Employee Security Guidelines

The employees are an important element of Defense in Depth, an important layer of the onion.

Employee Security Guidelines in the Organization provides employees with security guidelines on how to protect and manage the corporate assets on a daily basis, appropriately and consistently. The previous article discussed about the internet security guidelines, this article which is part of the management of information security will discuss about the need of employee security guidelines.

Defense in Depth

The Security in place is to protect people and all the corporate assets which is applied by what is called Defense in Depth. Defense in Depth is based on the principle of layered security, thus protecting the core assets. It’s very much like the layers of an onion; each layer of the onion represents a security measure or control with the following principles:

• Deter
• Detect
• Delay
• Respond
• Detain.

The whole idea of this is to firstly deter an intruder from gaining access to the corporate areas or assets of any kind (you want them to go somewhere else instead). Secondly if they do gain access, you want to detect their presence as soon as possible and with the security measures in place, delay the intruder sufficiently so that you can respond and detain the intruder. This type of approach is applied to both physical security and IT security.

Security Measures

There are various types of security measures in place in both the physical and IT realms that represent the Defense in Depth layers. Examples of these are:

• Policies, standards and processes – this measure outlines what should be protected, how and by whom.
• Physical perimeter security measures include fencing, lighting, locks, alarm systems, video surveillance cameras such as CCTV, reception areas, guards etc.
• IT perimeter security includes intrusion detection systems, firewalls, anti virus scanning, User IDs and passwords etc.
• Internal measures include visitor escort, supervision of maintenance personnel, lockable cabinets and safes etc.
• The Employees

Employee role

The employees are an important element of Defense in Depth, an important layer of the onion. Therefore should be diligent by taking notice of what is happening around them and taking appropriate action if something does not appear right. Knowing the information that will help the employees determine what is right; when something is wrong or amiss should be provided.

What are the corporate assets?

The organization assets are broadly categorized as the following:

• People (employees, clients, customers etc)
• Facilities (buildings, equipment, machinery etc)
• Vehicles of all types
• IT and telecommunications equipment
• Your organization products
• Information held in all forms:
• Electronic – stored or transmitted in computer systems, networks, laptops, workstations etc
• Hardcopy – paper, files, books, records, notes etc
• Media – diskettes, CDs, DVD, tapes etc
• What is known and spoken.

Need to Know Principle

Access to information and other assets is based on the Need to Know Principle. This means that the employees are provided access to information and assets needed for them to carry out their job, no more – no less. This applies to everyone, including employees (full time, casual or temporary), contractors, consultants and third parties.

If this principle is applied all the time, you will ensure that the authorized level of access is not exceeded. The organization has a responsibility due to various legislation and regulations to protect specific information and other assets from unauthorized access and/or use.

Security Risks and Exposures

What are the organization safeguarding assets against? There are many risks and exposures facing the organization assets which can be outlines below.

Source of risk and exposure

The sources of risk and exposure are many and varied. The risks and exposures for one organization can vary for another. Generally the organization is exposed to the following sources:

Consequences

The consequences faced by the organization if a risk or exposure occurs include the following:

Having a good understanding how important it is to be security conscious in helping and protect the corporate assets is a good practice for all the employees in the organization. For a more complete security guidelines check here.

See also:

• Business contibuity and Disaster recovery planning
• Case study about risk assessment – an example
• Risk security assessment