Getting security into employees heads

It's the kind of breach that companies fear: workers giving out network log-in names or changing passwords when asked to by someone posing as an IT staffer.

The best firewalls on the market can't protect against such scenarios.

"Why even lock your doors if employees happily hold them open for a stranger following behind them?" asks Alex Ryan, security officer at VeriCenter, an IT infrastructure and managed services provider.

The risk that employees pose is significant. They can fall prey to social engineering, a fancy term for being conned. They can ignore company policy by failing to encrypt sensitive data. Or they might install unauthorized software that can corrupt the system.

Think you're well protected? Recent findings from the Computing Technology Industry Association might convince you otherwise. In this year's CompTIA information security study, 59 percent of the organizations surveyed indicated that their latest security breaches were the result of human error alone. That's up from 47 percent last year.

Despite such statistics, many companies fail to do enough to educate their workers. That's what the Internal Revenue Service discovered, according to a March 2005 federal government report.

Federal inspectors posing as IT help desk staffers trying to correct a network problem called 100 IRS managers and employees and asked them to provide their network log-in names and temporarily change their passwords to ones they suggested. Inspectors persuaded 35 IRS workers to do just that.

This success came despite IRS efforts to educate employees.

Dan Galik, the IRS's chief security officer, says his agency "re-energized the awareness program" following the report. In addition to annual reviews, posted announcements and online courses mandated under the 2002 Federal Information Security Management Act, Galik says the agency has added some innovative approaches.

One was a Jeopardy-style game held last November during which workers tried to give the right answers on security-related topics.

"You've got to come up with something that will stick," Galik says.

Here are some other practices that have proved effective in getting the message across.

Make It Personal

"Many employees worry about their home machines' security. Leverage that concern to promote general security principles that can be applied at both home and work," Ryan says. "It's a way to make people personally interested in security." She e-mails employees newsletters with tips that alert them to the latest scams or viruses that could affect both their work and personal PCs.

Companies can also use personal examples to show what they're trying to achieve on a corporate level, says IT security expert Candy Alexander, a consultant at Alexander Advisory. For example, companies can tell workers that protecting passwords is no less important than protecting their debit cards' PINs.

If you have the luxury of getting people into a classroom for training, Ryan recommends a little live action to drive home the message. She has enlisted students during classes to act out roles, such as a hacker and an administrative assistant. She instructs the hacker to pressure the assistant for his computer password with techniques that real-life social engineers use.

Companies also shouldn't underestimate the power of publicity, says IT security expert Jim Litchko.

He points to a situation that played out at a government intelligence agency where a senior official, against agency policy, brought in a disk that turned out to contain a virus. The agency fired him and let everyone know it.

"To those people who value their jobs, it's very effective" in highlighting the importance of security, says Litchko, president of Litchko & Associates, an IT consulting firm, and past chairman of the IT security council for ASIS International, an organization of security professionals.

Employees should also have simple steps to follow if they suspect security problems. Litchko says one company had stickers on its computers providing information on typical scams, along with a number to call for help.

• Bookmark this page
• Share this article
  •  
  • facebook
  • slashdot
  • digg
  • Reddit
  • stumbleupon
  • linkedin
  • twitter
• Got more on this story? Email Computerworld
• Follow Computerworld on twitter

• Share
  Share this article

  •  google+
  • facebookfacebook
  • slashdotslashdot
  • diggdigg
  • RedditReddit
  • stumbleuponstumbleupon
  • linkedinlinkedin
  • twittertwitter
• print
• email
• Bookmark