Security

The Human Factor

Paul Kearney

• Publisher: ITGP
• Year: 2010
• Topic: Computer Science
• eBook ISBN:
  9781849281843
• Subtopic: Cyber Security
• Index: Computer Science

Your business information is likely to be much more valuable than the hardware on which it is stored. The loss of a laptop might set you back £400, but if the files on the laptop included sensitive customer data or the blueprint for a new product, the cost of repairing the damage would run into thousands. The consequences of a data breach range from alienating customers to heavy fines, or even criminal prosecution. While technologies, such as antivirus software and encryption, can offer some protection against cybercrime, security breaches are most often the result of human error and carelessness.

Improve information security

Improving information security within your organisation, therefore, has to encompass people and processes, as well as technology. Motivating your team and making them more aware of security concerns should be at the heart of your information security strategy. At the same time, the processes you have in place to address information security issues need to be straightforward and properly understood if you want your employees to adhere to them.

BT's approach

This pocket guide is based on the approach used by BT to protect its own data security – one that draws on the capabilities of both people and technology. The guide will prove invaluable for IT managers, information security officers and business executives.

Read this guide and …

• Win business
  By demonstrating that there are effective safeguards for your business information in place, you can strengthen the trust of partners and customers and improve the image of your brand. Effective information security may even provide the extra advantage you need to close an important deal.
• Protect your organisation from social engineering attacks
  Once fraudsters have gained the trust of a company employee they will then seek to exploit that trust for their own criminal purposes by persuading the employee to divulge confidential information. This pocket guide will help your staff to be on their guard against this type of threat.
• Improve processes and procedures
  The guide sets out some basic precautions that employees can take, both in and outside the workplace, to reduce the risk of a data breach.
• Enable people to make a positive contribution to security
  The processes you have in place to manage your information security need to be observed. At the same time, you are unlikely to achieve the optimum level of protection unless your workforce understands the reason why these policies are necessary.  This pocket guide shows you how you can enhance your information security by engaging and motivating your staff.

Security: The Human Factor looks at the challenges associated with information security, the consequences of failing to meet them and – most importantly – at the steps organisations can take to make themselves and their information more secure.

For an approach to information security that takes the human factor into account, buy this essential guide today!

CHAPTER 1: CARELESSNESS

‘Human error is overwhelmingly stated as the greatest {security} weakness this year (86%), followed by technology (a distant 63%) ... Unless robots replace the human workforce (unlikely in the lifetime of anyone reading this report), human error is an issue that companies will continue to deal with.’
Deloitte, 2009²

Let’s look at some of the ways that human nature can contribute to security breaches, beginning with carelessness.

Barely a week goes by without a report of a laptop, or a USB stick containing sensitive information, being left on a train, or being stolen when left in plain view on the back seat of a car. Modern electronic equipment is highly portable, and can hold staggering amounts of data. Employees are actively encouraged to take advantage of this portability, to work on the move, and at home, so they can hardly be criticised when they do. We’re not just talking about laptops either. It’s easy to underestimate the volume and value of information stored on smart phones, and the other devices that are used in both our business and our personal lives.

In times gone by, people going to meetings would just pack their briefcase with the papers they needed on the day. Everything else got left behind. Now, we can take everything but the proverbial kitchen sink with us – all our correspondence on every topic, every report that’s crossed our desk, and far more besides.

In some ways, it’s an advantage. There’s no chance of getting to a meeting only to discover you left the most critical document behind. But in other ways, it’s a big problem. By taking so much with you, you’re putting so much more at risk.

In January 2008, for example, a laptop was stolen from a Royal Navy recruiting officer’s car. It contained personal information about 600,000 people who had joined Britain’s armed forces, or expressed an interest in doing so³. The problems this could have caused are clear. As the Secretary of State for Defence at the time said, not only were details of bank accounts revealed, but the home addresses (and thus lives) of soldiers, sailors and airmen.

Such incidents are commonplace. Also in 2008, a consultant working for the Home Office copied the details of thousands of criminals onto a memory stick – then lost it. Data about 84,000 criminals was put at risk⁴. In 2009, a council worker lost a memory stick containing the names and bank details of more than 1,000 housing-benefit recipients⁵. And in 2010, the American healthcare provider, Kaiser Permanente, reported that a device stolen from an employee’s car had contained records relating to 15,000 patients⁶.

The cost of responding to such incidents is huge – the Ponemon Institute says American companies spend an average of US$204 for every customer record lost⁷.

So what can we do to reduce the likelihood and consequences of an incident?

The most obvious answer is to take only what you need with you. It’s tempting to carry extra information on a ‘just in case’ basis, or because it’s easier to download complete databases than extract specific details. Taking a back-up copy on a USB stick may seem like a sensible precaution, but that also doubles your chances that the data will go missing. This goes for paper copies too, and while a paper document carries less information than a PC, the information is exposed for all to see.

Remote access facilities are so much better than they were, and are so much easier to use. Furthermore, public hotspots are spreading, and Wi-Fi is even available on some trains. (Note, however, that ‘free public Wi-Fi’ is not always what it seems.)

This removes the need for people to carry so much data around with them. The principle is a simple one: data is far safer when it’s kept on central servers that are properly secured and managed. So, the best option is for people to leave it there and access it remotely, as and when required.

But what about the data people really do have to carry around? For that, full-disk encryption of built-in hard disk drives, and the automatically-enforced encryption of USB drives, is highly recommended. It may sound complicated, but it isn’t difficult – or expensive – to do. Hardware-based solutions that can secure entire disks to standards that far exceed most organisations’ needs, are available for as little as £200. Software-based solutions that protect data, file by file, are cheaper still, at £50 or less a machine. This may sound a lot, when compared to the falling prices of computer hardware. You can get a powerful laptop PC for a few hundred pounds, for example. But remember, the data on a device can be worth far more than the device itself. In that context, encryption is a bargain.

Remember also that the data is valuable to you, as well as to any thief. If your only copy of the 300-page report you’ve been writing is on the laptop that has just gone missing, it could really spoil your day! So, back-up your important work, ideally every day, and keep the copy safe and well away from the original.

Finally, it pays to be vigilant. Do not leave valuable equipment and documents unattended, and in plain view. If you’re travelling by car, lock your laptop in the boot, rather than leaving it in the seat where it can be seen. Remember, that in some foreign countries, industrial espionage is rife – and even state-sponsored – so locked hotel rooms cannot be considered secure. Also, be aware of who is around you while you are working. Can the sensitive information on your screen be seen by the man or woman in the seat behind? And be careful what you say on the phone in public places. Think of what the consequences would be if someone working for one of your fiercest competitors was sitting at the next table.

 

Top tips ...

Don’t carry any more data with you than you have to.

Encrypt disks and other data storage devices.

Make a back-up – every day!

Don’t leave equipment and documents unattended.

Beware of prying eyes.

² ‘Protecting what matters – 6th Annual Global Security Survey’, Deloitte, 2009, www.deloitte.com/view/en_CZ/cz/industries/fsi/article/66b7bf2733101210VgnVCM100000ba42f00aRCRD.htm.

³ ‘MoD lost three unencrypted laptops’, ZDNet UK, 22 January 2008, http://news.zdnet.co.uk/security/0,1000000189,39292312,00.htm.

⁴ ‘Firm “broke rules” over data loss’, BBC News, 22 August 2008, http://news.bbc.co.uk/1/hi/7575989.stm.

⁵ ‘Lost council data stick contained bank details of 1,000 residents’, dash.com, 2 March 2009, www.24dash.com/news/Local_Government/2009-03-02Lost-council-data-stick-contained-bank-details-of-1-000residents.

⁶ ‘Kaiser Patient Data Stolen’, KRCA.com, 12 January 2010, www.kcra.com/news/22220329/detail.html.

⁷ ‘Ponemon study shows the cost of a data breach continues to increase’, PR Newswire, 25 January 2010, www.prnewswire.com/news-releases/ponemon-studyshows-the-cost-of-a-data-breach-continues-to-increase82585957.html.

CHAPTER 2: ACCIDENTAL DISCLOSURE

‘All great work is preparing yourself for the accident to happen.’
Sidney Lumet

‘Oops! ... I did it again.’
Britney Spears

This brings me nicely to my ...

Table of contents

• Cover
• Title page
• Copyright
• Contents
• Introduction
• Chapter 1: Carelessness
• Chapter 2: Accidental Disclosure
• Chapter 3: People are Intelligent
• Chapter 4: An Aside: Password Policies
• Chapter 5: People are Helpful and Trusting
• Chapter 6: Harnessing Human Qualities to Improve Security
• Chapter 7: Why Raise Awareness?
• Chapter 8: Beyond Awareness
• Chapter 9: The Extended Enterprise
• Chapter 10: Process Design
• Chapter 11: Usability
• Chapter 12: And Finally
• ITG Resources