Rotten Apples in Tough Times

What is one security concern neglected during tough economic times? The resurgence of insider threats. A recent article in Computer World (IT Wary of Insider Attacks) brings this point into sharp focus.

Layoffs and job uncertainty contribute to stress and financial hardship. So it follows that an employee in a position of trust who feels about to be downsized out of work may either slam the door on the way out or take something marketable in lieu of pay – without bothering to gain permission.

Indicators of such betrayals of trust include people who start working long hours for no business reason or seek to gain access to networks, files, or business activities that would not normally fall within the purview of their normal duties.

What to do? Information technology professionals will lean in favor of more monitoring, usually with software or network administration tools – their comfort zone, as the article suggests.

However, there are more arrows in the quiver of the security manager. One of the best techniques for countering such vulnerabilities is to organize the work space to eliminate dark corners. This makes it difficult or impossible for any worker to hide or lurk alone in areas where he or she can take advantage of the employer’s resources. Another old-fashioned, low-tech tactic is to actually talk with employees, treat them decently, and still terminate their access to the employer’s crown jewels once it is necessary to let them go. Give them the severance package without forcing them to go through the motions of working for a final two weeks. Level with them and do your best to let them leave with a little dignity. This reduces ill feelings and gives them less motivation to seek out revenge through sabotage.

- Nick Catrantzos

Technology as Chance to Engage

Here is something being touted as the answer to the Virginia Tech problem of how to carry out broadcast notifications of a threat in time to help those under fire.

Mobile alert firm steps outside of comfort zone
Source: SECURITY DIRECTOR NEWS
Vol. 5, No. 9, Sept. 2008
http://www.securitydirectornews.com/article/sd200809plj11f/Mobile

I can't vouch for how good this information is, as it comes from a trade publication that is a thinly veiled cover for advertising vendor wares. Nevertheless, at the root of what makes such a technical solution both viable and marketable is this: helping average people engage in their own protection. Another smart thing about it, presuming it delivers the advertised benefits, is that it allows members of the public to use what they already have -- a cell phone -- instead of requiring them to get special equipment or training. True, they have to sign up with someone who has the software and makes the broadcast notifications, like the campus police or, in the private sector, a facility security office. But how different is this from a savvy society that increasingly signs up for more customized alerts from different sources, just to be actively involved in making one's own decisions about personal security?

In fact, if you want to use your cell phone as an alert device that tells you when a weather emergency or other natural disaster is headed your way, try signing up for free alerts customized by zip code at

www.mystateUSA.com

These things are encouraging, from a security perspective. They keep us engaged and self-reliant.

- Nick Catrantzos