Departing Engineer Data Download
A software company's DLP tool alerts at 02:14 that a senior backend engineer downloaded 3.2 GB from the source-code repository to a personal cloud storage domain. The engineer resigned nine days ago and is scheduled to leave in five business days. Their role includes access to the code signing service and a customer list used for license renewals. HR has not yet announced the departure. The engineer's manager says the download may be legitimate 'take-home work' and does not want to damage the relationship before a planned knowledge transfer. Legal says the employment contract prohibits removal of confidential information but any investigation must avoid tipping off the employee. The company has a policy of preserving forensic evidence and involving HR before access changes. The source repository logs show 14 repositories accessed in the same session, including two repositories the engineer does not normally use.
1. What immediate actions should security take, and what should it avoid?
Read the worked answer
Immediate actions: preserve DLP, repository, VPN, and endpoint logs; capture the personal-cloud destination and file names; notify legal and HR; open a confidential case; and monitor further uploads. Avoid confronting the engineer, wiping the laptop, or blocking all access in a way that signals an investigation. Also avoid accessing the engineer's personal cloud account without legal authorization. The 02:14 timing, 3.2 GB volume, and two unusual repositories make 'take-home work' less credible, but do not conclude intent yet. Security should determine whether the downloaded repositories contain code-signing secrets, customer data, or only ordinary source. If code-signing material is involved, treat it as a potential supply-chain risk and prepare key rotation without tipping off the employee.
2. How should HR, legal, and the manager be engaged without tipping off the employee?
Read the worked answer
Use a need-to-know group: HR lead, legal counsel, security investigator, and a senior manager who is not the direct manager if the direct manager may warn the employee. Give the manager a scripted, business-as-usual knowledge-transfer plan that does not mention the investigation. HR should confirm policy, notice periods, and interview rights. Legal should approve any forensic review of company devices and any contact with the personal-cloud provider. Preserve privilege where possible. Do not let the manager independently ask the engineer about the download. Set a timeline for deciding whether to interview before the last day, revoke access on the last day, or pursue a formal investigation. Document who knows what and when, because a leak can destroy evidence and create employment-law risk.
3. What access changes and knowledge-transfer controls are appropriate before the last day?
Read the worked answer
Reduce high-risk access without a visible blanket revocation. Remove or require dual approval for code-signing operations; restrict the customer-list export and replace it with a monitored, need-to-know view; require a second person for any bulk repository clone; and monitor uploads to personal cloud. Keep normal collaboration access so the knowledge transfer proceeds. Schedule structured handover sessions with named recipients and documented artifacts. On the last day, disable all accounts, revoke tokens and SSH keys, rotate shared secrets the engineer could access, and confirm device return. If evidence supports intentional exfiltration, legal may direct a different sequence. The goal is to protect code-signing integrity and customer data while preserving the investigation and avoiding an unnecessary confrontation before handover is complete.