Probably the biggest problem that we have in the world of I.T. Security are people.
People need training.
So what I want to do in this particular episode is talk about some of the aspects of training and what
people need to be aware of so that our I.T. security infrastructure is sound.
Now the whole idea of training pretty much starts from the moment somebody starts with the company until
the day that they leave.
So what I'd like to talk about first is what we call onboarding now onboarding is simply the process
that takes a person who is outside of your infrastructure and brings them in pretty much new hires but
that can also be contractors temporary workers stuff like that as well.
So when someone is on board and they go through a very big process of making sure that they're the type
of person we want to do and all kinds of training and all kinds of stuff.
However for the exam there's just a very few specific areas that I want to cover.
Onboarding Well in many cases require a good background check making sure that this is the type of person
that you want working for your organization.
In certain cases they might have to sign a non-disclosure agreement and make sure that they're not going
out with information that they shouldn't be talking about.
They should also be aware of standard operating procedures.
Anything that you do within your organization that has a procedure and that is standardize.
This is where they begin to learn about that.
Also specialized issues for example in many organizations there's a requirement for a clean desk by
requiring a clean desk.
It prevents the opportunity for passwords to be written and other bits of critical information to be
left about the other big area that we deal with an onboarding is rules of behavior and in particular
what we're talking about is a good acceptable use policy.
Here's where we go through the process of having the person read the acceptable use policy often signing
the policy in front of someone to make sure they understand exactly what they can and cannot do with
the company's equipment.
On top of that there'll be a number of general security policies for example.
What can they do with social media networks.
What can they do with different applications and even personal email training.
Does it end at the onboarding process.
Training keeps going for ever and ever.
All good employees are always going to be subject to continuing education.
For example if there's a major change in a policy new technology new applications new things that come
along we need to make sure that our people are up and trained.
And also it's always a good idea to give good refreshers make sure people are aware on things like watching
four different types of malware or making sure that their passwords are being handled properly.
Once a person decides to break away from your infrastructure then we go through the process known as
off boarding.
Now A14 is a very complex process and all types of things but at least for the exam the things I want
you to concentrate on is number one.
We're almost always going to disable someone's account we never delete an account because there are
different permissions and such.
We're also going to have them return any credentials they might have that would be very important from
a security standpoint.
But the other one and this is a big one is the exit interview.
We should always have an exit interview during the off boarding process.
For one reason at least from an I.T. security side and that is knowledge transfer this is the opportunity
for us to go to that particular soon to be X employee and say talk about where their data is where their
storage is or anything personal that might be helpful for us.
And this is often a good opportunity to discover that important thumb drive or whatever it might be
that can really help us specially when the next person comes along.
Now speaking of data there's a big issue that comes into play and that is the concept known as personally
identifiable information PIII is a big deal when it comes to security and we need to be training our
people to be aware of personally identifiable information for a myriad of reasons.
There are a number of legal issues involved with that.
There are problems where we run into where we have personal information stolen and we need to watch
out for that.
Now what's interesting is that we have a lot of resources for this.
So let's start off with the good ole NIST NIST document 800 dash 122 goes into great detail on the concept
of personally identifiable information.
Some of the things we need to be watching out for would be for example a full name a home address a
personal e-mail address a identification number here in the United States that would be a Social Security
number a passport number vehicle registration plate numbers their driver's license number any face fingerprint
or handwriting information credit card numbers digital identity and date of birth.
Another big issue when we're talking about personnel are personnel management controls that were actually
in this case talking about how we deal with what people do in terms of their work to be able to keep
our infrastructure as secure as possible.
So let's take a quick look at these very common and very well-known personnel management controls.
First our mandatory vacations a mandatory vacation is a requirement that someone take a vacation get
away from the office for a while.
In many industries people are required to take two weeks at a time.
Now a mandatory vacation does some powerful tools number one.
Others can fill in if needed.
So it shows our infrastructure that if someone's gone for two weeks other people can cover for them.
It also makes fraud much more difficult.
And if more than one person at a time is doing something naughty it prevents collusion by keeping these
people separated.
Another important personnel management control is job rotation job rotation prevents a single person
from being the only set of eyes for a job.
It also makes fraud more difficult and it allows for cross training jobs rotation is fantastic for larger
organizations although it's often difficult to do with smaller ones third is separation of duties separation
of duties simply means that at least two people are required to do a sensitive function.
Again this makes sure that no single person is always and only doing a particular function.
Everybody who touches your secure data in your infrastructure does this under what we call a roll.
Now different people have different roles depending on how and what they do within the infrastructure.
So when we're talking about dealing with data we often use very specific well known industry defined
roles that help us decide what different types of people what different types of roles are done when
it comes to handling data.
The best way to see how this works is actually just to see these very good examples.
So let's go through different well-known role based data controls.
First is a system owner a system owner is a management level role.
Their job is to maintain the security of a system.
Now when I say a system I don't necessarily mean a single computer it could be a network or whatever
you break down as a system a system owner will also define a system administrator who will see next.
And a system owner works with data owners will see who data owners are in a minute to ensure data security
a system administrator is usually someone who is assigned by the system owner to perform day to day
administration of a system.
These are the people who actually implement security controls on that particular system.
A data owner is the person in charge of the data on that system.
They're going to define the sensitivity of the data on that system.
They're also going to define the protection of that data whatever they need to do to protect it.
They're going to work with the system owner to protect that data and then usually the poor system administrators
the one who has to actually implement the controls and it's the data owner who defines access to the
data.
So addenda owners also going to work with a system administrator to see what can people do with that
data.
Next is the user and the user is the most common person.
These are the folks who access and use the assign data responsibly.
The other big job for any user is to monitor and report security breaches a privileged user is a person
who because of a management position or whatever will have special access to data beyond the typical
user.
So like the head of accounting is probably going to have more permissions than a regular accounting
user a privileged user.
Also works closely with system administrators to ensure data security lasts is the executive user and
executive user by definition will have read only access to pretty much all of the business data on a
particular system.
There's a lot to security training.
Make sure you're comfortable with different types of controls and different types of roles because this
is the stuff that really keeps our I.T. infrastructure secure.