Building Security vs Information Security
by: Eric Meyer
Most companies hire highly paid computer security professionals who spend hours
and hours a day configuring access policies and patching computers.
Then they turn around and hire a minimum wage security guards to protect their
millions of dollars worth of computer equipment. This isn’t even counting intellectual
property and their database of customers and names.
If a hacker has been hired to hack you which path do you think he will
take to steal company secrets? Will he spend months trying to hack the companies’
network which has been locked down by the highly paid computer security consultant?
Or will he spend a day trying to hack the poorly motivated security guard that
is paid minimum wage? Hacking a human (Social Engineering) is the greatest threat
to your company. If you don’t have someone who can combine computer
security with physical security you have no informational security.
Informational security combines every aspect of access control and building management.
Informational security ranges from how people access the building,
how the janitors dispose of garbage, computer security, staff background checks,
staff hiring, video surveillance ect.. A common lapse in physical security is that
smokers usually leave one door unlocked during the day so they can take a smoke break.
That completely cancels out your hundred thousand dollar key card system.
All a information thief would have to do is watch your building for the
day and find the smoker hang out.
Every major type of informational theft crime has used some type of social
engineering attack. Untrained and poorly paid employees are the easiest
targets because they are usually are unmotivated and easily influenced.
The key is not paying people more; the key is to train them to know what to look for.
A well trained staff member will enjoy their job and take ownership of
their responsibilities. They will not want to let the company down
if they are trained and feel needed.
Your employee hiring process should include a background check and credit check.
If the candidates have ever declared bankruptcy do not hire them.
If they are really strapped for cash they can be easily bribed or
seduced into selling your companies secrets. The federal government
does not give Secret security clearances to people who have declared bankruptcy.
Why would you let someone like that near your company’s vital data?
Your company’s weakest link is your employee’s cars and homes.
It’s easier for a hacker to follow someone home from work and then steal
their laptop out of the car. Also, employees usually leave their access
cards in their automobiles. Create company policies for storing company laptops,
PDA’s and access cards in secure locations…not in cars.
Check your company websites!! Don’t have every employees name, position,
phone number, email address and bios listed on the website.
All this information just gives a information thief more tools to work with.
Train your in house security about your computer network. If you train them
the very basics about technology and servers they will be more aware about
what people should be doing. Train them to look for portal hard drives,
key chain drives and writeable media like DVDs and cdroms. All of these
items can be used to take vital company secretes off company grounds.
Finally here is the easiest way to protect your company’s network……log
off your computer when you’re done using it. This sounds like a common
sense but nobody logs of their computer when there done. The worst culprits
are executives, who always want access to everything. If a hacker gets
inside your company, it takes less than a minute to install a root kit.
Once his root kit is installed your doomed.
Join the most popular wireless networking newsletter on the internet.
Get the inside scoop on wireless technology for the home and workplace
http://www.wirelessninja.com
Article Source: http://EzineArticles.com/?expert=Eric_Meyer