Training Magazine - June 2008 - (Page 66)

Data Security monitor a network, monitor computers, and detect potential problems. However, these will never stop an employee who is bent on compromising a system,” he says. “Stopping this requires processes, training, and policies.” Processes should begin as early as the hiring process, with human resources vetting job candidates for what technology insurance underwriter Darwin Professional Underwriters calls “dishonesty exposure.” HR needs to be involved again when an employee departs, and may participate in staff training and security certification in the meantime. How often do you leave your work carrying a mobile device such as a laptop, smartphone and/or USB flash drive which holds sensitive information related to your job?* *i.e., customer data, personally identifiable information such as Social Security numbers, company financials, credit card data, or competitively sensitive information such as product plans. 50 40 30 20 Question: Top-Tier Support But the general edict for internal security needs to originate with executive leadership. “The insider threat has been around since before IT,” says Dave Morrow, chief security and privacy officer for EDS, an IT applications and business processes firm based in Plano, TX. “The C-suite and internal auditors have had a lot of time to think about it.” Darwin finds that clients most successful in securing their systems from internal threats have a boardroom-level understanding of network security liability and data privacy issues, and initiate a formal policy that is disseminated to every area of the organization, including contractors and vendors. Senior leaders also enable those in charge of data protection with a budget for security measures and compliance testing. “We have found the best technology does not necessarily make the best risk,” says Adam Sills, lead underwriter at Darwin in Farmington, CT. “Encompassing policy brought in by corporate governance makes the best risk.” However, in many organizations, data asset security is buried too far down to get the attention of the corner office. Crisis management and securityrelated issues should include all operational function managers, Nance says, “and the executives should be involved in the actual testing of the plan and readiness exercises.” Frequently 10 Sometimes Never 0 Government 58% Frequently or Sometimes Enterprise 68% Frequently or Sometimes Total 65% Frequently or Sometimes Do you ever feel that you need to work around your company’s established security policies and procedures just to get your job done? 70 60 50 40 30 20 Question: Yes No 10 0 Government Enterprise Total Question: Does your company provide training about the importance of following security best practices? 100 80 60 40 20 Tech as Security Foundation Government Enterprise Total Yes No 0 SOURCE: “THE CONFESSIONS SURVEY,” RSA, THE SECURITY DIVISION OF EMC. Technology can not only monitor and optionally block sensitive outbound communications; it can verify that confidential information has not been stored on widely accessible shared w w w. t r a i n i n g m a g . c o m 66 | JUNE 2008 t r a i n i n g http://www.trainingmag.com

Table of Contents Feed for the Digital Edition of Training Magazine - June 2008

Training Magazine - June 2008 Contents Online TOC Editor’s Note Live & Online Training Today Soapbox How-To World View Changes With Penguins Keeping Forced Ranking Out of Court Across the Board Certify Me Meetings CPR How Secure Is Your Data? Training Leadership Summit Wrap-Up Tools of the Trade Inprint Questions for Covey

Training Magazine - June 2008

For optimal viewing of this digital publication, please enable JavaScript and then refresh the page. If you would like to try to load the digital publication without using Flash Player detection, please click here.