I was reading a Tim Wilson article at Dark Reading this morning in which he asked the question, “So are users hopeless? Are they inherently brainless and/or evil?” My first reaction to the question was raucous laughter. When I finally regained my senses, I read the rest of the article in which Wilson makes a lot of sense.
As a security director, I have days when I believe the users are all out to violate as many security policies as they can, either intentionally or because they are brain dead. But this attitude isn’t helpful. I agree with Wilson that most end users are intelligent individuals who want to do the right thing. Keeping that in mind, helping users help themselves is a key element in any security program.
For years I’ve been a proponent of user education as a first step. If there is chaos in the halls of security compliance, then part of the blame usually lies with the lack of effectiveness of an organization’s security awareness efforts. This is always the first step, but it isn’t enough.
Employees will always make mistakes. Yes, they’re human beings not robots. So there are steps security professionals must take to mitigate the impact of those mistakes. Content monitoring for data transfers, locking down the desktop, and Internet access controls are three good places to start. Not only will this help stop the bleeding from an accidental incident, it will also help minimize the probability of malicious activities.
Wilson does finish his article with the assertion that end users are hopeless. OK. Maybe. But IT security shouldn’t be.
Holy Toledo! The iPod did it!
Saturday, February 17th, 2007Unbelievable. It’s even more unbelievable because I live near the community of Oregon, Ohio where a police detective called a student’s iPod a “criminal tool”.
In an article in the Toledo Blade, Robin Erb describes an incident in which a former Clay High School student was charged with a felony for accessing school employee and student records. Not only did he access them, he downloaded them to his iPod. In addition to being charged with unauthorized use of a computer, he was also charged with possessing a criminal tool–i.e. the iPod. Nice police work, Oregon. Will I still be able to carry my iPod concealed when I cross the city line?
Although the former student used a school computer lab to access the sensitve records, no mention was made in the article about how this was even possible. It probably didn’t take much cracking of system security if access was gained in a classroom with High School staff supervision. Instead of vilifying the venerable iPod–or any other mobile storage device for that matter–it might be better to ask serious questions about how this was even possible. What steps is the school system taking to ensure this doesn’t happen again? Or will the school board simply add mobile storage devices to the list of criminal tools so it can assure parents and teachers that their information is now secure?
Posted in Commentary, Security Management Tips | No Comments »