Employees are vital link in the security chain
Published: 22 Jul 2004 14:10 BST
Back in the late '60s, Warren Moore was a young man working in the IT department at apparel giant Genesco.
As a prank, Moore rewrote some code for the company's IBM mainframe to allow him to send anonymous messages to co-workers. But his joke inadvertently resulted in his message being inserted into a sales forecast report, which was about to be presented by a Genesco vice president.
"Luckily, they didn't fire me," said Moore, who now serves as an information security consultant for Convergys. "I kept my job, but it got me thinking about computer security, and it got Genesco thinking about it too. They offered all their employees a programme on the dos and don'ts of working with computers."
Genesco was ahead of its time in offering information-security training to its rank-and-file workers. And even today, security experts say very little is being done to educate employees on antivirus techniques and company policies relating to information security.
"People are the weakest link," said Chris Pick, vice president of market strategy at security and systems-management company NetIQ and co-founder of Human Firewall, an educational and informational Web site now operated by the Information Systems Security Association, or ISSA. "Education is the first line of defence."
But apparently not many companies are following that playbook.
Last year, the Human Firewall Security Awareness Index Survey found that 48 percent of the companies participating in the survey had never provided formal security training for their workforce, Pick said. And of those companies that had, only 15 percent provided such training in the past six months. The National Cyber Security Partnership seems to be aware of the problem too. In March, the group urged companies to adopt more security education.
The lack of an informed workforce can be costly for a company, since technology can only go so far in protecting a network, security experts said.





