Security

Ask something
Discussion Locked

The easiest hack!

0 helpful
2 replies

by dlucas

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

All of the security schemas or firewalls in the world cannot withstand the Social Engineering Hack.

Certainly, we are just ignorant fools if we don't put in place the best "TECHNOLOGICAL" Solutions.

Security is not a technology, it is a philosophy.

With that in mind, how do we get our current employee mass to 'buy in' to our corporate need for security? Can we build a better group of vigilant security minded employees ? Can we incent the wistle blower ? ( that employee who notices a security breach )

What about the very good employee who wants to be more productive and can really do his/her work better in a "WIRELESS" mode; who brings in an access point from home and attaches it to the end of the cat5. Not for a malicious act, but just to be more mobile in the office area. Suddenly a breach in security !!!!

Just some musings; got any suggestions ?

2 replies

by mrbill-

Education is the answer. Establish an IT policy as regards to network security, configuration, lay out who can attach items to the network, password policies, anything that is IT related. Make sure management hacks off on it. Make it easily available to everyone; setup a link to it on the desktops. Make it mandatory that all employees review it semi-annually. Any new employee has to read it before they are allowed access to a PC. Provide a weekly/monthly email newsletter to remind everyone about security/network issues. Enforce the policy; here is where you need solid support from the boss. For small offenses that do not cause financial loss or undo hardship on the company use the old ridicule method, dunce cap/bone head award. For those more serious offenses, hit em in the pocketbook, but not too excessive. Provide incentive, recognition/monetary, to those who spot problems, within reason. Make the users think they are also a part of the IT team. Just a few ideas. Anyone else?

by oldefar

I would suggest staying away from "IT Policy" though. Having been on all sides of the issue, any policy that begins with another department as owner is going to cause push back. As a user, I don't care about IT except as it impacts my work. As a manager, I resent IT trying to dictate how I run my group. Make it a corporate policy, and suddenly we can all be on the same side.

Same with enforcement. IT has no authority over my department employees. I expect anyone with a concern with what my people are or are not doing to bring that concern to me and then go away.

An open and supportive IT department is the best approach. If I feel that IT is on my side, is an ally as I try to improve my department efficiency, then I will be going to IT for their expert advice on how to accomplish things using technology. If I feel IT is trying to dictate how I use technology, I am probably going to ignore them until my management gives me an ultimatum. If I am on the revenue or production side, I will rarely see such pressure if I am hitting my objectives.

Incentives on specifics won't do much. If I am running a sales team, any IT incentive will probably be "chump change" when compared to bonuses for exceeding sales targerts. For us, a common incentive is that week at some resort with our spouses for being in the top performer club.

The newletter is a good idea. Especially when it focuses on benefits and risks to the company with no real focus on technology.

This discussion is closed to new replies.