Are staff blowing your business secrets?

DOES the word "confidential" make your ears prick up? If so, you're not alone. There are plenty of ways well-meaning staff could be blowing your business secrets.

Edward Snowden

THE business is traveling nicely and you're surrounded with trusted staff.

But what happens if something goes awry and the trust is broken or someone leaves the business - along with your top secrets?

Prevention is better than the cure so it is best to get your house in order from the outset. For starters, staff need to understand they have a moral obligation to protect the secrets.

Also, they need to take care with the important information they are handling that, if leaked, could undermine the business.

Making it formal

Depending on your industry, you may wish to enter into a formal agreement with staff. Otherwise it is very hard to prove a breach of confidentiality and discipline staff.

Make sure you back up your trade secrets with a confidentiality agreement signed by every person who has knowledge of any secrets.

John Downes, director of Acorro business advisers, says most contracts of employment have sections included on moral obligations, the ownership of intellectual property, confidentiality of business and customer and employee information.

"Templates are readily available through employer organisations," he says.

Office gossips

Recognising the risks

Deloitte risk services partner Jean-Marie Abi-Ghanem says it is vital that staff don't take the important information they are privy to for granted.

"Staff will need to believe in the value of the information they possess," he says.

He says internal campaigns within the workplace should target the importance of care with secret information. He cautions that security always starts with the basics, and says it is a not so much matter of being hacked, because that can happen, but it is more an issue as to how the business is going to get back on track.

The level of diligence required may well depend on the type of business you are running.

Technology traps

The prevalence of technology in business continues to grow - from corporate emails on personal phones and corporate laptops used remotely to the use of public internet and WiFi facilities. This means that the lines of security and corporate confidentiality are being blurred, Abi-Ghanem says.

"Staff must possess the necessary training, tools and techniques to protect your information. This could be something as simple as encrypted USB drives, combined with the necessary training and awareness."

He says it might be as simple as not leaving technology lying around the office unsecured. While one bit of information might not be of value, a few bits may have the potential to undermine your business.

Another simple thing to do is put passwords on devices.

Edward Snowden

Getting it right

Downes says the basic problem is that, despite predictions of a paperless office, we are printing more material than ever before.

"That means there is a huge amount of sensitive information being released to landfill - without it being shredded or put through security destruction.

"In fact, the plethora of information is so great that people are becoming blase about it. They have become desensitised by the abundance of paper, emails, tweets and posts," he says.

Downes warns that rather than hackers and industrial espionage, the biggest threat comes from within.

"The desensitising of people's perception of what needs to be kept secure and the social currency of being online all the time is a recipe for the seemingly innocuous posting of sensitive opinions, perceptions and information about a business."

KEEPING IT TOP SECRET

• Impress upon your staff the importance of keeping devices safe.
• Train staff about the potential problems of mixing work and private material on devices.
• If it is a business device,warn them about using it for potentially embarrassing private uses.
• Rules about not leaving a room with laptops, and other sensitive material, lying around should be hammered home.
• Passwords need to be changed regularly and not divulged too widely.
• All important information on devices needs to be backed up in case they are lost or damaged.