Risktraining.info
Most people lie on their CV's (73% of men and 56% of women according to a recent poll). A lot of people steal stationery, use office printers and photocopiers for their own purposes and when not explicitly stopped may well conduct a bit of extra personal or commercial business on the side during work hours.
It is an important balance how you deal with this, a security policy (or staff handbook) should set out clear guidelines, but then again, is someone taking a few postit notes home that bad a thing if they are a generally good worker?
Vetting CV's is a complicated procedure, however, since the time of recruitment is the best time to check out a staff member, it is worth putting a lot of care into this and actually following up references, and if this is a key position, having them checked out by an external company. It is also worthwhile your interviewing staff going on a course on interview techniques to teach them how to sort out some of these CV misrepresentations at the interview.
In the rest of this section, we will look in some detail at various staff related risks.
Some statistics from a DTI Security Survey in 2000, covering 1000 companies:
30% of companies do not consider their information as sensitive.
Some more figures suggest that by far the vast majority of "hacking"
is caused by insiders, that very few companies are in any way prepared
for a virus attack and that it is only when vital data is lost that
a company may realise how poor its backup strategy (if indeed, they have
one) actually is.
The false sense of security (or the Ostrich Approach) to Risk and Security
may well work for a while, but in the long term it can cause corporate and
financial disaster if not the complete collapse of a company.
This is great, until the day that Mrs Smith is run over by a bus,
falls ill or runs away to Spain to marry a fisherman. The company has
effectively put a good deal of the business operations into the hands
of a single person and to make matters worse, this person has insisted
on not having her processes documented or passing on the knowledge to
other people.
Another rats-nest of knowledge-wells often occur in small technical
departments though these are often more deliberate. Commonly some staff
will deliberately make their job seem more complicated, avoid documenting
systems and processes and basically try and make themselves indispensable
to the company. This gives them a great amount of power which really
shouldn't be there.
The way around knowledge-wells is to have clear policy on process and
systems documentation, have clear training policies and where possible
to use well known and industry standard technology. It is also a good
idea to occasionally sanity-check system and processes either with an
internal committee or with short term external consultants.
More serious theft is something that all businesses are at risk from
but the most common problem is that of assuming your staff won't steal
from you. Even a lot of what look like external breakins are often
done with internal help. Bad asset control may even cover up a lot
of theft so that it is never identified. In one large company an
employee was eventually caught receiving new boxed computers, sticking his
own address labels on them and posting them straight back out again via
the post room. This may have never been spotted since the computers
hadn't at this point been entered into any asset tracking systems.
There are no complete answers to stopping theft; but some suggestions may help:
It is not only telephones that can be abused: Printers, photocopiers,
and postal services are equally open to theft of resources and some
limits and security should be placed on their usage.
Another often overlooked form of theft is in software and in licenses.
When you buy a piece of software, you are only really buying a license
to use it and this is the bit that your software asset owner should
keep. Often, if a number of software products have been installed, nobody
really cares what happens to the licenses or boxes but remember; if this
license is taken and sold to someone else, your version of the software
then becomes illegal to use.
Although this sounds somewhat "big brotherish", your staff are only human
and sales people will act in a lot of subtle but possibly unfair ways to
manipulate them. Even something as simple as a free T-shirt from a
supplier may tip the balance in favour of them in a poorly managed
tendering process.
After some severe ethical issues within the Hughes Corporation many years
ago they were forced to install a group wide ethical programme which is
regarded as the finest in the world. To quote from the Hughes Software
Systems page:
The Integrity program establishes a strong business ethics practice.
The ethics program is well documented and there is an ethics office
headed by a Chief Ethics Officer. All new hires are put through an
ethics workshop within four weeks of hiring and all employees go
through a refresher program every year. There is a strong mechanism
for reporting and acting on violations. Strong and swift action is
taken to set examples. This has helped HSS to create and maintain
an ethical environment for doing business within and outside the
company.
Social engineering is a modern term for all sorts of techniques that
basically involve lying to people to get information out of them or to
get them to do something for you. It's not a particularly clever
technique but usually, a very effective one. The people who fall for it
will usually tell you that they were trying to be helpful or that the person
who asked them to do something seemed to know what they were doing, so they
just did it.
Some examples of Social engineering are:
If either of these sound in any way far fetched, then it should be noted that
both of these are fairly common and standard methods of attack. The way to
counter this form of deception is to train staff in the basics of security.
It is not sufficient to teach people what they should do they must also be
taught why they are doing it so that they can apply their knowledge to
situations that are beyond their normal experience, since these are the
situations the social engineer will try and create to do their work.
Virus scanners will not spot all malicious software, so running one
may well give people a false sense of security. Staff apparently rarely
take much notice of instructions not to install software; this may be
because a lot of things install themselves. CD ROMs may install software
when they are put into the drive, email attachments may run software that
installs something and web pages may well cause software to be installed.
As this is the case, it is always best to try and "lock down" user's
machines as tightly as possible to try and stop software installation.
In simple terms, you need to teach staff to be polite, cynical and quiet.
In terms of politeness, it is quite important to teach people that the
laws of defamation do apply to email and with the extensions in the
Data Protection Act, people may well fall foul of these laws. It is
tempting to treat email as "personal correspondence" and there is often
a sense that you can say what you want. This is far from the case, legally.
See the Legal section for more information.
Spam mail is the Internet term for any sort of mail sent to you to sell you
something, to advertise something or just to generally annoy
you. It is the equivalent of the letters that flood through letterboxes
informing you that you are 3 steps away from winning a billion pounds.
However much spam is being blocked, some will still get in. For people
unused to receiving Spam the first few months of it can be quite an
education. One of the problems with some of the more common hoaxes is that
they appear to be addressed personally, and to the recipient, it is far
too easy to be fooled into thinking this is just for them. There are
lots of hoax mail messages that if people fall for, at the least they may
be left feeling silly and at the worse, for example, the email saying it
is from someone in Africa who wants to use your bank account to deposit
a few million or billian dollars, they may end up kidnapped or dead. It
is vital that staff are made aware of spam and hoax emails, how they
work and how to spot them.
Finally, it is probably a good idea to teach staff not to overuse the
email systems. There is a fine line between overuse and abuse and in
the UK the overuse of email systems is getting to such a point that quite
a few companies are starting to have whole days where email is not allowed
in an attempt to get their staff talking to one another again!
Some common problems are:
Whilst chat services are reasonably easy to block technically, there
are also more and more ways to get around these blocks, specifically
designed so that people can chat from work; this is becoming quite a big
thing and a modern security policy should address chat systems and if
people are allowed to use them at all then the limits of when this use
becomes abuse should be laid down.
Often these businesses will start in an employee's non-work time but
as things get larger, they may well start to interfere more and more
with their daily work; there are even some cases of people using the
company postrooms to do their shipping and stealing large amounts of
stationary for their own businesses.
As well as clear security policy guidelines and disciplinary procedures
to deal with this problem, it is a good idea to monitor Internet access
and to block some of the more obvious sites (eg: eBay) as well as
taking precautions against stationary and postage theft.
Be aware of the "mood" of your staff. If someone is being malicious
there is usually a reason. Are they unhappy in their work? Are they
having financial problems that would cause them to be malicious for
money? If there are problems then that person should be watched and
if required, some limiting actions should be taken.
Make it clear that if any deliberate malice is detected then the matter
will be dealt with seriously and the police will be called in. A lot of
companies will just silently make somebody redundant but this may cause
a lot more problems later in showing people that malicious acts may be
tolerated.
Although there are endless acts of malice that can be caused, here
is a short but varied selection of ones that have been seen recently.
If you are employing someone in a position of trust (and in some senses,
that includes anybody with access to your computer systems and data) is
is especially important that references are followed up carefully and
properly from previous companies. If none are provided, then be especially
suspicious. Also during the interview process, don't be scared to get
somebody in to check their technical skills and don't be scared to
question them in some detail about past jobs, asking for references and
if they would mind them being contacted from each. You may think you are
being overcautious, but when you find out they were sacked from their
five previous jobs for hacking you may well find the paranoia was useful.
Far fetched? Not at all - A lot of IT and finance companies will sack
people they catch hacking quietly so as not to damage their own reputations.
In the worse cases they will even offer a good reference in the hope that
they don't say anything. In a recent case a big police investigation into
one hacker was ruined when he was employed by the security department of
a large telecoms company who didn't bother checking to see that he
had been sacked from most of his previous jobs. The police had to arrest
him before he caused any major damage at the telecoms company but by
doing so ruined their own two year investigation.
These days, especially in IT, it takes very little for someone to post
their CV onto a recruitment website and once that happens, they will be
the target of headhunters offering them better salaries, relocation
bonuses and training.
Staff like being trained, and in the long run, this is good for your
company but bear in mind that the staff will often be looking to increase
their skills so that they can leave. It is a good idea after any expensive
training course to "lock them in" so that if they leave within a given time
they will have to pay the cost of the course back.
Keeping staff "happy" is outside the scope if these pages, except to
note that a well known media company did this by building a video arcade
in the basement of their offices, turned a large number of their staff
into video-games addicts and rarely saw them at their desks ever again.
As for taking your employees firewalking to promote team spirit, you may
want to read
this article on Ananova first.
A final top five bullet points of things from this section:
Finally... During my lectures on this subject I am often accused of
representing cleaning staff as the Anti-Christs of the security world.
Whilst it is tempting to end with the comment "Well, they are!" in this
section, I will avoid doing so.
A false sense of security
This may well be the biggest single danger associated with your staff that
a company will face. The problem here is simply the "It won't happen to
us" attitude. The problem is, that often it does happen to you, and more
often than not, nothing has been prepared to deal with the bad happenings.
60% of companies have suffered a security breach in the last 2 years.
43% of companies have had a serious breach of security
40% of security breaches were caused by user error
Mistakes
From the above statistics, it can be seen that 40% of security breaches
were caused by user error. The easiest way of showing how simple mistakes
can cause serious problems is to give some examples:
There is a famous story of an office worker backing up their files to
floppy disk and then pinning that disk to a notice board...
Careless use of data
It is a good idea to not only know what data your company stores, but also
to assign some sort of value to all of different types of data. This will
naturally lead to far more appreciation as to the value of keeping some or
all of your company data safe. It is also a good start for compliance with
the Data Protection Act in some circumstances. Again, it is not possible
to give a complete list of how data can be used carelessly but a few
examples should give some ideas:
Key staff creating knowledge wells
This can be a very severe problem, and when it hits, it can hit quite
badly. A common example of this is Mrs Smith, the loyal and long serving
Office Manager who, as everyone in the company would tell you is not
only worth her weight in gold but she is also the only person in the place
who understands how the office systems work and doesn't like anyone to
interfere with her own way of doing things.
General theft
Because your staff have to be trusted to a large degree, theft may well
become an issue in your company. Some theft is almost expected such as
stationary theft. Staff taking the odd pen, or pack of postits isn't
often considered a problem however, staff stealing boxes of black-and-red
note pads and selling them at car boot sales is starting to get a lot
more serious.
Subtle theft (including telephone usage)
Following on from the obvious forms of theft, there are more
subtle areas of theft from a company that may be less easy to spot. One
of the most obvious of these is staff using the company telephone system
for personal calls. It is a legal requirement to provide an outgoing
line for staff but, this can be provided by means of a payphone in a
public area. It is definitely a good idea to document the bounds of
personal telephone usage in a staffing policy and to monitor usage
and make it known that this is happening. A good idea is to present
individual staff or departmental managers with itemeised bills each
month just to show what is being used.
Lack of training
This is covered elsewhere in a lot of areas, so there is no need for a
large section on this. It is sufficient to say here that security training
is important and that it is important to teach people about the fundamentals
of security as well as just the processes. If you and your staff understand
why they are doing things and why things are important then they will be
equipped to deal with a wide range of problems and events that may not be
covered by just learning standard processes. The events of September 11th
have taught us all the importance of good security and risk training and
basic awareness training cannot be underestimated in its importance.
Lack of ethical guidance
At first sight ethical training may seem to be a bit pointless, but all
sorts of problems can creep into a company if there are not strict and
consistent ethical guidelines set. Equally importantly there should be
a system of
reporting breaches in business ethics and taking action following the
event.
Vulnerability to social engineering
This can be a huge problem, and a very difficult one to counter. In many
ways people like to be helpful to one another and "social engineering" is
preying on that coupled with a degree of innocence about security problems.
Software installation
Staff will often treat their work PC as though it is their own property
and as such they will personalise it, and install a lot of their own
software. The problem is, this software may well carry viruses and
Trojan horses that could destroy that machine, spread itself to every
other machine in the organisation, spread itself to customers or even
provide hackers with easy access to the machines and networks.
Email usage (Spam mail hoaxes, obscenity and defamation)
There are a number of problems that can occur with email and most of them
are easily solved with a bit of user education.
Web usage
There are many problems with web usage, and the limits on this should
be set down clearly in a security policy and possibly enforced by the
IT department with suitable filtering mechanisms and monitoring of
Internet access.
Don't get me wrong... There are a lot of good points to having web
access... It is after all the
biggest library and information source in the world and may save people
years of traditional research. It is also a useful way to recruit people
and, provided it is not abused, a good way of relaxing a bit and just
browsing casually.
Non Work activity (chat systems etc)
Aside from Web access, there are other things to be aware of. Instant
messengers such as IRC, ICQ, MSN messenger, AOL's AIM and Yahoo Chat are
becoming more and more popular. These allow people to waste away many
happy hours chatting to their friends or chatting to groups of people
in chat-rooms but whilst they are doing this, they are probably not
doing a lot of work.
Running other businesses
This one may seem a bit odd; but these days is it even easier to run a
small business with not a lot more than an Internet connection. These
business may range from a bit of freelance web design "on the side" to
running a large scale book selling business on Amazon or large amounts
of auctions on eBay.
Malice
Deliberate malice is a hard problem to deal with. A lot of controls such
as training will protect you from your staff accidentally causing damage
but when there is a deliberate attempt to cause problems things become more
difficult. There aren't many protections against this, the only two really
being:
Background checking
As mentioned in the introduction, a lot of people are now lying on
their CV's - There are the results of some recent polls on these two
external links:
Sometimes, the lies aren't bad but sometimes (and it appears especially
in IT) they can be much larger and more "inventive".
Keeping staff happy, paying them enough?
There is a saying that although loyalty cannot be bought, loyalty
doesn't put food on the table. However loyal your staff, if they are
constantly being reminded that they could be earning a lot more elsewhere
then eventually they will probably leave.
Safety
Fire walking aside, there are a number of safety issues that are closely
connected with security. Health and Safety is covered in other pages and
courses but there are important additions to be noted. Safety training
is every bit as important as security training but the two topics do
overlap in some areas and so overlapping some of the training should be
considered as well. A selection of
things not covered elsewhere that may get you thinking of others are:
And finally...
A lot of this section offers a fairly pessimistic view of the actions of
staff. It is in the nature of security to expect the worst and hope for
the best and in the vast majority of cases your staff won't be taking liberties,
stealing from you, wasting company time or selling the contents of your
stationary cupboard at car boot sales every weekend. A good security policy
and staff handbook coupled some good training that teaches people why they
do things as well as just that they should do them will help enormously.
Risk Training Info. Email:
[email protected]
Copyright © 2002 Michael Lawrie. All rights reserved. For more information
on using these documents click here.