Question

After an employee was terminated, the company discovered the employee still had access to emails and attached content that should have been destroyed during the off-boarding. The employee's laptop and cell phone were confiscated and accounts were disabled promptly. Forensic investigation suggests the company's DLP was effective, and the content in question was not sent outside of work or transferred to removable media. Personality owned devices are not permitted to access company systems or information.

Which of the following would be the MOST efficient control to prevent this from occurring in the future?

A. Install application whitelist on mobile devices.
B. Disallow side loading of applications on mobile devices.
C. Restrict access to company systems to expected times of day and geographic locations.
D. Prevent backup of mobile devices to personally owned computers.
E. Perform unannounced insider threat testing on high-risk employees.

Answer 1

The most efficient control to prevent terminated employees from accessing sensitive information in the future would be to restrict access to company systems to expected times of day and geographic locations, as this provides an additional layer of security beyond account deactivation.

Step-by-step explanation:

After an employee was terminated, the company discovered the employee still had access to emails and attached content that should have been destroyed during the off-boarding process. While various measures can be taken to prevent future occurrences, the question seeks the most efficient control. Considering that the company already disables accounts promptly and does not allow personal devices to access company systems, option C would be the strongest addition to the current security setup. Restricting access to company systems to expected times of day and geographic locations can prevent unauthorized access after termination effectively. By setting these parameters, even if an account deactivation fails or is delayed, the access would be denied based on other restricting criteria preventing a potential data breach.

Options A, B, and D are less relevant since the issue isn't related to the misuse of mobile devices or applications but rather the residual accessibility of corporate systems. Option E, while valuable for ongoing vigilance, is not the most efficient control for this specific issue because it focuses on actively employed high-risk employees rather than on improving systematic off-boarding processes for all employees.