CertiGuide to Security+  9  Chapter 5:  Operational/Organizational Security (Domain 5.0; 15%)       9  5.8  Education

5.8.1  Communication 1 5.8.3  Education

“Ghosts of millions of former workers populate the databases of corporate America. The workers have moved on, but their ghosts linger, awaiting the hacker intent on using the ghost’s identity to damage the company’s network systems.” Says Brian Hook in his Tech Republic article⁴⁶².

The outdated access account can either be used by a black hat or by an employee whose layoff was handled with less than excellence. From a user awareness viewpoint:

• Educate users on the value of strong passwords that are not written down.
  
  
• Educate users on the value in mandatory frequent changing of passwords. This will disable forgotten accounts.
  
  
• Give personnel that are being laid off a specific amount of time to download personal data. Failure to do so only creates a hostile former worker.

Create and enforce non-disclosure policies. Non-disclosure is not the same as non-compete clauses. The former employee has a right to work, making non-compete clauses impractical. It is reasonable to expect them to not take with them sensitive supplier or customer data.

5.8.1  Communication 1 5.8.3  Education