Chapter 7: Security and Personnel
7.1 Overview of Security and Personnel
Importance of Human Factor: Recognizes that employees are often the weakest link in security
due to unintentional errors or lack of awareness.
Goals: To establish a culture of security, implement effective personnel policies, and provide
training to mitigate risks associated with human behavior.
7.2 Security Policies Related to Personnel
Purpose of Personnel Security Policies: To define roles and responsibilities, establish security
protocols, and ensure the protection of sensitive information.
Key Policies:
o Acceptable Use Policy (AUP): Outlines acceptable behaviors for using organizational
resources and data.
o Security Clearances: Defines levels of access based on job roles, requiring background
checks and clearance processes.
o Termination Procedures: Procedures for revoking access and ensuring that sensitive
data is returned upon employee termination.
7.3 Hiring Practices and Background Checks
Importance of Thorough Hiring Processes: Effective hiring practices help ensure that the right
individuals are selected for sensitive roles.
Background Checks:
o Types: Criminal history checks, credit checks, and employment verification.
o Purpose: To identify any potential risks or issues that may affect an employee’s
suitability for a position.
Reference Checks: Contacting previous employers to verify the candidate’s character and work
history.
7.4 Security Awareness Training
Objective: To educate employees about security policies, potential threats, and best practices to
protect sensitive information.
Key Components:
o Training Topics:
Phishing Awareness: Recognizing and avoiding phishing attempts.
Social Engineering: Understanding manipulation tactics used by attackers.
Password Security: Best practices for creating and managing strong passwords.
Data Handling Procedures: Guidelines for handling sensitive information
securely.
o Training Methods:
Onboarding Training: Initial training for new employees.
Regular Refresher Courses: Ongoing training sessions to reinforce security
principles.
Simulated Attacks: Conducting phishing simulations to assess and improve
employee awareness.
7.5 Managing Insider Threats
Definition of Insider Threats: Risks posed by employees or contractors who misuse their access
to harm the organization, either maliciously or unintentionally.
Types of Insider Threats:
o Malicious Insider: Deliberately causing harm (e.g., data theft, sabotage).
o Negligent Insider: Unintentional actions that lead to security breaches (e.g., falling for
phishing scams).
Mitigation Strategies:
o Access Controls: Implementing the principle of least privilege to limit access to sensitive
data.
o Monitoring and Auditing: Regularly reviewing user activity logs and access patterns to
detect suspicious behavior.
o Incident Reporting: Establishing a clear process for employees to report suspected
insider threats without fear of retaliation.
7.6 Incident Response Involving Personnel
Role of Employees in Incident Response: Employees are critical in detecting, reporting, and
responding to security incidents.
Incident Reporting Procedures: Clear guidelines on how and when to report security incidents.
Communication Plans: Ensuring employees understand their roles during an incident, including
communication protocols.
7.7 Termination and Offboarding Procedures
Importance of Secure Offboarding: Properly managing the exit process to protect organizational
data.
Key Offboarding Steps:
o Access Revocation: Immediate termination of access to systems and data upon
employee exit.
o Return of Assets: Ensuring that all company-owned devices and sensitive information
are returned.
o Exit Interviews: Conducting interviews to gather feedback and identify any security
concerns.
7.8 Building a Security Culture
Creating a Security-Conscious Environment: Fostering an organizational culture that prioritizes
security as a shared responsibility.
Strategies:
o Leadership Involvement: Engaging management in promoting and participating in
security initiatives.
o Rewarding Good Behavior: Recognizing and rewarding employees who demonstrate
good security practices.
o Regular Communication: Keeping security at the forefront through newsletters,
meetings, and updates.
7.9 Legal and Ethical Considerations
Legal Compliance: Ensuring personnel policies comply with employment laws and data
protection regulations.
Ethical Considerations: Balancing security needs with respect for employee privacy and rights.
Data Protection Training: Training employees on the legal obligations surrounding data
protection (e.g., GDPR compliance).
7.10 Continuous Improvement
Regular Policy Review: Periodically assessing and updating personnel security policies to address
new threats and organizational changes.
Feedback Mechanisms: Establishing channels for employees to provide feedback on security
policies and training effectiveness.
Metrics for Evaluation:
o Training Effectiveness: Assessing employee knowledge through tests or assessments
post-training.
o Incident Tracking: Monitoring the number and types of security incidents related to
personnel to identify trends and areas for improvement.
