There are two fundamental points in the life cycle of every employee in an Organization: The beginning of their professional activity and the end of it.
One of the main activities of corporate criminology is the support to Human Resources departments in the hiring and termination of personnel because organizations are entrusting the integrity and viability of the company to people who will take care of the processes, who They will have access to information and availability of resources and in reality, very little is known about them, especially in companies with frequent staff turnover.
One point of risk lies in the fact that employers entrust their employees with access to a large amount of information without having sufficiently detailed access controls, resulting in access to more information than they actually need, for example the workers of telephone or banking companies. This increases the risk of harm to the company if an employee makes a mistake in the information leak or is careless.
The departure of an employee is a critical point of risk for the Organization. In cases of labor problems and layoffs, a model employee to date, can become a serious threat.
To avoid all this, Daniel Barriuso (2003) recommends a cancellation procedure that takes into account the following security aspects:
Classification of casualties
The employee's manager together with Human Resources must classify the leave according to the circumstances that surround it. An example of possible categories would be:
Normal discharge, if it occurs under normal circumstances and without conflicts.
Precautionary low, if it occurs under normal circumstances, but with which it is necessary to have a special vigilance in the accesses and documentation that is in the possession of the employee: personnel with access to sensitive information, system administrators, etc.
Low criticism if it occurs in special circumstances: layoffs, problems with the employee, etc.
Termination notice
As soon as the termination of an employee is known, Human Resources must report the termination of personnel to Security. The communication must indicate the name, the effective date of withdrawal, its classification and any special measures or controls that need to be carried out.
Dismissal management
Security must coordinate that the withdrawal occurs in the appropriate time depending on the classification (for example, a critical withdrawal must be made immediately). The withdrawal of:
- physical accesses (keys, safes, electronic keys) logical accesses (email, access to the network and servers, etc.) material of the company (laptop, mobile, etc.)
The management of the cancellation may also include other measures depending on the classification of the same making backup copies of the sensitive information, monitoring of the accesses until the day of the cancellation preventive cancellation of the most critical accesses.
Practical tips:
1. Maintain communication with your security peers in local and regional companies, this will allow you to request first-hand references about applicants to occupy a position in your organization.
2. During the first days of work, it is recommended that the employee:
Attend training sessions where you are introduced to the company's internal and security regulations. In this way, all employees know their security obligations such as the protection of their access codes, proper use of email and internet, information classification, etc.
Receive the manual of internal regulations and sign the commitment to comply with it. This procedure formally establishes the internal regulations and guarantees that the employee knows the existing regulations.
3. Conduct audits of people who resign or leave for other reasons. Check the list of clients, the physical condition of the tools or vehicles in charge, all this before it is delivered and sign a settlement.
