From the course: ISC2 Certified Information Systems Security Professional (CISSP) (2024) Cert Prep

Personnel security

From the course: ISC2 Certified Information Systems Security Professional (CISSP) (2024) Cert Prep

Start my 1-month free trial Buy for my team

Personnel security

“

- [Instructor] Personnel can often be the weakest link in the security chain. So personnel security should be an important part of the foundation of any cybersecurity program. It's very important to have strong security policies that clearly outline expectations for individual behavior, as well as the consequences for failing to comply with policy. Personnel security programs should be built upon educating employees about these policies and their role in protecting the enterprise. As you build your personnel security program, you should design explicit procedures that describe how you will handle violations of security policy. Now, this is often a tricky situation that requires coordination between cybersecurity teams, managers throughout the organization, your legal team and your human resources department. You should never approach an individual about a policy violation without first consulting with management, you might wind up causing more trouble than you expected. One of the specific issues that you should address is the use of personal resources on company premises and with corporate data. You'll want to clearly identify whether it's appropriate to use personal computers, personal email or cloud service accounts and personal mobile devices for these purposes. If you allow the use of personal resources, you should have procedures for vetting those uses to ensure that they comply with security policies and remain in compliance over time. You'll also need to arm your staff with the knowledge that they need to protect themselves against both technical and non-technical risks, including social engineering attempts. Education is the best preventive tool to protect your team from falling victim to these attacks. Also, you have to remember that not every employee has your organization's best interests at heart. Insider attacks are a source of many very damaging security breaches. When someone violates your trust, the impact can be devastating. Verizon recently released a report analyzing a year's worth of data breaches around the world, and they found that a quarter of all security breaches were the result of an insider threat. You can protect your organization from the insider threat by performing strong and consistent background checks of new employees. I'll talk more about those later in this course. You can also implement careful monitoring processes, provide managers with training to help them identify disgruntled employees and intervene before something bad happens. And by deploying data loss prevention technology that watches for unauthorized data exfiltration. Protecting against personnel security threats can be very tricky, but it's an important component of any security program.

Contents