PERSONNEL SECURITY

PART 2 PERSONNEL SECURITY MEASURES WITHIN A COMPUTER INSTALLATION

Computer staff should display high personal and professional standards and qualities: a. Intelligence. Judgement, commonsense, imagination,

perception, problem-solving abilities. b. Compatibility. Co-operation, tact, teamwork, relationship

with superiors, peers and subordinates. c. Strength of Character. Maturity, stability, integrity, moral

courage, determination, honesty. d. Loyalty. Sense of duty, reliability, dedication to the

organization, enthusiasm for its aims. e. Professional Knowledge and Abilities. Ability to

perform current duties, efforts made to keep abreast of new developments in the individual's field of employment.

f. General Characteristics. Breadth of interests, social attributes, powers of written/spoken expression, energy, appetite for work, staying power, drive, health.

Sadly, companies have been known to recruit data processing staff with less diligence than for personnel of other departments. Indeed any strict company procedures for recruit selection can be deliberately waived or ignored in respect of the computer department. Qualifications often outweigh all other qualities and considerations within the current market place where there is a serious shortage of good computer staff. Post-employment supervision is then rarely carried out by management on those staff now absorbed into the insular and mysterious computer world. There are several stages involved in the achievement of a sound and comprehensive personnel security policy.

STAGE 1: IDENTITY SENSITIVE JOBS A N D KEY PERSONNEL

In order to apply most cost effectively the available personnel security resources, those person who hold the most sensitive appointments, those who have access to the more sensitive and valuable information and assets, and those on whom computer operations most depend, should be identified and concentrated upon.

STAGE 2: SCREEN PERSONNEL The screening process is best achieved before employment, during the recruitment of new staff, but it can be applied retrospectively. The simple methods of screening are often the most effective. If designed well, application forms completed by prospective employees will contain a wealth of personal and background information. More can then be learned about the individual from character~professional referees. These should include at least the previous employer, and at least one character referee whose credentials are provable, such as a senior public or government servant, a member of one of the professions (lawyer, doctor, teacher) or a commissioned officer of the armed services or civil police - we need one to attest to our worth for a passport, why not a job? Private background investigations may be considered appropriate in the case of applicants for very sensitive appointments. Finally, whatever is learned about an individual in other ways, a properly

structured interview should be conducted in order to gain a 'feel' for that person. The personal qualities that should be considered in an applicant are:

• Previous employment and positions held, and career pattern/development. In particular, any mysterious gaps in this history should be thoroughly accounted for - do they represent a prison sentence, or a period in hospital?

• Check references and qualifications throughly. There are numerous examples of fictitious 'previous employers' and legendary "university of life" type diplomas and degrees. Nothing should be taken at face value. Find out about:

(1) COMPETENCE. The most highly qualified individual can be useless in practice, and a polished performance during interview can be little more than a facade for incompetence. Devise some simple test of an individual's abilities in the work for which he or she is to be employed. Incompetent indiv!duals are more prone to cause operator errors, and will be more vulnerable to the pressures of blackmail or subversion.

(2) TIME-KEEPING AND ABSENTEEISM. How reliable is the individual?

(3) DISCIPLINARY RECORD. Are there any continuing involvements with legal proceedings, either criminal or civil?

(4) MEDICAL HISTORY. Is there any evidence of mental instability, or protracted~chronic illness which could place financial or social pressures on the individual? One effective method of obtaining these facts is to offer company-paid life insurance policy which requires a medical examination of the person to be insured; medical-in-confidence details may not be forthcoming, but if the candidate is fit to insure then there is probably no serious affliction.

(5) TERMINATION. What were the reasons for termination of previous employments?

(6) PREVIOUS EMPLOYER. Would any previous employer re-employ, or would any referee?

(7) OBLIGATION. Are there any continuing obligations upon the individual from any previous employment?

(8) PREVIOUS' EMPLOY. Was the individual ever employed in the past by one's own organisation, and if so when and under what circumstances and for what reasons did the individual leave? Has he declared this previous employment. If not, why not?

(9) RELATIONSHIPS. What were the individual's relationships with colleagues - was the person able to work as the member of a team? Was he or she liked and respected? Were there any problems that arose concerning ability to work with others and vice versa? There is one recorded case where a programmer with the most atrocious body odour disrupted an entire DP centre and another where the individual's penchant for gossip brought the complete staff out in mutiny.

• Consider the individual's origins, domestic and family circumstances, and contacts or family connections with competitors. Ask for proof of identity and nationality such as passport or birth certificate.

23

JUI, o- AUG TIIE COMPUTER I,AW AND SECURITY REPORT [~ 990-9~ I 2 CLSR

• Is there any evidence or history of alcohol or drug abuse? • Is the individual a member of any professional or business

associations? Are any strong political views held, and if so what? Does the candidate hold any public or other responsible office (councillor, trades union official, etc) which may occupy any inordinate amount of time and thus detract from performance at work, or which may bring the candidate or the company into unwanted conflict or limelight?

• What is the individual's lifestyle? What are his or her social and sporting activities? Are there any signs of excessive or unexplained wealth or extravagance, and is there any indication that he or she may be over-extended?

• Consider the individual's driving record, which will reveal much about character, emotional stability and maturity.

• If possible, elicit information about the individual's creditworthiness within the banking, mortgage, credit card and private finance circles. There are specialist services available in this field.

• If the individual has previously served in the armed forces, discharge papers will be available for scrutiny.

Background enquiries or field enquiries beyond the scope of company resources can be contracted out to firms specializing in such work. The voluntary use of lie detectors may be considered worthwhile at times, but these can create unwanted animosity and mistrust from the very start of one's relationship with a prospective employee. Personality - or psychometric - testing is used by many large companies when recruiting for jobs where an employee's personality is an important factor in his or her future job; these tests can also reveal inherent security weaknesses in an individual. They should be used to complement the job interview not replace it, and will indicate such diverse qualities as leadership, teamwork, sociability and reaction to stress. There is resistance to such tests, mainly due to ignorance, fear and suspicion, and cost is often cited as a major objection. But modern techniques are vastly improved over the original tests of 15 or so years ago, and an accurate personality profile can be gained from a test lasting only 45 minutes. They are designed so that they cannot be "best-guessed" and are resistant to deception by the person under review. They must, of course, be professionally administered and analysed properly, or they are of little worth. Like any tool they only work satisfactorily in the right hands. However, only intelligence is tested, not the whole person, and the subject does not need to be honest and accurate. Finally, the tests are of greater worth if the results are explained to the candidates, giving them an insight into their strengths and weaknesses. Some final words of caution about references and testimonials:

• References are usually nominated by the candidates, and so are biased.

• The motives of the referee, especially present employer, cannot always be determined. A good reference may indeed reflect the individual's worth or it may be that the present employer is trying to get rid of a poor worker; a poor reference may be about a good worker whose boss is reluctant to release.

• References are written in a language all of their own, and often a translator is required to reveal the true meaning of faint praise. "Bloggs has tried hard..." (failed); "Bloggs' satisfactory performance ..." (pathetic); "... has shown

average intelligence ..." (has more teeth than brain cells): "... a person of sound qualities ..." (I would hesitate to breed from individual); how often have we used such phrases ourselves to avoid the unpleasantness of confrontation with our staff, or simply because we are naturally considerate and do not wish to offend?

STAGE 3: AWARD SECURITY CLEARANCES Classification of data provides adjustable security levels; security clearances provide adjustable levels of trust. We must be able to indicate who is and who is not to be allowed access to the various classifications of data, and this is achieved by granting security clearance levels to individuals depending on their trustworthiness. The higher the level of clearance, the greater the trust we place in the individual, and the more sensitive the material we allow such a person to see. This process is linked to, and follows on from, the screening process. There are essentially three types of employee:

• UNCHECKED. Uncleared personnel will not have been checked in depth or at all for their honesty, reliability, integrity or loyalty to the organization, and their contact with sensitive data must be limited accordingly. There is no suggestion that such people are dishonest or untrustworthy, it is simply that we do not know. In this group, though, will be those, who because they have failed checks or have proved to be of doubtful character, must be kept away from sensitive data.

• NO REASON TO DOUBT. Those employees about whom limited checks have been made, and which they passed, will be awarded a level of clearance to allow some access to classified data of a certain value.

• HIGHLY TRUSTED. Most exhaustive and positive checks into an individual's history, background, family, personal life, moral views and previous employment will indicate those who may be trusted with the most sensitive data. This positive screening is only good as to the day of completion and cannot guarantee reliability and honesty, but in the risk-taking business of security it must reduce the chances of loss or compromise of data by dishonest activity.

Each level of clearance will allow a greater level of access and a greater award of responsibility. An unchecked employee may be allowed to work in the receipt and dispatch section, a no- reason-to-doubt employee may be allowed to program or operate the computer, while the highly trusted person would fill such sensitive and responsible appointments as systems manager. It may, indeed, be prudent to screen such as the installation manager to a level higher than apparently necessary, since the aggregation of data and the importance of the role may make this person important to the very survival of the company. The work of a newly-arrived or obviously unstable employee must always be treated with more suspicion than that of a senior and long-standing employee. But take care with the latter, too.

STAGE 4: ARRIVAL PROCEDURES An employee's contract of employment should state clearly and unambiguously:

• His or her personal responsibilities and duties towards the security of computer assets, including information, so as to:

(1) Remove doubt as to exactly who does what.

24

1UL ~ A[G TttE (OMP[!T~R L:~W AND SECURITY REPORT 1 9 9 0 - 9 1 ] 2 CLSR

(2) Bring this vital topic to the employee's attention from the time of his earliest associations with the organization.

(3) Allow the medium for any necessary subsequent disciplinary action.

• The formal disciplinary procedures adopted by the organization as well as the type of behaviourloffence.which will cause it to be invoked.

• The constraints to be placed on the employee in the event that he or she leaves the company's employ, in particular the non-disclosure of sensitive or proprietary information to a competitor (the so-called confidentiality clause).

• That any professional books, papers and presentations written or given are to be cleared in advance by senior management.

The employee should sign as having read and understood the contract of employment and all general security regulations in force. The employee should also agree in writing to the random search of his person and belongings at work, or on entering or leaving work. There should then follow an agreed and clearly understood period of probationary employment of, say, six months. During this time special note should be taken by supervisors of the employee's behaviour, performance and apparent security awareness. At the end of this period, a deliberate review and decision should be madeabout suitability and retention. The probationary period should not be allowed simply to fizzle out.

STAGE 5: TRAINING AND AWARENESS There should be established an effective computer security training and awareness programme to ensure the continuing reliability of employees. Such a campaign can be formal or informal, but it should be kept simple, enjoyable, understandable, innovative, cover the salient points of computer security over a recurring period of, say, two years, and draw upon company experiences and those of other organizations. Posters, beer-mats, and notices in routine company orders/newsletters can all be used to disperse the message, and a number of firms produce specialist video films that have been found to be a particularly effective medium. Properly conducted and controlled visits around the computer centre, and a comprehensive and detailed briefing about computer operations within the organization and the employee's part, should be given to new arrivals. This will emphasize, but also take away any fear or misconceptions about the nature and importance of the computing function within the organization. Mystery creates fear in many, and in others the "jar of sweets" effect where they become intent on the forbidden and unknown. Teach staff above all else to challenge strangers, and not to accept identity or story at face value. Always encourage them to check back, no matter what the embarrassment or inconvenience.

STAGE 6: SUPERVISION Most larger organizations already use a formal system of annual appraisal of individual performance, in order to guide careers and to select those more able candidates for further promotion. Such a system is ideal for monitoring those personal qualities which indicate an individual's security reliability and honesty, and any rotten apple will be identified before any significant or lasting damage can be done to the computer operation.

More informal, everyday monitoring and supervision of personnel is in any case a vital element of any supervisor's role, and the disloyal, disaffected or dishonest worker should be recognized. Low morale, which is a common precursor to incompetence or disaffection, should also be identified and its causes dealt with, as much as a matter of good practice as a security measure. Remember to re-appriase an individual's security clearance and reliability if jobs are changed within the company, including promotion, or if performance or personal circumstances change, especialy for the worse. The security education programme should encourage all staff to be vigilant, and report any security matters especially the suspicious activities of a colleague, boss or junior. Such things as illegal orders to contravene security regulations, irrational or unusual behaviour, unusual spending and apparent wealth, or unexplained absenteeism or lateness for work should all ring alarm bells in people's minds. The Big Brother image of such a requirement should be countered by a clear understanding on everyone's part of the greater need of the organization over the individual. More importantly, though, such prompt reporting may save an individual from falling into even deeper trouble.

STAGE 7: TERMINATION OF EMPLOYMENT PROCEDURES

Formal termination of employment procedures should be introduced for persons leaving the company. It may be necessary to ban some employees from the installation as soon as they make known their intention to leave. Post- employment agreements should be re-stated, with individuals being reminded in particular of their agreement not to tell competitors any company trade secrets they may know. A suitable signed statement to this effect should be obtained. Any access keys or tokens for the site and the computer should be recovered and computer access authorizations (passwords) revoked. Finally, the rest of the organization should be informed of the individual's departure, so that combination settings, etc, can be changed. It may be appropriate to include in these procedures any employees moving posts within the organization.

STAGE 8: MISCELLANEOUS CONSIDERATIONS CONTRACT EMPLOYEES. Do not treat contract employees as if they were employed by the company - they are not, and their loyalties will be to their own firms. Personnel security measures must be bolstered for such individuals. Do not forget the maintenance engineers, even though they may be regular visitors. Contract cleaning, increasingly common in many organizations, results in a variety of possibly unsavoury individuals being admitted without supervision to the installation. Consultants, for all their qualifications and assumed importance, are also outsiders; usually they can be trusted since they would soon be out of business if they broke confidences, but there may be things you do not wish them to know.

REMOTE SITES/TERMINALS, Do not forget remote sites~terminals' staff, who are often out of mind, are a greater risk to security since they often work unsupervised, can remain anonymous, and often have direct access into the very heart of the system. Included in this group should be any maintenance firms with whom remote diagnostic contracts have been arranged.

VISITORS. Visitors to the computer installation, either regular or unknown, should be included within the personnel security procedures as appropriate, including background checks and

25

JUL o- AUG TIIE COMPUTER I,AW AND SECURITY REPORT [~ 990-9~ I 2 CLSR

authentication of those to be allowed access. If necessary, and in any case as good practice, all visitors to the installation should be escorted at all times during their stay by a member of the computer or security staffs.

"REMOTE CONTROL' OVER EMPLOYEES. A member of the installation staff, who apparently has insufficient skill or knowledge to subvert the system security features, may be being guided by someone from outside with such knowledge. ACT POSITIVELY, If an individual's security reliability has been brought into doubt for any reason, then until any such suspicions have been entirely resolved, access to the system should be denied at once. Often, the individual's access authority (password etc) can be revoked by system management without the person's knowledge or help, but it may be necessary to remove an individual physically and with surprise. For a software bomb, placed in advance by a dishonest employee in case of detection, the touching of a key sequence on the keyboard could be sufficient to demolish the whole database; if the stakes are high enough and a crook realizes the game is up, then this is just what might happen. Do the same for an employee who resigns; given him pay in lieu of notice and get him off the premises straight away, or at least away from the computer.

LOYALTY EXTENDS UPWARDS AND DOWNWARDS. Employers must treat, and be seen to treat, their staff fairly and honestly if they are to expect fair and honest treatment in return. This is especially true for one's ADP staff who are by nature intelligent and perceptive. WALK THE SHOP. Managers must get away from their desks on a regular basis, to walk the shop and talk to the employees. The perspectiye from below is entirely different from that from above, but often equally valid. An eagle against the ground is invisible from above, but from below can be seen silhouetted against the sky; such "eagles" are stalking every organization, ready to pounce on any weaknesses in the system and invisible to the bosses on the top floor. "IF YOU PAY PEANUTS, YOU GET MONKEYS". If you require high quality and trustworthy ADP and security staffs, especially in today's competitive market where there is an overall shortage of computer skills, then you must be prepared to pay at least the going rate. This alone will not guarantee security reliability, but cheap wages will attract the less able and more unsavoury members of the security and ADP community. SET A GOOD EXAMPLE. A company that operates efficiently and honestly, treats it staff and clients fairly, and is thus respected by its competitors will tend to enjoy higher standards of personnel security. The expected standards of corporate conduct will always be perceived by the staff as the minimum. The higher such standards in the first place, the better will be individual honesty and efficiency. At the same tim~, make security rules appliable throughout the organization; it is demoralizing for lower ranks to see different standards, usually less stringent, for the bosses. DO NOT BE FOOLED. Throughout the history of crime and espionage, the most convincing and successful crooks have been the most unlikely. Remain vigilant at all times, and never assume anyone's honesty. ESCAPE ROUTE. Employees must always be able to escape the consequences of their actions in the interests of security; they must not be so afraid of the punishment that they fail to admit to the 'crime' when it highlights some security weakness. There must be some sort of confessor figure, available to all staff and able to listen to, and react to, anonymous reports of security incidents and breaches. At the same time, employees must be able to report their superiors without fear of retribution, if those superiors are putting

security at risk by careless or deliberate breaches of the rules. Anonymous reporting can, however, result in maliciousness, but attributable reporting will cause shyness and reluctance. A balance must be developed for all these elements of the security reporting procedures.

NEVER ASSUME. Never assume, check. This is especially true when dealing with people. An assumption is usually the first step towards a foul-up.

"IF IT LOOKS LIKE A DUCK ...". Trust your judgement and instincts. If a bird looks like a duck, flies like a duck, sounds like a duck and mixes with other ducks, it is almost certainly a duck!

SOME FINAL THOUGHTS. Computer security is not simply a technical matter. Most of those working in this field are fed from a computing background, and they tend understandably to rely on, and in fact may be limited by, their own knowledge and skills. The counter measures do, of course, need to take into account the technical nature of the environment, but the answers lie not with the equipment but as ever with the people who surround it. Computer security, I believe, is not a machine problem, it is a people problem. Personnel security is paramount. Computers are here to stay, and their numbers will continue to escalate at an ever-increasing rate. The trends are towards smaller systems of awe-inspiring power, more distribution of resources to bring computing to the desks of the lowliest workers, networking, and with open systems interconnection to a more open provision of information. The need for computer security will also continue to grow, but I believe the technical solution v~ill become increasingly difficult and cumbersome both to achieve and to enforce. Involving staff at all levels and making them carry out their personal responsibilities towards computer security will, I think, be the area of most importance and reward. I believe that raising awareness and educating a wide audience in the basics of computer will achieve, pound for pound, a far more profound and longer-lasting result than any technical solution could ever hope to achieve. One final word of encouragement: the vast majority of those involved in any way with the computing world, like their colleagues in almost every other walk of life, are honest and conscientious. If they are failing in their duties it is probably due to over-enthusiasm or ignorance rather than from malice aforethought. During the time I have worked within the field of computer security I have encountered a most positive reception from computer security and executive staff alike. They are uneasy in their minds anyway, without really knowing why, but once the dangers have been explained to them there is an almost frantic willingness to learn about and improve computer security standards. It seems the only barrier to a massive step forward is the current lack of awareness. In 1960, following his study of security in government departments, Lord Radcliffe stated that then the biggest single risk to security was probably a general lack of conviction that any substantial threat existed. Nearly 30 years on, this has become similarly true today of computer security, but as noted in the Radcliffe Commission report this attitude of mind can be overcome by a "sustained and skillfully directed educational effort in the right quarters". This, then, must be the way forward. Martin Smith, Editorial Panelist © M.R. Smith 1990 This paper is extracted from "Commonsense Computer Security - Your Practical Guide to Preventing Accidental and Deliberate Electronic Data Loss" by Martin R Smith, published September 1989 by McGraw-Hill. The views expressed are those of the author, and do not necessarily reflect the opinion .of any organization with which he is associated.

26