Security and the Internet

4. Employees

Create a culture of security awareness among employees.

4.1 The biggest risk for most businesses comes from their employees. Deliberately or accidentally, an employee may:

• Fail to follow security procedures. For example, using another employee's password to save time.
• Load potentially harmful software onto computers.
• Reveal confidential security information.

4.2 Where appropriate, make security a recruitment issue.

• The network manager, who controls your password and security procedures, is the greatest risk.
• Test attitudes to security in interviews and check the qualifications and references of IT employees carefully.

4.3 Make security a part of employees' contracts.

• Clearly set out your security procedures and policies. Include training in computer security in a new employee's induction.

4.4 Train employees how to handle email attachments. See Email and An email policy for your employees.

• If you do not know the sender of an attachment, delete it.

4.5 Contractors and temporary workers are a particular risk.

• Issue them with their own passwords, and give them the absolute minimum of access to your system. Providing a temp with a permanent employee's password is a common error.
• Set temps' passwords and accounts to expire automatically.