Newsletters Welcome, Guest Log In | Register

Subscribe

Sign up now and get the best business technology insights direct to your inbox.

  • Daily Edge
  • CTO Edge Update
  • Business Tools & Templates
  • Aligning IT & Business Goals
  • Maximizing IT Investments

0

People Skills Vital to Security Arsenal

by Susan Hall, IT Business Edge
Dec 23, 2008 12:00:00 AM

When IT Business Edge's Rob Enderle wrote in October that we could see major strikes and riots before this financial mess is over, it seemed a bit far-fetched.

 

But since, there have been killings, a suicide attempt at work, an attempted extortion, the takeover of a factory, and Web site defacement.

 

And those have been the reactions of companies' own employees, not some outside threat.

 

"This is something that people should take seriously," says Ellen Libenson, vice president of product management for access software vendor Symark.

 

Clearly, companies need people skills as well as technology to deal with insider threats.

 

"Whenever people feel they're not appreciated, they're not paid enough, they're going to lose their job, when they did work they feel an emotional attachment to, there's a greater risk of sabotage. And they may think things are so disorganized, who's going to notice?" Libenson says.

 

Indeed, in a recent survey by security vendor Cyber-Ark Software, 40 percent of  UK office workers said they would steal sensitive data if they felt their jobs were at risk, and 71 percent of respondents globally said they'd do so if they were fired suddenly.

 

The recent chaos is upping the ante for managers, already advised to watch for people who suddenly work longer or even shorter hours, seek access to unauthorized information, or have questionable meetings with clients or even competitors.

 

But employee anger could be building long before it manifests itself. A colleague in the trial of San Francisco computer engineer Terry Childs testified that Childs refused to share passwords a full year before he locked down the city's FiberWAN network. And apparently that didn't set off any alarms within the organization.

 

That only illustrates the limitations of trying to enlist coworkers as extra eyes and ears to protect the company. Indeed, in the recent survey by KPMG done last summer that showed high rates of malfeasance already occurring, 89 percent of U.S. workers called reporting it "doing the right thing," but just 39 percent expected they would be satisfied with the way the incident would be handled.

 

And many times, people just don't snap to what's going on.

 

"It's amazing how many people will overlook it," says Libenson.

 

At a time when so many companies are laying off workers, Enderle recently wrote that few companies know how to do it well.

 

Most people just need the opportunity to vent their feelings, Libenson says, and it pays for companies to provide a way for them to do so. Just allowing people to feel that they have been heard goes a long way toward diffusing anger, she says.

 

"The worst thing is not being open with people or actually misleading them into thinking that things are OK when they're not," she says. "People don't like being lied to and that's when they react the worst. And the market reacts badly to that. They think, 'What else haven't you told people? What haven't you told the analysts? What haven't you told your vendors?'"

 

She prefers face-to-face communications with employees, ideally from senior executives. If the company culture has not fostered openness, employees might not feel free to speak their minds. In that case, they can be allowed to submit comments before the meeting that will be read anonymously, she says.

 

Employee e-mail and intranet threads tend to take on a life of their own, often requiring companies to do some serious damage control, as IT Business Edge's Ann All wrote recently. And technologies such as Twitter are making the whole layoff process much more visible to the world at large.

 

It pays for companies to provide counseling and outplacement services to employees. Even placing an ad in the newspaper inviting other companies to recruit its laid-off workers can go a long way toward improving morale, Libenson says.

 

Laid-off workers can become financially desperate — and there is a market out there for trade secrets and information about how to infiltrate your systems. Meanwhile, overwhelmed workers who remain might feel no one cares, they just don't have time to be as vigilant about security as before, or they may be more vulnerable to social engineering, Libenson says.

 

Those who survive a layoff suffer their own stress: rising workloads, sinking morale, continuing anxiety and feeling they should somehow be grateful nevertheless.

 

This MSNBC story quotes an unnamed California software engineer saying, "If I hear 'At least you have a job' one more time, I'm going to physically injure someone."

 

This Workplace Coach column in the Seattle Post-Intelligencer offers good advice on inspiring loyalty and cutting the stress for the troops still on the job.

Add a comment Leave a comment on this blog post.

There are no comments on this post

Lowering Your IT Costs with Oracle Database 11g Release 2

This white paper identifies the key capabilities a database management solution needs to successfully deliver more information with higher quality of service, make more efficient use of IT budgets, and reduce the risk of change in data centers.

Software Forum: Information On Demand Virtual Experience

This interactive virtual forum presents leading IT experts providing the insights you need to turn your information into a strategic driver for innovation, business optimization and competitive differentiation.

Strategic IT Planning & Governance Best Practices Guide

Use this guide — along with the more than 60 templates included — to ensure the overall success of your entire IT department.

Learn more >

Six Sigma Framework for IT

This collection of tutorials, calculators, and templates will show you how to apply six sigma thinking to IT service management.

Learn more >