 
  See your link here
|
For more info on a specific newsletter, click the title. Details will be displayed in a new window.
Subscribe to
Computerworld 40 years of the most authoritative source of news and information for IT leaders.
Employee Security Training: Beyond Posters
or
Other Security Stories
|
|
|
|
April 17, 2006 (Computerworld) -- It's the kind of breach that companies fear: workers giving out network log-in names or changing passwords when asked to by someone posing as an IT staffer.
The best firewalls on the market can't protect against such scenarios.
"Why even lock your doors if employees happily hold them open for a stranger following behind them?" asks Alex Ryan, security officer at VeriCenter Inc., an IT infrastructure and managed services provider in Houston.
The risk that employees pose is significant. They can fall prey to social engineering, a fancy term for being conned. They can ignore company policy by failing to encrypt sensitive data. Or they might install unauthorized software that can corrupt the system.
Think you're well protected? Recent findings from the Computing Technology Industry Association might convince you otherwise. In this year's CompTIA information security study, 59% of the organizations surveyed indicated that their latest security breaches were the result of human error alone. That's up from 47% last year.
Despite such statistics, many companies fail to do enough to educate their workers. That's what the Internal Revenue Service discovered, according to a March 2005 federal government report.
Federal inspectors posing as IT help desk staffers trying to correct a network problem called 100 IRS managers and employees and asked them to provide their network log-in names and temporarily change their passwords to ones they suggested. Inspectors persuaded 35 IRS workers to do just that.
This success came despite IRS efforts to educate employees.
Dan Galik, the IRS's chief security officer, says his agency "re-energized the awareness program" following the report. In addition to annual reviews, posted announcements and online courses mandated under the 2002 Federal Information Security Management Act, Galik says the agency has added some innovative approaches.
One was a Jeopardy-style game held last November during which workers tried to give the right answers on security-related topics.
"You've got to come up with something that will stick," Galik says.
Here are some other practices that have proved effective in getting the message across.
Make It Personal
"Many employees worry about their home machines' security. Leverage that concern to promote general security principles that can be applied at both home and work," Ryan says. "It's a way to make people personally interested in security." She e-mails employees newsletters with tips that alert them to the latest scams or viruses that could affect both their work and personal PCs.
Source: Exclusive Computerworld survey, March 2006
Companies can also use personal examples to show what they're trying to achieve on a corporate level, says IT security expert Candy Alexander, a consultant at Alexander Advisory LLC in Merrimack, N.H. For example, companies can tell workers that protecting passwords is no less important than protecting their debit cards' PINs.
|
Print this Story |
|
Send Us Feedback |
|
E-mail this Story |
|
Digg this Story |
|
Slashdot this Story |
|
|
|
|
|
|
|
 |
| All Zones Application Performance Zone Business Continuity Zone The File Data Management Zone Security Management Zone The SAS Zone Business Intelligence and Analytics Zone Windows Protection Zone The Enterprise Search Zone Software as a Service Zone |
|
See your link here
|
 |
||||||||
| ||||||||
| ||||||||
| ||||||||
|
From Laggard to Leader: Transforming the Data Center
Download this Executive Bulletin (a $49.95 value) for free, compliments of MessageLabs. 
Download this whitepaper to learn how to outsmart spam & viruses, compliments of MessageLabs.
Read up on the latest ideas and technologies from companies that sell hardware, software and services. 
- Update: AMD spins off manufacturing to cut costs, raise funds
- Microsoft's (un)secret weapon for winning the BI battle
- IBM launches Bluehouse, a Facebook for business
- More top stories
Go Green with Webroot® Perimeter Security SaaS! Webroot Perimeter Security SaaS is a powerful alternative to obsolete on-premise hardware based security solutions. SaaS allows businesses to obtain flexible protection through an expert security provider, solving the problems caused by software, hardware and appliance solutions. Benefits include easier manageability, better protection and guaranteed performance –all at a lower cost. Register for your free copy of the "Why Security SaaS Makes Sense" whitepaper and Go Green with Webroot! Download this white paper now!
|
 Fired up about IT? Join Sharkbait and share your true tales of IT. SharkBait is the place for you to sound off about everything IT – the good, the bad, and the rest of the weird stuff you deal with every day.New baits 
|
|
|
John Brandon: Google Chrome = Dead, Google Search = HotI think the browser has become almost inconsequential, a bright blip that has faded faster than my summer tan. ... [more] |
