The best firewalls on the market can't protect against such scenarios.
"Why even lock your doors if employees happily hold them open for a stranger following behind them?" asks Alex Ryan, security officer at VeriCenter Inc., an IT infrastructure and managed services provider in Houston.
The risk that employees pose is significant. They can fall prey to social engineering, a fancy term for being conned. They can ignore company policy by failing to encrypt sensitive data. Or they might install unauthorized software that can corrupt the system.
Think you're well protected? Recent findings from the Computing Technology Industry Association might convince you otherwise. In this year's CompTIA information security study, 59 percent of the organizations surveyed indicated that their latest security breaches were the result of human error alone. That's up from 47 percent last year.
Despite such statistics, many companies fail to do enough to educate their workers. That's what the Internal Revenue Service discovered, according to a March 2005 federal government report.
Federal inspectors posing as IT help desk staffers trying to correct a network problem called 100 IRS managers and employees and asked them to provide their network log-in names and temporarily change their passwords to ones they suggested. Inspectors persuaded 35 IRS workers to do just that.
This success came despite IRS efforts to educate employees.
Dan Galik, the IRS's chief security officer, says his agency "re-energized the awareness program" following the report. In addition to annual reviews, posted announcements and online courses mandated under the 2002 Federal Information Security Management Act, Galik says the agency has added some innovative approaches.
One was a Jeopardy-style game held last November during which workers tried to give the right answers on security-related topics.
"You've got to come up with something that will stick," Galik says.
Here are some other practices that have proved effective in getting the message across.
Make It Personal
"Many employees worry about their home machines' security. Leverage that concern to promote general security principles that can be applied at both home and work," Ryan says. "It's a way to make people personally interested in security." She e-mails employees newsletters with tips that alert them to the latest scams or viruses that could affect both their work and personal PCs.
Companies can also use personal examples to show what they're trying to achieve on a corporate level, says IT security expert Candy Alexander, a consultant at Alexander Advisory LLC in Merrimack, N.H. For example, companies can tell workers that protecting passwords is no less important than protecting their debit cards' PINs.
If you have the luxury of getting people into a classroom for training, Ryan recommends a little live action to drive home the message. She has enlisted students during classes to act out roles, such as a hacker and an administrative assistant. She instructs the hacker to pressure the assistant for his computer password with techniques that real-life social engineers use.
Companies also shouldn't underestimate the power of publicity, says IT security expert Jim Litchko.
He points to a situation that played out at a government intelligence agency where a senior official, against agency policy, brought in a disk that turned out to contain a virus. The agency fired him and let everyone know it.
"To those people who value their jobs, it's very effective" in highlighting the importance of security, says Litchko, president of Litchko & Associates Inc., an IT consulting firm in Kensington, Md., and past chairman of the IT security council for ASIS International, an organization of security professionals.
Employees should also have simple steps to follow if they suspect security problems. Litchko says one company had stickers on its computers providing information on typical scams, along with a number to call for help.
Integrate Security Awareness
Companies that consider security training an annual event are missing out on opportunities to make security part of the everyday culture, says Jonathan G. Gossels, president of SystemExperts Corp., a Sudbury, Mass.-based network security consulting firm.
Gossels recommends leveraging ongoing training events. He notes that one client, a large chemical company, incorporates security components into its regular professional development courses.
"No one would take time out to take a security course, but to take 15 minutes in another course works well. And they're able to tune the security message to the people taking the course," Gossels says.
Also, don't let security become an "out of sight, out of mind" issue, says Litchko.
"It has to be a continual thing. You can't just put up a poster and keep it there a year. It needs to be constant and varied."
In addition to her monthly security newsletters, VeriCenter's Ryan regularly e-mails summaries of news articles related to IT security.
Another way to keep security on everyone's mind is to use technology itself to remind them, says Joel Rakow, the e-crimes practice leader at Tatum LLC, an executive consulting and services firm in Atlanta. Companies can have security-related tips and reminders -- like "Our data is sensitive information," or "Customer information is available on a need-to-know basis" -- flash up on screensavers.
Like so much else in IT, security training should not take a one-size-fits-all approach, says Susan Hansche, program manager at Nortel Government Solutions Inc., a Fairfax, Va.-based company that provides information-assurance training programs to the U.S. Department of State.
Hansche recommends role-based training, where the messages and action items are targeted to specific audiences. Her company, for example, uses eight different role-based programs to train 1,000 State Department employees annually. The courses for executives are different from those for senior-level managers and general end users.
Alexander has taken a similar approach to training. She says executives like war stories, middle managers prefer presentations that give them checklists of action items, and general end users like information in small, easily digestible chucks.
When Alexander worked at the former Digital Equipment Corp., she developed a scavenger hunt that asked workers to find 10 items related to security on the company's Web site. Those who got all 10 were entered into a drawing to win a mug.
You might be surprised to learn that the nonmandatory event drew in more than 70 percent of the company's worldwide workforce. "Positive competition is really beneficial," Alexander says.
K Rudolph says she has seen similar success with competitive programs. Rudolph is a Certified Information Systems Security Professional and chief inspiration officer at Native Intelligence Inc., a company in Glenelg, Md., that provides IT security awareness services to government agencies and private industry.
She says one of her clients implemented a "news hawk" program, where the first employee to bring in a news story on IT security gets a prize. Prizes have ranged from time off to movie tickets. The awareness team then distributes the news item through a weekly e-mail or its periodic newsletter.
Make It Fun
IT security is a serious topic, but security officials have found that some levity helps keep workers' attention.
Alexander, like many others, has used Web-based training to educate employees on security topics and used online quizzes to test their knowledge. Although the material covered significant topics, she still found ways to elicit some smirks. For example, the multiple-choice answers for "What is social engineering?" included "a college degree" and "a job on a cruise line" -- obviously false answers infused with a hint of dry wit.
"It's not extremely silly," Alexander says, "but it's something to make people remember."
Pratt is a Computerworld contributing writer in Waltham, Mass. Contact her at marykpratt@verizon.net.
SIDEBAR
Would your workers pass the test?
As an executive at an IT consulting company, Bruce Baird assumed that his workers were security-savvy. But a conversation with a former colleague rocked his confidence.
Baird, vice president of operations at T2 Software Services Inc. in Tampa, Fla., learned from security expert Todd Snapp that hackers can set up phones to spoof the Caller ID names of legitimate companies.
"One of the things we look for when we hire consultants is interpersonal skills -- [people who ask] 'How can I help you?' when talking to clients. And if they think they're talking to the client and they're really not," they could be unintentionally passing along information to hackers, Baird says.
Companies have used so-called penetration testing to see how well their technology can fend off intruders. Some are now using the same techniques to see how well their employees can spot potential problems. The results, according to reports, aren't encouraging.
"We have found that a lot of companies spend a lot of money and time building a strong, secure infrastructure, but they don't spend much time on securing their people. They're not trained on what to look for, at a time when hackers are getting more sophisticated," says Snapp, president of RocketReady, a Tampa company that offers readiness testing in addition to other services and products.
RocketReady's employees use the same techniques that malicious hackers use to gain information and access to a company's IT infrastructure and the data it contains.
They gather information from readily available sources, such as a company's Web site. They then pose as customers, potential clients, representatives of partner companies, travel agents and even employees to get specific details, such as employee ID numbers and acronyms used only by company workers, that will help them in their attacks.
Baird doesn't want T2 employees to fall prey to scams. Since Rocket-Ready showed him how easily it could spoof Caller ID, Baird has upped company-sponsored training on this issue and now requires staffers to take annual courses on the topic.