Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 5 down vote favorite
2

What are the equivalent digital parallels to the practice of offering bonuses to employees challenging persons in a secured area without a visible badge?

share|improve this question
1  
I like this question, but I'm finding it hard to see what kind of policy would maximize this... Looking forward to the answers – AviD♦ Nov 21 '10 at 10:10
Hmm, now that I think about it - the question has a builtin contradiction. For a policy to "maximize detection", @Graham has a good answer... BUT if you're asking about "an equivalent parallel" to offering bonuses to employees, then @sdanelson's answer is spot on - and about as useless as the employee bonuses. To clarify, what I'm saying is "the practice of offering bonuses to employees challenging persons in a secured area" does not maximize incident detection. – AviD♦ Nov 22 '10 at 11:09

3 Answers

up vote 2 down vote accepted

After thinking about this for a bit, and seeing the couple of (conflicting) answers that were offered, I realized - this is no different from your question on "What policies maximize employee buy-in to security?".

  1. Awareness
  2. Social norms (as per @Graham's answer there) - employees need to feel that they are expected to say something. Not quite "See something, say something" - more like "This is your office too, you'd say something if somebody walked into your home, wouldnt you?"
  3. Getting them to care.
  4. Priorities. Employees need to see that management cares about this too. Not by giving bonuses, but by actions. E.g. CEO goes over to a stranger... Or, contrarily, if an employee was late because he was questioning strangers or whatever, there shouldnt be repurcussions...
  5. Appropriate tools, much as @Graham mentioned here. Moreover, automate detection as much as possible! Invest in good tools for the job at hand, and remove as much as possible reliance on the people.
share|improve this answer
up vote 2 down vote

The policy that improves incident detection is a policy to equip security staff with automated monitoring tools that save them from the tedious legwork of scouring log files and performing manual detection. By analogy: you don't improve physical security by asking your guard to walk faster, you give him CCTV monitors.

share|improve this answer
up vote 1 down vote

I think the answer is a policy that rewards the reporting of unusual activity. IE software/hardware that is running abnormally slow, crashing unexpectedly, etc. The policy could also cover the discovery of bugs, misconfigured software/hardware, and poor practices.

In a healthy organization a lot of this activity should already be going on. IE users calling the help desk to report that their computer is running really slowly. The policy would just formalize the rewarding/recognition of employees who help discover incidents.

share|improve this answer
1  
Re "policy that rewards the reporting of unusual activity", as Schneier says if you ask amateurs to do your security, don't be surprised when what you get is amateur security. – Graham Lee Nov 21 '10 at 23:21
1  
I agree with Schneier. For those interested the article that Graham quotes can be found at schneier.com/blog/archives/2007/11/the_war_on_the.html. – sdanelson Nov 22 '10 at 2:17
1  
I accidentally hit enter on my last comment. I don't think that the question or my answer opposes what Schneier argues. End users are not security experts, but end users are familiar with the software and hardware that they use on a daily basis. See Schneier's earlier article titled "Recognizing "Hinky" vs. Citizen Informants". – sdanelson Nov 22 '10 at 2:47
Another problem with this is that whatever you're rewarding for, will be gamed. You reward for reporting slow hardware? Expect everything to slow down. You give bonus for finding virus? All of a sudden every single virus appears in your network. And so on... – AviD♦ Nov 22 '10 at 7:36

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.