When the Leak Comes From Inside

What was disclosed this week

Yesterday a large Canadian financial institution disclosed that an employee had taken personal information on millions of its members and passed it to people outside the organisation.

Nothing was broken into from outside. The information left through someone the organisation had already trusted with access.

Most coverage will dwell on the scale. For a small business the useful part is the shape: the risk came from inside, through access given on purpose.

Every business with a customer list has a version of that risk, and many have never looked at it.

Where your customer list lives

• The booking or appointment system, with every client's history.
• The email newsletter service, holding every subscriber's address.
• The online store's admin, with orders and delivery addresses.
• The website's stored form entries, sometimes going back years.
• The accounting software, with customers and invoices.
• A spreadsheet on a shared drive, copied from all of the above.

The fourth is the one nobody remembers. Many form plugins keep every submission in the site's database, and any administrator can export years of names, phone numbers and messages in a couple of clicks.

Who can export it

In most of those systems, exporting the whole list is a button. The question is who can see the button.

Small businesses tend to give everyone the top level of access, because it is simplest and saves being asked for permissions later. The person who writes the blog has the same rights as the owner.

Most systems have roles. A website can let someone write posts without exporting form entries; a newsletter service can let someone build a campaign without downloading the list.

The rule is the lowest level of access that lets each person do their job, with exports kept for the owner or one named manager.

Access that outlasts the job

The more common small business version is less dramatic. Someone leaves, and their access stays.

Their website login still works. Their booking system account was never closed. Their phone still syncs the shared inbox. They still know the password everyone used for the newsletter.

Most former employees never use any of it. But the business cannot tell which ones would, and assuming the best is a weak answer to a customer whose details turned up somewhere.

A leaving checklist fixes this: every system, every account, closed or changed on the last day, with the person's email forwarded to a manager rather than left open.

A worked example

A staffing agency with six recruiters used recruitment software holding every candidate's name, phone number, email, work history and interview notes.

All the recruiters used one shared login with full rights, including exporting the candidate list.

When a recruiter left for a competing agency across town, candidates on the agency's books began getting calls offering them work there. Some had never dealt with that recruiter at all.

The owner could not tell who had exported what, or when, because every action in the system was recorded under the same login.

Each recruiter now has an individual login that can search candidate files but cannot export them. Exports belong to the owner, and the system's activity log is switched on.

A leaving checklist now covers the recruitment software, the email list and the agency's job board accounts. The owner also recorded the incident and took advice on whether candidates needed to be told.

Logs only help with individual logins

Most business systems can record who did what: who logged in, who viewed which records, who exported what and when.

That record is only useful if each login belongs to one person. When four people share an account, the log says the account did it, which tells you nothing.

Individual logins also protect staff. When something goes wrong, a clear record shows who did not do it, which matters as much as who did.

Turning on the logs you already have

Many of the logs a small business needs already exist, switched off or unread.

Depending on the edition, G Suite and Office 365 keep audit records of sign-ins and file activity in their admin consoles. Booking, store and accounting systems often have a user activity log in their settings.

A WordPress site keeps little record of who logged in or exported what until an activity log plugin is added, which takes minutes.

Check each system once, note what it records and for how long, and switch on what is available. Nobody needs to read the logs daily; they exist for the day a question comes up.

Agreements and expectations

Staff should know, in writing, that customer information belongs to the business and is used only for its purposes, during employment and after.

That belongs in the employment agreement or a short policy they sign. A lawyer can say what yours should contain and how far it can reach.

Saying it plainly also changes behaviour. Many people who take a list do not think of it as taking anything, because nobody ever told them it was not theirs.

If it happens

Close the access first: the person's accounts, any shared passwords they knew, any devices still syncing.

Then record what happened, what information was involved and what you did, in the breach log that federal privacy law has required since last November for the businesses it covers.

Whether it must also be reported to the Privacy Commissioner, and customers told, depends on the risk of significant harm and on which privacy law applies to you. Take advice early, and keep the record either way.

The counter-case

A five-person business cannot run like a bank, and should not try. In small teams people cover for each other, and access that is too tight gets in the way of serving customers.

Trust is the normal state, and almost every employee deserves it. The aim is not to watch staff but to make sure access matches the job and ends with it.

For many small businesses that comes down to three things, and they are where to start: the owner holds the export rights, everyone has their own login, and a checklist closes everything on the last day.

This month

1. List every system that holds customer details.
2. Note who can export from each one.
3. Reduce access to what each job needs.
4. Replace shared logins with individual ones.
5. Switch on the activity logs each system offers.
6. Write a leaving checklist covering every account.
7. Close old accounts for anyone who has already left.

Step seven is the one that almost always finds something. Accounts for people who left last year, or the year before, are still open somewhere, and closing them takes an afternoon.

Shared logins, and changing passwords when someone leaves, are covered in the shared password on the office wall.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.