Information leaks when employees leave organizations.

• Position: DATA SECURITY

What happens to your information assets when an employee leaves your organization? Is there a chance that the data could be leaving the organization along with the employee?

A 2012 study by Vontu Inc. and Ponemon Institute found that nearly 60% of employees steal organization information when they leave or are fired. Of those, 67% admit to taking the information to a new employer. Even more startling is the reported statistic that only 15% of the employers in the study performed any sort of review of digital or paper documents that the employees were taking.

[ILLUSTRATION OMITTED]

"Organizations must become more aware of the source of information loss, and then they can adopt best practices to address the issue," said Joseph Ansanelli, chief executive officer of Vontu. "We believe that companies need to focus on not only preventing customer information loss, but also on the loss of other confidential information such as source code, intellectual property, merger and acquisition information, design documents, network diagrams, and marketing documents."

The survey reports that of the top data security breaches:

* 39% involved confidential business information

* 27% involved personal information about customers

* 14% involved intellectual property, including software source code

* 10% involved personal information about employees

Information protection takes many forms--some directed toward ensuring that only authorized employees have access to particular types of information; others toward the protection of physical assets and storage locations, such as server rooms; and others toward preventing the leakage of information.

In addition to information being pilfered by departing employees, it can be leaked through e-mail transmissions or even through employees' "sharing" on social networking sites.

Information governance professionals can take a number of steps to address any of these situations. Some actions are self-evident, such as restricting access to physical file server rooms and databases and establishing security authorizations so only authorized individuals can access sensitive information.

According to the Generally Accepted Recordkeeping Principles (R) (www.arma.org) published by ARMA International, organizations also...