Training Magazine - June 2008 - (Page 67)

drives or Web servers. This granular control of end-user devices can selectively prevent copying and pasting activity or transferring highly classified information to flash drives, CD-ROMs, or other computers via e-mail. “Start with access management,” Sills recommends. This simplifies employee training. Products can take the place of policies that may seem overprotective or parental, leaving employees feeling distrusted by management. Access management decisions should consider not only to whom information should be available but where (May employees sign in from home, for example?) and on what (Office-issued laptops? Their own hardware? Mobile devices?). It also should set rules for data storage, transfer, and handling. May employees download corporate e-mail outside of the office? What about client records? To what printers may they send files? “Identity and access management is important for securing systems for standard hacking prevention, and is one of several sources for insider threat assessment,” IBM’s Ramsey says. IBM extends the effect of access management with its Identity Risk and Investigation Solution (IRIS). Behavioral analysis of employees’ data use derives from a combination of advanced analytics and visual datamining that assesses deviations in behavior from an individual’s prior activity and against similar users. Reducing risk factors reduces breaches. part in an annual Security Awareness Week, complete with prizes for interactive data protection activities and identity theft education. “We teach employees to protect their own data, and they have greater sensitivity to protecting our data,” he says. Employees also are presented with scenarios in which data may be at risk. “In making them think about what they’re doing, we can prevent things from going bad,” says Morrow, a former security investigator for the U.S. Air Force. “Security is everybody’s job. Everyone has a piece of it and has responsibility for it.” t Education & Effectiveness However, technology alone will not solve all of your problems, says Dave Morrow, chief security and privacy officer for EDS, an IT applications and business processes firm based in Plano, TX. That’s why EDS has extensive, mandatory employee training every year. Employees, contractors, and vendors must certify completion of the program and sign off that they have read security communications. They receive video vignettes about security pushed by corporate e-mail and take w w w. t r a i n i n g m a g . c o m t r a i n i n g JUNE 2008 | 67 http://www.gbcconnect.com/chewswisely http://www.gbcconnect.com/chewswisely http://www.trainingmag.com

Table of Contents Feed for the Digital Edition of Training Magazine - June 2008

Training Magazine - June 2008 Contents Online TOC Editor’s Note Live & Online Training Today Soapbox How-To World View Changes With Penguins Keeping Forced Ranking Out of Court Across the Board Certify Me Meetings CPR How Secure Is Your Data? Training Leadership Summit Wrap-Up Tools of the Trade Inprint Questions for Covey

Training Magazine - June 2008

For optimal viewing of this digital publication, please enable JavaScript and then refresh the page. If you would like to try to load the digital publication without using Flash Player detection, please click here.