Then one designer put in his two weeks and spent the majority of the time downloading all the site files for all of the sites the company had built over the two years he was there. We're talking hundreds of static sites where he took the all the design docs and static HTML/CSS/JS files one would need to recreate them somewhere else.
Instead of going after the guy legally, they passed and then instituted the same policy. You put in your two weeks? Nah, you're out the moment you hit send on that email. Manager alerts security, who then come over to your desk. You get your jacket and whatever you walked in with and get walked out. The one designer totally ruined the company from ever letting someone stay for their two weeks.
It could have been unannounced and they just stop showing up.
You either trust your people or you don't. If you don't, get rid of them and lock them out. If you do and you still have to let them go then don't worry about it.
People are far too inhuman in professional relationships and I strongly dislike that tendency. You likely spend as much time with your colleagues as your spouse, make it a real connection.
If you can't meet that use keycards instead of keys, voip instead of real phones, lock file cabinets, I mean go all the way.
Corporate America loves pretending. Pretending you're part of the family and then treating you like you're trying to rob the place at the drop of a hat.
That's the messed up thing. Be consistent and don't be fake. People can deal with you for being overly formal and paranoid but probably not for being a phony backstabber, that's how you grow haters.
The hardest thing for a brand to shake off is a bad reputation, whether they justly deserved it or not. You don't want haters in the Internet age.
Yes, most reasonable adults remain reasonable even after fired
But once you hire a thousand, ten thousand, a hundred thousand people… statistically there are gonna be some wackos you didn’t filter out!
It’s tough. I agree that treating each other like humans is the best policy.
Also if you want to work with the people you like again but need to actually downsize because of external pressure, good luck trying to get them to come work for you at your next venture after some fucked up bridge burning ceremony.
This will work for the first 5-10-20 people, then word of mouth goes out about this policy and your evil designer is downloading everything the day before sending their resignation mail.
Though with sales orgs I think this is almost an expected practice - sales people are often hired on the tactit, never officially acknowledged basis that they will bring their leads list.
maybe the phone number too
You make it sound like he poached your clients or extorted your company. As they didn't go after him legally, I assume that didn't happen.
I assume all the files are on a thumb drive in his drawer, unopened, just in case he wants to remember how "that cool animation" was implemented. And when that moment comes, he will not find the thumb drive, anyway.
And all that security charade will accomplish is that people who care enough about their work, will make a copy the day before they quit. Congratulations, your policy achieved nothing, except get rid of their two weeks notice and everyone feel a bit worse working for you.
It feels like if an employee did this with modern projects, they would at the very least be summarily fired, if not have legal action taken against them.
No, it's the over-reaction by whoever instituted that policy that ruined the company. They should've cut their losses and ignore the outlier, perhaps make it tad more difficult to copy off data en masse without being noticed, and/or do many other things addressing this risk without ruining the workplace for everyone else.
This is the organizational equivalent of autoimmune disease. Works at every scale. On national/international scale, this is what terrorist organizations are exploiting - do an X amount of damage that may even be counterproductive to their goal, and watch the victim do 1000X damage to itself by overreaction.
The only thing that that accomplishes is that people don't put any notice.
1984 is so appealing for so many people, it seems like it is just a book about the tendencies that power can take when it is not guided by sane principles. I have always been employed in a high trust capacity since I was a young adult, there is not a technically feasible system in the world that could prevent me from wrecking havoc in a company. Social ones though, they are extremely effective.
All the DLPs rely on, effectively, regular expression searches of traffic.
This is fine if what you need to protect are SSNs, phone numbers, credit card numbers... but if your data is not easily recognized that way, they don't work.
If you ask the DLP vendors about their threat model -- and the salespeople generally don't know what a threat model is -- it's always a set of stories about a salesperson who clicks the download-as-CSV button on a CRM system, a DB reporting specialist who generates a report full of raw passwords and credit card numbers, and an off-shore programmer who sends AWS credentials via email.
Hopefully you can spot the non-DLP prevention mechanisms for all of these...
What is it?
https://www.cnbc.com/amp/2020/08/04/anthony-levandowski-gets...
Sure, they can't do any of that, and development becomes miserable. You don't have to go full VM and remote desktop to prevent those things.
Basically the machine is not allowed to access the internet and USB drives do not work. Only specific locked down applications like the email app, web browser, and so forth have internet access. Downloads are allowed but uploads are not.
A permissions interface is available for say legitimate transfers of data to a flash drive or a web upload, in that case the user will have to add a valid reason and the specific files into the form. Once that's checked and approved by a higher-up the files are temporarily placed in a special folder that permits transfer out. The same thing goes for external emails that aren't on a whitelist, they'll need approval before they get sent.
What VMs are helpful for is cross-contamination and spyware attacks from other clients a contractor is working for.
If someone is fired for cause then they go immediately, but if they are given notice then they are usually trusted with access, and it rarely goes wrong.
Stealing IP is rare because it's hard to benefit from it. If stolen IP is offered to another company, usually they report it to the owner to cover their backs legally. Funders are not going to want to invest in a company that is based on stolen IP, where their investment can become worthless overnight.
So I think these stories about how 'we have to treat employees like they are potential criminals' (not accusing parent of that, but you hear them) are bugos. Treating people like human beings is both right and economically efficient.
If I trusted them for the 3 years they worked for me, I can trust them for another week or two.
Tie up loose ends, take your time. We're all adults here.
I understand that under the worst circumstances bad things can happen but that's always the case.