 | Chapter 13 Personnel Security |  |
| Chapter 13 Personnel Security | |
Your security concerns with an employee should not stop after that person is hired.
Every potential computer user should undergo fundamental education in security policy as a matter of course. At the least, this education should include procedures for password selection and use, physical access to computers, backup procedures, dial-in policies, and the policies for divulging information over the telephone. Executives should not be excluded from these classes because of their status - they are as likely (or more likely) as other personnel to pick poor passwords and commit other errors. They, too, must demonstrate their commitment to security: security consciousness flows from the top down, not the other way.
Education should include written materials and a copy of the computer-use policy. The education should include discussion of appropriate and inappropriate use of the computers and networks, personal use of computing equipment (during and after hours), policy on ownership and use of electronic mail, and policies on the import and export of software and papers. Penalties for violations of these policies should also be detailed.
All users should sign a form acknowledging the receipt of this information, and their acceptance of its restrictions. These forms should be retained. Later, if any question arises as to whether the employee was given prior warning about what was allowed, there will be proof.
Periodically, users should be presented with refresher information about security and appropriate use of the computers. This retraining is an opportunity to explain good practice, remind users of current threats and their consequences, and provide a forum to air questions and concerns.
Your staff should also be given adequate opportunities for ongoing training. This training should include support to attend professional conferences and seminars, to subscribe to professional and trade periodicals, and to obtain reference books and other training materials. Your staff must also be given sufficient time to make use of the material, and positive incentives to master it.
Coupled with periodic education, you may wish to employ various methods of continuing awareness. These methods could include putting up posters or notices about good practice,[1] having periodic messages of the day with tips and reminders, having an "Awareness Day" every few months, or having other events to keep security from fading into the background.
[1] If you do this, change them periodically. A poster or notice that has not changed in many months becomes invisible.
Of course, the nature of your organization, the level of threat and possible loss, and the size and nature of your user population should all be factored into your plans. The cost of awareness activities should also be considered and budgeted in advance.
The performance of your staff should be reviewed periodically. In particular, the staff should be given credit and rewarded for professional growth and good practice. At the same time, problems should be identified and addressed in a constructive manner. You must encourage staff members to increase their abilities and enhance their understanding.
You also want to avoid creating situations in which staff members feel overworked, underappreciated, or ignored. Creating such a working environment can lead to carelessness and a lack of interest in protecting the interests of the organization. The staff could also leave for better opportunities. Or worse, the staff could become involved in acts of disruption as a matter of revenge. Overtime must be an exception and not the rule, and all employees-especially those in critical positions-must be given adequate holiday and vacation time.
In general, users with privileges should be monitored for signs of excessive stress, personal problems, or other indications of difficulties. Identifying such problems and providing help, where possible, is at the very least humane. Such practice is also a way to preserve valuable resources - the users themselves, and the resources to which they have access. A user under considerable financial or personal stress might spontaneously take some action that he would never consider under more normal situations...and that action might be damaging to your operations.
Ensure that auditing of access to equipment and data is enabled, and is monitored. Furthermore, ensure that anyone with such access knows that auditing is enabled. Many instances of computer abuse are spontaneous in nature. If a possible malefactor knows that the activity and access are logged, he might be discouraged in his actions.
Consider carefully the time-tested principles of least privilege and separation of duties. These should be employed wherever practical in your operations.
This principle states that you give each person the minimum access necessary to do his or her job. This restricted access is both logical (access to accounts, networks, programs) and physical (access to computers, backup tapes, and other peripherals). If every user has accounts on every system and has physical access to everything, then all users are roughly equivalent in level of threat.
This principle states that you should carefully separate duties so that people involved in checking for inappropriate use are not also capable of making such inappropriate use. Thus, having all the security functions and audit responsibilities reside in the same person is dangerous. This practice can lead to a case in which the person may violate security policy and commit prohibited acts, yet in which no other person sees the audit trail to be alerted to the problem.
Personnel leave, sometimes on their own, and sometimes involuntarily. In either case, you should have a defined set of actions for how to handle the departure. This procedure should include shutting down accounts; forwarding email; changing critical passwords, phone numbers, and combinations; and otherwise removing access to your systems.
In some environments, this suggestion may be too drastic. In the case of a university, for instance, graduated students might be allowed to keep accounts active for months or years after they leave. In such cases, you must determine exactly what access is to be allowed and what access is to be disallowed. Make certain that the personnel involved know exactly what the limits are.
In other environments, a departure is quite sudden and dramatic. Someone may show up at work, only to find the locks changed and a security guard waiting with a box containing everything that was in the user's desk drawers. The account has already been deleted; all system passwords have been changed; and the user's office phone number is no longer assigned. This form of separation management is quite common in financial service industries, and is understood to be part of the job.
|  | |
| 13.1 Background Checks |  | 13.3 Outsiders |