An organization you work for has always had a somewhat "hands off" approach toward managing information security, which has led to servers under desks, coat closets arbitrarily being turned into wiring closets for network and routing systems, and portable hard drives being used to share large amounts of important data between departments or groups. There is generally a lack of top down structure or enforcement. Based on a rapid shift in the local economy, the company now finds itself needing to downsize staffing levels.

What are some possible threats that could exist as a result of these rapid organizational changes? How have their practices introduced vulnerabilities? Is there anything they could do to quickly limit the risks here through controls?