Download Security

Muhammad Rafiq


Predictability is the key
Information assurance process involves
technology, processes, and people
◦ Any of these can cause a breakdown in the security,
however:
 Technology is predictable - well-designed processes
are, at least, consistent
 Human behavior is hard to predict and control
◦ Disastrous effects of employee-based actions:
 Organizations should have mechanisms in place to
ensure the secure behavior of the employees
 Threats that center on people:
 Outsiders – these threats are commonly recognized
 Insiders – fraud, misuse, theft, and human error
 More serious threat to information assets than outsiders






Customers
Visitors
Employees
Executives
Contractors & Consultants
Unauthorized persons



Involves those measures taken to safeguard a
company’s employees and those coming to a place
of business either for business reasons or as a
guests.
Can further include access control systems that
control access in and out of specific premises.
Various identification card systems, passes, and
permits used by companies are considered
personnel control.

Personnel security behavior falls into three
categories:
◦ Routine activities – individual actions to secure the
space that they control from any threats
◦ Operational functions – activities that are performed
to ensure the security of the entire system during
day-to-day operation
◦ Management responsibilities – actions which
guarantee that the information assurance and
security strategy is implemented properly



At a minimum, the screening process should include
a series of comprehensive interviews that emphasize
integrity as well as technical qualifications.
References from former employers should be
examined and verified.
This includes former teachers, friends, co-workers,
& supervisors.



Former employers are usually in the best position to
rate the applicant accurately, providing an
assessment of strengths and weaknesses, personal
ethics, past earnings, etc.
Use of a reference authorization and hold-harmless
agreement oftentimes provides the necessary
information.
Be sure reference authorizations have: signature of
applicant, releases former & prospective employers
What to Look For? A Straw person
Perhaps?
Education
Training
Stable Work History
Clear Criminal Record
Background Continuity
Experience
Professional Certifications
Fiscal Responsibility
Physical Fitness