Stop these employees from leaking your corporate data

by Jennifer McAdams

April 14, 2008 —

You might know how to secure your network devices and data centers to keep
your corporate intelligence safe. But do you know how to teach your employees
how to guard against attacks -- not generically, but based on the work they
do? Experts suggest that a well-constructed security plan involves customized
training by job function. You need to tell your HR people to manage personnel
files that might reside in multiple locations, your facilities crew to watch
out for people entering the building with fake IDs and your salespeople to guard
access to the company's CRM system.

Trusting an employee with access to mission-critical or sensitive systems is
a risky but unavoidable gamble. Let's face it: People are wild cards. In fact,
let's take the gambling analogy a step further. Just as casinos thwart cheaters
at every table or station on their floors, so, too, can IT officials thwart
breaches by customizing security plans for individual employees in every zone
of their companies.

In fact, casino practices can be translated to the corporate IT world to create
at a common-sense list of do's and don'ts for redoubling security based on who
does what job. The lessons we learn from craps pits and blackjack tables reveal
that it's never wise to entrust your business's most valuable or vulnerable
assets to a single employee. Instead, compartmentalize access whenever possible,
and never hesitate to look over employees' shoulders.

Above all, follow the golden rule of a casino: Gauge your level of risk and
develop airtight audit trails, urges Bruce Schneier, a security expert in Mountain
View, Calif., who has written several books on computer and network security,
including Applied Cryptography (Wiley, 1996). Schneier often uses the casino
metaphor to drive home important points surrounding individualized security.
"If you look at a casino floor, you will notice immediately that people
are watching people," he says. "That's because a lot of cash is moving,
and it's moving very quickly."

Just as edgy casino managers constantly size up everyone on the floor as potential
security threats, so must corporate IT security leaders size up every employee.
"People are the weakest link in security. They always have been, and you
will never change that," Schneier says. "But the reality is that you've
got to deal with people, and people are going to make mistakes."

Security isn't the responsibility of a single security manager or even a security
department. Just as quality was understood in the 1980s to be the responsibility
of everyone in an organization, so, too, is security everyone's responsibility.

Each person in the organization creates, works with, transports and stores
valuable information and physical assets. And each employee has a responsibility
to safeguard those assets. Unfortunately, too often employees aren't educated
by the organization as to what their duties are and how they can effectively
manage risk while still getting their jobs done.

And the idea that an organization must guard against nefarious insider activity
isn't new, either. "Most effective security programs address the people
element, and any job function with access to an organization's valuable resources
or assets is a risk," explains Kent Anderson, managing director of Network
Risk Management LLC in Portland, Ore. Anderson cites a wide range of personnel
who pose mighty risks -- everyone from security guards to IT workers to higher-level
executives with the authority to override security controls.

The people problem continues to grow, since it is now harder to differentiate
between internal and external threats. "The difference between an insider
and an outsider is no longer clear," says Anderson, who cautions corporations
to be aware of the ways that contractors, outsourcers, vendors, partner companies
and suppliers could gain access to sensitive corporate data -- either by accident
or by design.

While spotting risks can be tricky enough, addressing weaknesses is even tougher,
says Anderson. For example, security training programs often prove ineffective,
and many employees will continually disregard advice and fail to pay heed to
the cautionary tales delivered at droning security seminars.

"The average employee view is one-dimensional. These individuals are not
looking at security from the standpoint of accountability for the organization.
They are looking at the issue only as it affects their level of responsibility,"
observes Norris Roberts, director of technology for the Jennings, Mo., school
district.

A quarterly employee-awareness seminar might provide a check for a compliance-driven
security program, but if the employees are left to try to figure out how to
apply security controls to their day-to-day job functions, that will probably
never happen, says Anderson.

Roberts rattles off a list of security measures employees are likely to ignore.
"Strong password practices are not being applied. The sharing of passwords
continues. Good e-mail practices are ignored. And overall, inappropriate user
rights and privileges remain a huge problem," he says.

"The most common mistake when educating end users about security awareness
is that the training is frequently presented in a Draconian fashion, which does
nothing to encourage employees to cooperate with the policies being implemented,"
notes Eddie Zeitler, executive director of International Information Systems
Security Certification Consortium Inc., or (ISC)2, in Palm Harbor, Fla.

"Security awareness doesn't have to be boring," he says, quickly
adding that companies must do far more than just jazz up security training efforts.
To make employees more invested, IT shops must convince workers that security
measures are imposed for the benefit of both employer and employee.

"If employees realize they could lose their jobs over something that could
have been prevented by practicing common-sense security measures, they are given
extra incentive to play by the rules," Zeitler says.

Playing by the rules is non-negotiable at casinos, where the stakes are high.
Corporations that have just as much to lose must constantly communicate the
same message. Only then will granting the privilege of access no longer be such
a gamble.

Computerworld