6

What are the equivalent digital parallels to the practice of offering bonuses to employees challenging persons in a secured area without a visible badge?

Improve this question
2
  • 1
    I like this question, but I'm finding it hard to see what kind of policy would maximize this... Looking forward to the answers
    – AviD ♦
    Commented Nov 21, 2010 at 10:10
  • Hmm, now that I think about it - the question has a builtin contradiction. For a policy to "maximize detection", @Graham has a good answer... BUT if you're asking about "an equivalent parallel" to offering bonuses to employees, then @sdanelson's answer is spot on - and about as useless as the employee bonuses. To clarify, what I'm saying is "the practice of offering bonuses to employees challenging persons in a secured area" does not maximize incident detection.
    – AviD ♦
    Commented Nov 22, 2010 at 11:09

3 Answers 3

Reset to default
2

After thinking about this for a bit, and seeing the couple of (conflicting) answers that were offered, I realized - this is no different from your question on "What policies maximize employee buy-in to security?".

  1. Awareness
  2. Social norms (as per @Graham's answer there) - employees need to feel that they are expected to say something. Not quite "See something, say something" - more like "This is your office too, you'd say something if somebody walked into your home, wouldnt you?"
  3. Getting them to care.
  4. Priorities. Employees need to see that management cares about this too. Not by giving bonuses, but by actions. E.g. CEO goes over to a stranger... Or, contrarily, if an employee was late because he was questioning strangers or whatever, there shouldnt be repurcussions...
  5. Appropriate tools, much as @Graham mentioned here. Moreover, automate detection as much as possible! Invest in good tools for the job at hand, and remove as much as possible reliance on the people.
Improve this answer
2

The policy that improves incident detection is a policy to equip security staff with automated monitoring tools that save them from the tedious legwork of scouring log files and performing manual detection. By analogy: you don't improve physical security by asking your guard to walk faster, you give him CCTV monitors.

Improve this answer
1

I think the answer is a policy that rewards the reporting of unusual activity. IE software/hardware that is running abnormally slow, crashing unexpectedly, etc. The policy could also cover the discovery of bugs, misconfigured software/hardware, and poor practices.

In a healthy organization a lot of this activity should already be going on. IE users calling the help desk to report that their computer is running really slowly. The policy would just formalize the rewarding/recognition of employees who help discover incidents.

Improve this answer
4
  • 1
    Re "policy that rewards the reporting of unusual activity", as Schneier says if you ask amateurs to do your security, don't be surprised when what you get is amateur security.
    – user185
    Commented Nov 21, 2010 at 23:21
  • 1
    I agree with Schneier. For those interested the article that Graham quotes can be found at schneier.com/blog/archives/2007/11/the_war_on_the.html.
    – sdanelson
    Commented Nov 22, 2010 at 2:17
  • 1
    I accidentally hit enter on my last comment. I don't think that the question or my answer opposes what Schneier argues. End users are not security experts, but end users are familiar with the software and hardware that they use on a daily basis. See Schneier's earlier article titled "Recognizing "Hinky" vs. Citizen Informants".
    – sdanelson
    Commented Nov 22, 2010 at 2:47
  • Another problem with this is that whatever you're rewarding for, will be gamed. You reward for reporting slow hardware? Expect everything to slow down. You give bonus for finding virus? All of a sudden every single virus appears in your network. And so on...
    – AviD ♦
    Commented Nov 22, 2010 at 7:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .