Infringement
Disruption of Business Operations
Excessive Personal Use
Exfiltration via Email
Exfiltration via Media Capture
Exfiltration via Messaging Applications
Exfiltration via Other Network Medium
Exfiltration via Physical Medium
- Exfiltration via Bring Your Own Device (BYOD)
- Exfiltration via Disk Media
- Exfiltration via Floppy Disk
- Exfiltration via New Internal Drive
- Exfiltration via Physical Access to System Drive
- Exfiltration via Physical Documents
- Exfiltration via Target Disk Mode
- Exfiltration via USB Mass Storage Device
- Exfiltration via USB to Mobile Device
- Exfiltration via USB to USB Data Transfer
Exfiltration via Web Service
Harassment and Discrimination
Inappropriate Web Browsing
Installing Unapproved Software
Misappropriation of Funds
Non-Corporate Device
Providing Access to a Unauthorized Third Party
Public Statements Resulting in Brand Damage
Sharing on AI Chatbot Platforms
Theft
Unauthorized Changes to IT Systems
Unauthorized Printing of Documents
Unauthorized VPN Client
Unlawfully Accessing Copyrighted Material
- ID: IF012
- Created: 03rd June 2024
- Updated: 05th July 2024
- Contributor: The ITM Team
Public Statements Resulting in Brand Damage
A subject makes comments either in-person or online that can damage the organization's brand through association.
Subsections
ID | Name | Description |
---|---|---|
IF012.001 | Statements On Organization's Social Media | A subject uses existing access to social media accounts owned by the organization to post statements or other media that can result in brand damage. |
IF012.002 | Statements On Personal Social Media | A subject uses personal social media accounts to post statements or other media that can result in brand damage through association between the subject and their employer. |
Prevention
ID | Name | Description |
---|---|---|
PV004 | Enforce a Social Media Policy | A social media policy is a set of rules that governs how employees should use social media platforms in connection with their work. It outlines acceptable and unacceptable behaviors, helps employees understand the consequences of misuse, and serves as a deterrent by promoting accountability, raising awareness of risks, and ensuring consistent enforcement. |
PV013 | Pre-Employment Background Checks | Background checks should be conducted to ensure whether the information provided by the candidate during the interview process is truthful. This could include employment and educational reference checks, and a criminal background check. Background checks can highlight specific risks, such as a potential for extortion. |
Detection
ID | Name | Description |
---|---|---|
DT033 | Closed-Circuit Television | CCTV can be used to observe activity within or around a site. This control can help to detect preparation or infringement activities and record it to a video file. |
DT049 | Social Media Monitoring | Social Media Monitoring refers to monitoring social media interactions to identify organizational risks, such as employees disclosing confidential information and making statements that could harm the organization (either directly or through an employment association). |