Security Management Tools - First Secure the Facility
With reports about new computer viruses every week, it’s easy to see why companies focus on tuning up their information technology departments. But there’s a “soft” side of security that’s quicker, easier and far less expensive.
The key is to make your employees more aware of the basics of information protection. The payoff? Studies show companies can reduce their exposure to data leaks by as much as 35%—and do it without going anywhere near their computer systems.
That doesn’t mean companies should ignore IT protection, of course. Any company needs good IT defenses to help shield sensitive information from malicious outsiders. But research by Ernst & Young and others shows that 65% to 70% of all company security incidents occur from inside, not outside, the company.
Yes, some of these incidents involve disgruntled employees who erase data, tamper with records or steal information. Yet those are the exception. In most cases, security breaches come from simple mistakes on the part of honest but unthinking employees.
Here’s a classic example. Your firm uses door locks that require employees to swipe a badge to open. Then a “helpful” employee holds the door open for the stranger who appears to be fumbling to find his or her own pass card. It’s a common trick used by thieves to get into an office. Once they’re inside, it’s easy to walk off with anything from pocketbooks to passwords.
Educating employees about the perils of bypassing security measures is a great place for a company to start when improving security. It can be as simple as not leaving your password on a Post-It note stuck to your computer or being careful about tossing out papers that contain sensitive information. Likewise, employees should be taught about putting sensitive information in email messages.
These easy steps should be the first things a company does. But it won’t work until the company defines its security policy. Otherwise, questions quickly arise about what you’re trying to accomplish. Usually, a training program’s content is driven by company policy.
There are lots of ways to do employee training in this area. You can conduct formal classroom sessions, set up a training website or conduct a contest and award prizes to employees who score high on the company’s “security test.” Ernst & Young has developed a comprehensive methodology companies can use to provide this security awareness program and make it fun for employees at the same time.
Training programs such as these usually get announced by high-level executives in the company. When that happens, effective awareness programs can be implemented relatively easy, even on a global scale. Unfortunately, such efforts often are spawned within the middle ranks of management and fail to gain support from top management. Then employees don’t take the program seriously, and security suffers.
It’s a good idea to “recertify” employees on security at least once a year. One reason is that technologies, and the threats they can bring, change over time. Cell phones with built-in cameras are a good example of a new potential threat to data security that was unheard of a few years ago. Since employees come and go, it also makes sense to make security awareness an integral part of the materials that companies give new hires.
Depending upon how big a company is, it might take 12-18 months to set up a program and roll it out across the organization on an international scale. It’s a faster time frame for smaller companies. Either way, it’s important for senior management to remain engaged. Organizations with world-class security programs have a proactive, lifecycle perspective that includes never-ending assessment, updates and redeployments.
These days, a company’s critical data face risks from new and more sophisticated threats every week. That’s why IT departments must work harder than ever to keep ahead of these security challenges. But they can’t do it alone. For any company, data security starts with employees who have been trained how to be careful.
