I found that an employee who is no longer with us uploaded a giant Excel file containing HR information into Slack. The file is available to anyone in our Slack and contains names of all current and former employees, their contact details, full names, who has stock options, annual leave entitlements, HR history and various notes about them, but not the compensation details. The file is somehow there and can be found in search, but is not attached to any message or posted into any channel (not sure how that works).
Should I tell our CTO about this?
Yes, you should inform your CISO or CTO in writing.
In the verticals I have worked, stock options fall under executive compensation, and executive compensation is classified as high value data.
The high value classification includes mergers and acquisitions, pending litigation, executive compensation, company performance reports like unreleased SEC filings, etc.
Employee data is usually classified as medium or low value data. The data includes name address, phone number, social security number, etc.
And to add a twist, Slack may be encrypting the data such that only your company can decrypt it, so there may not be an external leak at all. (I don't know Slack and I have not performed a security evaluation on it, so I can't say what it is doing).
Companies care greatly if high value data is lost or leaked because of potential financial and reputational harm to the firm, especially in regulated environments like US Financial. Companies don't cares as much if social security numbers or bank accounts numbers are leaked since there's little risk associated with losing it.
And keep in mind risk is democratized by passing losses onto share holders, and reward is privatized through executive bonuses, so most data loss does not materially affect executives.
I don't have a plausible explanation for how I found this file (yeah, I was poking around our Slack on a weekend to see what I can find)
It does not really matter. You [hopefully] found it before a bad actor. I doubt anyone is going to blame you for it.
Also, we are a fairly small company (less than 200 people), so we don't have any official published policies regarding any of this.
Yes, that's fairly typical for small companies and firms.
It is a gap in your company's policies and procedures, and the executives need to address it. Until the executives decide to address it, the best you can do is report the incident to the CISO, CTO or other management.
If interested, in US Financial, I worked as a security architect in risk. I was responsible for evaluating internal systems and vendors systems (and vendor proposals).
We did three or four things:
- Classify the data according to firm's policies and procedures
- Perform a security evaluation on the system, ensuring the system could handle the data according to firm's policies and procedures
- Provide suggested changes to ensure the data was handled according to firm's policies and procedures
Sometimes a vendor would refuse to bring a system in compliance with the firms policies and procedures. In this case, the executive sponsoring the initiative could say "I don't care, I want it anyway". If the executive said that, then the system and its security evaluation was sent to a Risk Committee to perform a detailed Cost/Benefit Analysis and determine if the firm should override my decision. The Risk Committee had final say on the matter.
The projects that gave me the hardest time were the "Board Pad" apps as I called them. Every executive wanted to go paperless and put company business on their iPads for board meetings. And of course, since they were executives, they wanted to carry around mergers and acquisitions, pending litigation, executive compensation, company performance reports. All protected with a 4 digit PIN code because the developer though Apple's authentication was adequate enough. Sigh...