Timeline for security performance criteria in employee reviews
Current License: CC BY-SA 3.0
10 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Dec 14, 2013 at 8:44 | answer | added | user35676 | timeline score: 0 | |
| Dec 13, 2013 at 11:36 | comment | added | CodesInChaos | The problem is that the only thing security policies and actual security share is part of the name. | |
| Dec 13, 2013 at 9:35 | history | edited | AviD♦ |
edited tags
|
|
| Dec 13, 2013 at 6:18 | history | tweeted | twitter.com/#!/StackSecurity/status/411379554146869248 | ||
| Dec 13, 2013 at 5:20 | answer | added | scuzzy-delta | timeline score: 6 | |
| Dec 13, 2013 at 1:21 | answer | added | ChrisLively | timeline score: 2 | |
| Dec 13, 2013 at 1:17 | comment | added | Panther Modern | "If a company REALLY believes security is important, it'd be in employee evaluations" - It already is: if you violate company security policies, you should be disciplined and/or fired depending on the severity thereof. If you give your users quizzes based on what you're teaching them, use those quizzes to evaluate the effectiveness of your training materials & security policy. Evaluating employees on things that aren't directly their job is...ludicrous. | |
| Dec 13, 2013 at 0:39 | comment | added | user35603 | I'd say it could go both ways. Employees can be penalized AND incentivized. Personally I'd advocate for the latter. Consider performance indicators such as quiz results, attended security meetings, their resistance to phishing attacks . . . If a company REALLY believes security is important, it'd be in employee evaluations. | |
| Dec 13, 2013 at 0:15 | comment | added | Panther Modern | What does this even mean? How many times a user opened unsafe email attachments? How many times the user wrote their password on a sticky-note and left it on their desk? "Security performance metrics" is nondescriptive buzzword bingo. If users consistently perform such unsafe actions as to warrant a review of "security performance metrics", that seems to imply your organization's security policy has far deeper problems than its users violation of it. | |
| Dec 12, 2013 at 23:55 | history | asked | user35603 | CC BY-SA 3.0 |