A newly-hired Chief Information Security Officer (CISO) is faced with improving security for a company with low morale and numerous disgruntled employees. After reviewing the situation for several…

Employees posting on external social media from company or personal devices involves expressive personal behavior that internal technical controls cannot fully block without also restricting legitimate business use of the same platforms.

An employee remotely configuring an external mail server using company systems during work hours can be blocked through technical controls such as outbound firewall rules restricting remote administration protocols like SSH, RDP, or SMTP management ports, as well as network-level data loss prevention policies. These controls are enforced automatically by the system and do not rely on the employee's willingness to comply, making them effective even in a low-morale environment. The new security policy can mandate these controls at the network perimeter or endpoint level.

Negative comments posted from employees' personal phones over personal networks fall entirely outside the reach of company-enforced technical controls, as the company has no jurisdiction over personal devices or connections.

Web page cloning is performed by external parties on infrastructure entirely outside the company's network perimeter, making internal technical controls powerless to prevent it.