Training Employees
A well-trained workforce is a valuable asset in any access control system, especially when it comes to defeating social engineering tactics. Employees cannot be expected to respond appropriately to security situations if they have not been trained in the proper way to handle them.
Simply handing a new hire the employee handbook and expecting him or her to read the sections on security policy is not enough. A good security awareness program should:
- Be ongoing—Telling employees about a security policy once is not enough. Security awareness messages should be repeated and reinforced on a regular basis.
- Include multiple formats—Not every individual learns in the same way. Some people are better at processing written information, while others are auditory learners. Some respond better to visual representations or dramatizations. Presenting information in a variety of formats helps to ensure that every employee understands security concepts well.
- Be interactive—People remember information more clearly when they are able to interact with it. Role-playing activities are a great way to allow employees to interact with security information and practice recognizing and responding to security events.
- Include multiple points of contact—It can take up to a dozen repetitions before a concept becomes internalized. Place security awareness signs around the workplace, schedule workshops and seminars, and conduct security awareness drills. Each time employees encounter security awareness messages, that information will become a little more ingrained.
What should employees learn about security? Two common policies, the acceptable use policy and the security awareness policy, cover the common security information most employees need. Neither of these policies is a one-size-fits-all solution. Each organization will have its own version.
Acceptable Use Policy
An acceptable use policy (AUP) defines how employees may use the IT infrastructure supplied by an organization. In general, an acceptable use policy specifies whether employees may use organization resources such as networks, Internet connections, and email accounts for personal use. It may also define whether employees may download files from the Internet, forward humorous or chain letters via email, or engage in sending spam. An acceptable use policy generally forbids any activity that is prohibited by federal, state, or local laws or that violates regulatory compliance. Common elements in an acceptable use policy are:
- Keep all passwords secure and do not share accounts.
- All workstations and laptops must be secured with a password-protected screensaver.
- Use of organizational communications resources, including email, telephone, Internet, and interoffice mail, shall be limited to business purposes only. Personal use is strictly prohibited.
- Sending unsolicited junk email or advertisements is prohibited.
- Any form of harassment, including email and telephone messages, is prohibited.
- Creating or forwarding chain letters, pyramid schemes, or other similar messages is prohibited.
- Circumventing the security of any network or host owned by the organization is prohibited.
Most acceptable use policies go into more depth; however, these are some common items found in every acceptable use policy.
Security Awareness Policy
A security awareness policy specifies what individual employees are responsible for in terms of information security. It also defines the responsibilities of managers and information owners. Because security is an ever-changing field, many security awareness policies do not lay out specific procedures, but rather, refer employees to another resource for up-to-date information, such as a page on the organization’s Intranet.
In general, employees must agree to read and follow security procedures. Managers are responsible for providing training and security resources for those under their supervision, and information owners are responsible for classifying their information and taking appropriate steps to safeguard it. Some common elements in a security awareness policy include:
- The organization will provide ongoing training and resources on information security.
- Information owners will classify the information according to its sensitivity and take reasonable precautions to safeguard the information.
- Employees should understand common security threats and maintain a sense of vigilance, especially with regard to social engineering attacks.
- Employees should immediately report any suspicious activity to their manager.
Many security awareness policies also include references to other documents, both internal policies and external resources, to which employees can refer if they are unsure of whether a given situation constitutes a security threat.