Many businesses invest time and resources in developing a carefully crafted online presence. Also, trade secrets, confidential and otherwise crucial information are now used by and accessible to employees and contractors in electronic form.

How do you protect your reputation and internal information? Do you have policies and procedures for your employees in the event they leave and go to work for a competitor?

@debbielynnava – Good point Debbie! Hope they still take the time to develop the policies and procedures in the unfortunate event of a legal situation.

Here are some questions I ask about internal security when conducting a vulnerability audit of a client:

1. If I emptied 10 trashcans that normally go into a dumpster and went through the contents, would I find anything you wouldn’t like to see in the hands of the media, your competitors, disgruntled former employees or others who don’t have your best interests in mind?
2. If I go to one of the local bars/restaurants where your employees hang out, am I likely to overhear one or more saying things about your organization that you regard as confidential?
3. If you have policies related to information security and related important topics, is there training AND regular refresher training to go along with those policies?  Note – policies without training are useless.
4. If you have policies related to information security and related important topics, are violators sanctioned strongly for violations?  Note – anyone who has kids know that policies without actual consequences are worthless.