Stop employees from leaking your corporate data

And the idea that an organization must guard against nefarious insider activity isn't new, either. "Most effective security programs address the people element, and any job function with access to an organization's valuable resources or assets is a risk," explains Kent Anderson, managing director of Network Risk Management LLC in Portland, Ore. Anderson cites a wide range of personnel who pose mighty risks -- everyone from security guards to IT workers to higher-level executives with the authority to override security controls.

The people problem continues to grow, since it is now harder to differentiate between internal and external threats. "The difference between an insider and an outsider is no longer clear," says Anderson, who cautions corporations to be aware of the ways that contractors, outsourcers, vendors, partner companies, and suppliers could gain access to sensitive corporate data -- either by accident or by design.

While spotting risks can be tricky enough, addressing weaknesses is even tougher, says Anderson. For example, security training programs often prove ineffective, and many employees will continually disregard advice and fail to pay heed to the cautionary tales delivered at droning security seminars.

"The average employee view is one-dimensional. These individuals are not looking at security from the standpoint of accountability for the organization. They are looking at the issue only as it affects their level of responsibility," observes Norris Roberts, director of technology for the Jennings, Mo., school district.

A quarterly employee-awareness seminar might provide a check for a compliance-driven security program, but if the employees are left to try to figure out how to apply security controls to their day-to-day job functions, that will probably never happen, says Anderson.

Roberts rattles off a list of security measures employees are likely to ignore. "Strong password practices are not being applied. The sharing of passwords continues. Good e-mail practices are ignored. And overall, inappropriate user rights and privileges remain a huge problem," he says.

"The most common mistake when educating end-users about security awareness is that the training is frequently presented in a Draconian fashion, which does nothing to encourage employees to cooperate with the policies being implemented," notes Eddie Zeitler, executive director of International Information Systems Security Certification Consortium Inc., or (ISC)2, in Palm Harbor, Fla.

"Security awareness doesn't have to be boring," he says, quickly adding that companies must do far more than just jazz up security training efforts. To make employees more invested, IT shops must convince workers that security measures are imposed for the benefit of both employer and employee.

"If employees realize they could lose their jobs over something that could have been prevented by practicing common-sense security measures, they are given extra incentive to play by the rules," Zeitler says.

Playing by the rules is non-negotiable at casinos, where the stakes are high. Corporations that have just as much to lose must constantly communicate the same message. Only then will granting the privilege of access no longer be such a gamble.

Computerworld is an InfoWorld affiliate.