18

There are the basic things that need to be explained to every employee about a security policy. For example:

  • How sensitive information must be handled.
  • How to properly maintain your ID, and password, as well as any other accounting data.
  • How to respond to a potential security incident, intrusion attempt, etc.
  • How to use workstations and Internet connectivity in a secure manner.
  • How to properly use the corporate e-mail system.

But at what point in their employment should these security policies be explained to an employee?

Improve this question
1
  • 1
    Start early and do it often. For most organizations there are all sorts of annual re-trainings or recertifications/sign-offs as well.
    – Eric G
    Commented Jul 18, 2015 at 18:49

5 Answers 5

Reset to default
36

The question could also be asked: "how long should an employee have access to data before they are trained in how to use and protect that data?"

For most organizations, the answer is "0 minutes". You wouldn't place an employee in front of machinery without training them, and you shouldn't place employees in front of a computer without training either.

Each organization needs to assess the risks of this, but the typical answer is that this training is done during orientation.

Improve this answer
5
  • 1
    Exactly. We train day one before allowing users to log in and we require users to retrain yearly (taking roughly 30 minutes each time)
    – Mike McMahon
    Commented Jul 18, 2015 at 1:12
  • 3
    Yep. "How long would you have someone operate a forklift before they were trained in how to use it and be safe?" "0 minutes." -- This is true even if they have already driven a forklift somewhere else.
    – Paul Draper
    Commented Jul 18, 2015 at 15:59
  • 1
    My first job, my last stop in the interview was with the chief of security. It was the most intimidated I've been in my entire life.
    – corsiKa
    Commented Jul 18, 2015 at 16:47
  • @corsiKa: Why intimidated? I feel like there's an interesting story to be shared here :)
    – user541686
    Commented Jul 19, 2015 at 7:57
  • 1
    I was 18, it was for a defense contractor, the guy was ex military (probably special ops, but none of the brass ever talked about it). It was a very intense 45 minute one way conversation about the consequences of releasing even tiny bits of information to the wrong people. A "loose links sink ships" kinda speech.
    – corsiKa
    Commented Jul 19, 2015 at 15:36
16

Do it as part of new employee orientation and follow up with more training at regular intervals.

Security policy is part of our new employee orientation. We also require a short online "securing the human" training to be completed once every other year. Introduction of this regular training has had noticable positive results.

Improve this answer
4
3

First, when the employee starts. Not in order for them to learn a lot, but to get the impression that you are taking security seriously, so they don't do anything stupid.

Then a week or two later, when the employee has some clue about the job they are doing, and can actually appreciate the security training.

Then a while later when they are firmly and securely in their job, when the security training may get rid of bad habits, and where they fully understand the security training and the reasons for it.

Improve this answer
2

'Stay aware and alert' is the mantra for information security. As for your question, the awareness should be part of the induction program for new employees. Basic security etiquettes like

  1. Not flashing ID cards
  2. No scribbling of sensitive information.
  3. Governing policies like web access restrictions etc.

These are basic policies that need to be put forth before you give access to your organizational data to the new inductees.

Apart from new inductees, security policies like this (though are understood, but not practiced by existing employees) that apply to everyone in the organization should be told to everyone on a regular basis. You can have monthly meetings for the same. You can put up awareness posters in around you office are so that people are reminded of it. Reinforcement is key for such initiatives. You can circulate internal newsletters that allow employees to stay aware of new vulnerabilities and the countermeasures that can be used to prevent them.

Improve this answer
6
  • Could you clarify what you mean by "flashing ID cards"?
    – Lilienthal
    Commented Jul 18, 2015 at 12:02
  • @Lilienthal: At least in movies and television, it's common for people to show a guard an ID badge briefly and immediately put it away, before the guard has a chance to scrutinize it. Of course, in many movies and television shows this is essential to the plot, as guards' willingness to accept such behavior allows sneaky people to get by with very poorly-faked credentials.
    – supercat
    Commented Jul 18, 2015 at 14:10
  • @supercat It's not just in movies and TV. I see it all the time in real life.
    – Moshe Katz
    Commented Jul 22, 2015 at 14:28
  • @MosheKatz: The "getting in with poorly-faked credentials" part, or people unknown to the guard being allowed without much scrutiny?
    – supercat
    Commented Jul 22, 2015 at 15:18
  • @supercat both. I work on a large college campus. In the "poorly faked" category, students enjoy a brisk trade in faked IDs for underage drinking. In the "unknown to the guard" category, IDs are used to get on the bus here and people just flash random cards at the driver. (Off-campus at night, they are much more careful, but the rest of the time they don't really look too hard.)
    – Moshe Katz
    Commented Jul 22, 2015 at 15:24
0

Data security policy should be introduced conceptually to the employee before they sign the contract, and explained and/or provided to them in detail before they sit down at their desk for the first time.

Improve this answer
4
  • Before employment? In North America, that would be very strange, indeed.
    – schroeder ♦
    Commented Jul 19, 2015 at 3:01
  • @schroeder You're saying you wouldn't introduce the concept of security at all before employment? If any of it was part of the employment contract it would be unavoidably introduced pre-employment...
    – Craig Tullis
    Commented Jul 19, 2015 at 3:14
  • "the concept of security" might be introduced during the interviews, but not the policies or their content. Typically, there is an assumption that one would comply with all legally enforceable corporate policies no matter what their content. If the ability to work securely is a requirement, specifically, of a position, then the interviews would not be introducing security, but would be querying the applicant's experience with security.
    – schroeder ♦
    Commented Jul 19, 2015 at 3:41
  • @schroeder That's why I said "conceptually." :-)
    – Craig Tullis
    Commented Jul 19, 2015 at 20:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .