Q
Q
Q
Q
Information security is as important as physical security, and care should be taken to ensure that information is protected from unauthorised removal, alteration, or denial. Sensitive information on sites that use nuclear or radiological materials could have damaging consequences if this is lost, stolen or disclosed without authorisation. For example, theft of intellectual property could damage a site’s competitiveness or reputation, while detailed information on a facility’s vital areas, defence in depth arrangements, or security responses could be used by adversaries planning a hostile act.
When working at a nuclear site, organisations should take care to protect sensitive information at all times. Employees need to be aware they should not mix personal and professional devices and applications. Many companies have policies in place on situational awareness (for example, where to answer official phone calls, transmission of information overseas) and restricted items (for example, the use of USB keys and number of prints or copies of a document). In addition, loss or compromise of information should be reported, with the possibility of disciplinary action for those in breach.
As employees look to move organisations, their risk profile can change. According to research by CERT, intellectual property may be stolen by scientists, engineers, programmers and sales people they have worked on; ‘because of their personal investment, some emotional attachment or a sense of entitlement might be established to the IP’. Accordingly, ‘their actions will most likely take place within 60 days of leaving an organisation, before or after, and data theft may occur in numerous ways, not just by theft of physical documents or illicit transfers of data’. For example, in 1999 a former employee of Los Alamos Laboratory took highly classified information home as a backup system to make consulting work easier after leaving the organisation. Similarly, disgruntled employees may seek to sabotage or commit fraud before leaving a company.
Organisations should ensure that employees’ activities are routinely monitored for suspicious behaviours, and prepare for when employees leave an organisation. This includes limiting any access to agreed levels (if any), stopping access where there is no agreement, and where staff have privileged network access and may have grievances, ensuring that no vulnerabilities have been installed. Furthermore, organisations should regularly change their administration codes so that the working knowledge of former employees is less useful over time.
Further Reading:
Sellafield Ltd., ‘How do I manage information marked OFFICIAL-SENSITIVE?’, 2019
