Survey: When Leaving Company, Most Insiders Take Data They Created

Employees feel a sense of ownership over the data and documents they create on the job -- so much so, that 87 percent of them take data they created with them when they leave the company, according to a new survey.

Secure communications company Biscom surveyed individuals who previously left a full-time job -- voluntarily or otherwise. While only 28 percent of respondents stated they took data they had not created when they departed, the vast majority walked off with copies of their own work.

"I think the biggest driver was that sense of ownership," says Biscom CEO Bill Ho. Of those who took data they created, 59 percent said they did so because they felt the data was theirs. Seventy-seven percent said they thought the information would be useful in their new job.

The good news is that none of the respondents said they did it to harm the organization. (Although 14 percent admitted that they'd be more likely to nab data on the way out if they were leaving under "negative circumstances.")

"There may be a concept in their mind that it's not malicious because they're not trying to harm anyone," says Ho, "but I think deep down they know it's wrong."

The other good news is that none of the respondents stated they took data protected by privacy regulations. Yet 88 percent of respondents took company strategy documents and/or presentations, 31 percent took customer contact lists, and 25 percent took intellectual property (IP).

"IP is a really, really big problem," says Ho. "It's [a company's] differentiator. It's what gives them their competitive edge."

The vast majority of respondents, a whopping 94 percent, said that weren't aware of any protections their organization had in place to prevent employees from removing data and documents. Only 3 percent admitted that they knew of these protections and ignored them. Another 3 percent said they knew of them, and couldn't get around them.

Biscom researchers say that it's doubtful 94 percent of the organizations had no policies or procedures in place to prevent insider data leaks/theft. The trouble, therefore, was that companies were doing a poor job of educating employees on the existence of these policies, procedures, and security technologies.

"If there were tools and technologies in place," says Ho, "it wasn't stopping them."

The most common method respondents used to take data was moving it to a Flash or external drive (84%). Other tactics were emailing it to their personal accounts (47%), printing hard copies (37%), loading it onto a shared drive (21%), or saving it to a sync and share service like Dropbox (11%).

Although some respondents said they were more likely to abscond with data if they left the company under negative circumstances -- like being fired or laid off -- security teams are better equipped to handle those situations. They know the bad news before the employee does, and can protect the company by quickly revoking access privileges and having people escorted out of the building. However, the employees who quit are a step ahead of the security team, and can begin the process of exfiltrating data long before they give their two weeks notice.

So how to dissuade that type of behavior? One, which may seem counterintuitive, is to provide users with better, easier, more secure file-sharing tools that the organization can monitor, Ho says. 

"If the employees don't have the tools to share, they're going to use what they can," he says. Technologies like DropBox and Google Drive are free and easy to obtain. "Companies should probably serve their own employee" better.

Ho also recommends technologies to monitor user behavior -- like behavioral analytics and data exfiltration monitoring -- and regular security awareness programs that inform users about the company's policies about data removal and the tools they use to enforce them.  

"The people who are really determined, they'll probably find a way," he says. "It's the people who are on the edge ... who you can potentially change their behavior."