Human Aspect of Information Security > Presentation done on 12 October, 2011 E-Crime Event, Istanbul

1. > The Human
dimension
human aspect of information security

2. Guess You’ll all agree
with me that….

3. bad information security
means
bad company security
lost credibility

4. we must be sure that
we protect our data, our
commercial secrets, our assets
and our business transactions

5. YOU DO EVERYTHING TO
MAKE THIS HAPPEN
FOR SURE

6. but…
EMPLOYEES WORK WITH COMPANY DATA,
COMPANY SYSTEMS, THEY ARE IN TOUCH WITH
CLIENTS, SERVICES AND PRODUCTS.
THEY NEED TO UNDERSTAND THE BASIC
PRINCIPLES OF INFORMATION SECURITY.

7. Fact:
HUMAN ERROR IS THE
CAUSE OF 42% OF ALL
SECURITY BREACHES
ISC2 White Paper : Securing the Organizations: Creating A
Partnership Between HR and Information Security

8. Information security is one of
the biggest challenges a business faces today.
55% of 50% of
companies used respondents think that
their employees had
over 7 different little or even no
vendors to keep awareness of data
their network protection issues or
secure. corporate security policy.
Ref: Checkpoint Technologies&The Ponemon Institute Survey 2011 >>
2,400 IT security staff across the world

10. When does “an employee”
becomes a RISK?

11. Do you know what these are?
123456
Password
iloveu

12. I mean…
The gap between you
guys
And your average
employee
is
HUGE

13. Fact:
We don’t know
As much as you do

14. Paper, pen, letter
typewriter
computer
internet, e-mail
Web 2.0, social media
Virtual communities

15. People move…
Both in real and virtual world…
And they create risk!
With or without knowing it

16. A picture…
87,5% of large businesses have a security policy in place.
67% of the companies that give a high priority to security also had a security policy.
A big majority of companies take steps to raise awareness among employees.
More than 50% allow staff to access their systems remotely.
The proportion of businesses restricting internet access dropped by 50%.
Now only fewer than 10% gave no access to the internet.
Employees are increasingly being targeted by "social engineering" attacks.
Businesses are becoming more concerned about what was being said about them on
social networking sites.
More than 80% of large companies blocked access to inappropriate websites.
86% logged and monitored staff access to the internet.
Research by PWC UK , 2010

17. more exposure,
more action,
more knowhow sharing,
more interaction
The Return is big but
the Risk is big too

18. your employees
can fast become
the weakest link
in your information
security

19. changing employee behaviour
is the key
to improving information security.

20. The big how

21. Offer them a clear framework
EMAIL SECURITY
INTERNET SECURITY
DATA SECURITY
ASSETS SECURITY

22. Do you have policies?
Why?

23. Customize the access
according to the skills and
needs of the employees
customize the risk
But standardize your
policies

24. The worst way to
communicate a policy is
Publishing it

25. Educate, educate, educate:
have your employees build
the “awareness” muscle
Give people good habits

26. Communicate your
best practices

27. Create an awareness
culture:
let it be a dialogue

28. Make it formal:
it is serious

29. Make it simple,
make it fun,
make it participative

30. Make it a
management issue

31. Be fully proactive

32. Tell them
Personal = professional

33. Prohibiting
Limiting
Banning
is not your key to success
trust

34. answer
WIIFM?

35. Hr & it partnership*
Does hr talk about these?
I am afraid not…
Legal base remains unclear too…

36. You have to be security
and policy mentor
Your employees have to be
security and policy literate
Your company has to be
security and policy fluent

37. get connected
E-mail:
pinar.akkaya.pa@gmail.com
LinkedIn:
http://tr.linkedin.com/in/pinarakkaya
Twitter: http://twitter.com/PINARAKKAYA
http://twitter.com/lifesocialmedia
http://tr.linkedin.com/groups/hrleadersturkey