be prepared for the worst-case scenarios. The HR team needs to work very closely with IT when designing the off-boarding process. If the layoff is imminent, it is important to make sure that the employees leave on a good note. This also helps in reducing reputational risks for the company. Besides that, a systematic approach and processes help smooth operations and reduces cybersecurity risks.
- Define an offboarding process and follow a checklist when employees have to be offboarded.
- Review and update access controls. Periodically review the access to sensitive information and systems. Revoke or restrict access as necessary, and update access controls to ensure that only authorized individuals have access to critical information.
- Use only authorized and protected code repositories for storing code online. Limit access of personal accounts to the corporate cloud environment.
- Disable access to accounts, mailboxes, applications, cloud, company network, and other data sources and company-owned mobile devices.
- Conduct exit interviews - during the exit interview process, remind employees of their obligations to protect company information and remind them not to take confidential information with them. Execute a non-disclosure agreement
- Have an incident response plan in place. Having an incident response plan in place will help the organization quickly respond to and recover from any security incidents that may occur.
- Train the staff on the importance of cybersecurity, to ensure they understand the importance of maintaining the security of company data and intellectual property. Organizations should ensure that all employees have access to the latest cybersecurity education and awareness materials. This will help employees understand insider threats and how to identify and report potential threats.
- Privileged access management - this will help ensure that only the necessary personnel have access to sensitive data and that the data is secure.
Consider hiring a professional security assessment firm to assess your organization’s security posture, identify areas of vulnerability, and make recommendations for improvement.
Ensure that HR, security, IT/cyber, legal, and supervisors collaborate to develop a plan of action that includes timelines, function-specific action items before and after the layoff, and communications.
Conclusion
Layoffs can be difficult for both employees and organizations, but with robust security protocols and solutions in place, organizations can minimize the associated cybersecurity risks. While your company may not be planning any layoffs in near future, employees can still feel vulnerable due to the negative news about other companies and the surrounding environment. Implementing a Zero Trust security approach always helps in proactively dealing with unforeseen cybersecurity risks. By taking the necessary steps to protect their data and networks, companies can ensure that their data remains secure, and their networks remain safe.
© Copyright 2023. The views expressed herein are those of the author(s) and not necessarily the views of Ankura Consulting Group, LLC., its management, its subsidiaries, its affiliates, or its other professionals. Ankura is not a law firm and cannot provide legal advice.
