For more info on a specific newsletter, click the title. Details will be displayed in a new window.
Subscribe to
Computerworld 40 years of the most authoritative source of news and information for IT leaders.
Employee Security Training: Beyond Posters
or
Other Careers Stories
|
|
|
|
April 17, 2006 (Computerworld) -- It's the kind of breach that companies fear: workers giving out network log-in names or changing passwords when asked to by someone posing as an IT staffer.
The best firewalls on the market can't protect against such scenarios.
"Why even lock your doors if employees happily hold them open for a stranger following behind them?" asks Alex Ryan, security officer at VeriCenter Inc., an IT infrastructure and managed services provider in Houston.
The risk that employees pose is significant. They can fall prey to social engineering, a fancy term for being conned. They can ignore company policy by failing to encrypt sensitive data. Or they might install unauthorized software that can corrupt the system.
Think you're well protected? Recent findings from the Computing Technology Industry Association might convince you otherwise. In this year's CompTIA information security study, 59% of the organizations surveyed indicated that their latest security breaches were the result of human error alone. That's up from 47% last year.
Despite such statistics, many companies fail to do enough to educate their workers. That's what the Internal Revenue Service discovered, according to a March 2005 federal government report.
Federal inspectors posing as IT help desk staffers trying to correct a network problem called 100 IRS managers and employees and asked them to provide their network log-in names and temporarily change their passwords to ones they suggested. Inspectors persuaded 35 IRS workers to do just that.
This success came despite IRS efforts to educate employees.
Dan Galik, the IRS's chief security officer, says his agency "re-energized the awareness program" following the report. In addition to annual reviews, posted announcements and online courses mandated under the 2002 Federal Information Security Management Act, Galik says the agency has added some innovative approaches.
One was a Jeopardy-style game held last November during which workers tried to give the right answers on security-related topics.
"You've got to come up with something that will stick," Galik says.
Here are some other practices that have proved effective in getting the message across.
Make It Personal
"Many employees worry about their home machines' security. Leverage that concern to promote general security principles that can be applied at both home and work," Ryan says. "It's a way to make people personally interested in security." She e-mails employees newsletters with tips that alert them to the latest scams or viruses that could affect both their work and personal PCs.
Source: Exclusive Computerworld survey, March 2006
Companies can also use personal examples to show what they're trying to achieve on a corporate level, says IT security expert Candy Alexander, a consultant at Alexander Advisory LLC in Merrimack, N.H. For example, companies can tell workers that protecting passwords is no less important than protecting their debit cards' PINs.
If you have the luxury of getting people into a classroom for training, Ryan recommends a little live action to drive home the message. She has enlisted students during classes to act out roles, such as a hacker and an administrative assistant. She instructs the hacker to pressure the assistant for his computer password with techniques that real-life social engineers use.
Companies also shouldn't underestimate the power of publicity, says IT security expert Jim Litchko.
He points to a situation that played out at a government intelligence agency where a senior official, against agency policy, brought in a disk that turned out to contain a virus. The agency fired him and let everyone know it.
"To those people who value their jobs, it's very effective" in highlighting the importance of security, says Litchko, president of Litchko & Associates Inc., an IT consulting firm in Kensington, Md., and past chairman of the IT security council for ASIS International, an organization of security professionals.
Employees should also have simple steps to follow if they suspect security problems. Litchko says one company had stickers on its computers providing information on typical scams, along with a number to call for help.
Integrate Security Awareness
Companies that consider security training an annual event are missing out on opportunities to make security part of the everyday culture, says Jonathan G. Gossels, president of SystemExperts Corp., a Sudbury, Mass.-based network security consulting firm.
Gossels recommends leveraging ongoing training events. He notes that one client, a large chemical company, incorporates security components into its regular professional development courses.
"No one would take time out to take a security course, but to take 15 minutes in another course works well. And they're able to tune the security message to the people taking the course," Gossels says.
Also, don't let security become an "out of sight, out of mind" issue, says Litchko.
"It has to be a continual thing. You can't just put up a poster and keep it there a year. It needs to be constant and varied."
In addition to her monthly security newsletters, VeriCenter's Ryan regularly e-mails summaries of news articles related to IT security.
Another way to keep security on everyone's mind is to use technology itself to remind them, says Joel Rakow, the e-crimes practice leader at Tatum LLC, an executive consulting and services firm in Atlanta. Companies can have security-related tips and reminders -- like "Our data is sensitive information," or "Customer information is available on a need-to-know basis" -- flash up on screensavers.
Like so much else in IT, security training should not take a one-size-fits-all approach, says Susan Hansche, program manager at Nortel Government Solutions Inc., a Fairfax, Va.-based company that provides information-assurance training programs to the U.S. Department of State.
Hansche recommends role-based training, where the messages and action items are targeted to specific audiences. Her company, for example, uses eight different role-based programs to train 1,000 State Department employees annually. The courses for executives are different from those for senior-level managers and general end users.
Alexander has taken a similar approach to training. She says executives like war stories, middle managers prefer presentations that give them checklists of action items, and general end users like information in small, easily digestible chucks.
When Alexander worked at the former Digital Equipment Corp., she developed a scavenger hunt that asked workers to find 10 items related to security on the company's Web site. Those who got all 10 were entered into a drawing to win a mug.
You might be surprised to learn that the nonmandatory event drew in more than 70% of the company's worldwide workforce. "Positive competition is really beneficial," Alexander says.
K Rudolph says she has seen similar success with competitive programs. Rudolph is a Certified Information Systems Security Professional and chief inspiration officer at Native Intelligence Inc., a company in Glenelg, Md., that provides IT security awareness services to government agencies and private industry.
She says one of her clients implemented a "news hawk" program, where the first employee to bring in a news story on IT security gets a prize. Prizes have ranged from time off to movie tickets. The awareness team then distributes the news item through a weekly e-mail or its periodic newsletter.
Make It Fun
IT security is a serious topic, but security officials have found that some levity helps keep workers' attention.
Alexander, like many others, has used Web-based training to educate employees on security topics and used online quizzes to test their knowledge. Although the material covered significant topics, she still found ways to elicit some smirks. For example, the multiple-choice answers for "What is social engineering?" included "a college degree" and "a job on a cruise line" -- obviously false answers infused with a hint of dry wit.
"It's not extremely silly," Alexander says, "but it's something to make people remember."
Pratt is a Computerworld contributing writer in Waltham, Mass. Contact her at marykpratt@verizon.net.
- The Business of Security
- Risk-Based Security Model
- The Big Picture: Security Dashboards
- Avoiding Security Spending Fatigue
- Securing Data with Classification Schemes
- Employee Security Training: Beyond Posters
- Explainer: Security standards and frameworks
- Skills: Chief Risk Officer
- QuickStudy: Computer forensics
- Personal memory device security leaks
- No Silver Bullet
- IT Management Survey: Security
- Biometric Authentication: Sci-Fi Security Enters Mainstream IT
|
Print this Story |
|
Send Us Feedback |
|
E-mail this Story |
|
Digg this Story |
|
Slashdot this Story |
|
|
|
|
|
|
 |
|
All Zones Application Performance Zone Enterprise-Class Security Zone Enterprise Solutions Zone The File Data Management Zone Grid Computing on Windows Zone Security Management Zone ITIL Best Practices Zone The SAS Zone Storage Virtualization Zone The Data Center Management Zone |
 See your link here
|
 |
||||||||
| ||||||||
| ||||||||
| ||||||||
|
Download this Computerworld Report, free, compliments of HP.
Long Tail Supplier Collaboration - What's In It For You? 
Download this white paper, free, compliments of Sunbelt Software.
Read up on the latest ideas and technologies from companies that sell hardware, software and services.
- Mozilla launches Firefox 3.0 RC1 early
- Microsoft: Don't misunderstand UAC, other Vista features
- HP confirms XP SP3 endless reboot snafu, promises patch
- More top stories
|
March 9-11, 2008 |
The Impact of Messaging and Web Threats Messaging, internal and Web-based threats are increasing in number and severity. The risks to organizations large and small are real problems that users and their employers face if they do not establish adequate defenses against this growing variety of threats.Read this Osterman Research paper to learn how organizations must implement a layered defensive strategy to protect against all types of threats and how Sunbelt Software can help. Download this white paper now
|
 Fired up about IT? Join Sharkbait and share your true tales of IT. SharkBait is the place for you to sound off about everything IT – the good, the bad, and the rest of the weird stuff you deal with every day.New baits 
|
| XenServer FREE trial Citrix XenServer is the simplest and most effective way to virtualize and provision servers. XenServer combines comprehensive server virtualization capabilities with unparalleled scalability, performance, economics, and ease-of-use. Based on the open source Xen hypervisor, XenServer delivers fast performance, easy management, and advanced features such as live migration. |
