Cmpe 471: Personnel and Legal Issues

Personnel Crime is a human issue not a technological one Hiring On-going management Unauthorised access Redundancy –having more than one person who can accomplish a given task –it is a requirement for security

Personnel Problems with schedules –required vacation Behavioural changes Separation of duties Employment termination –resignations –firing

Personnel All security arrangements must be changed to exclude the ex-employee from access to the building and from all information systems: –striking the person’s name from all security lists of authorised access –explicitly informing guards that ex-employee is not allowed into the building –changing the combinations, reprogramming access card systems, replacing physical keys

Personnel –Removing or changing all personal access codes known to have been used by the ex- employee on all secured systems –informing all outside agencies –request co-operation from outside agencies in informing if the ex-employee conducts n unauthorised functions on behalf of the former employer

Personnel Training replacements –cross training as a regular procedure Psychological issues –farewell party –firing: embarrassment, shame, anger –remaining staff: rumors, resentment, fear

Personnel To overcome such issues: –publish termination procedures –require all employees to sign a statement confirming that they have read and agred to the termination procedures –consistent application of the termination procedures

Personnel Style –image to the outside world Legal issues –build a solid, documented case –keep a good record: get several opinions of trustworthy people and keep them on record –give employee a clear feedback before firing –offer the delinquent employee all reasonable chances to correct his/ her behaviour

Physical Security A new site –geographical site –access –neighbourhood risks An existing building –layout –walls –doors –windows –ceilings and floors

Physical Security The computer centre electrical power supply air conditioning fire –prevention –detection –suppression

Physical Security Access Control Devices –employee badges –guards –mechanical locks –electronic systems –security cards –biometric devices

Identification, Authentication, and Authorisation Passwords –borrowing –theft –guessing Password hygiene –composition and length

Identification, Authentication, and Authorisation IBM corporate password policy from IBM UK Information Network Newsletter: –a password will be disallowed if its length is not at least 6 characters –the first character must be alphabetic –the following strings cause the new password to be disallowed: the year number of this year, last year, or next year any three-character string from the old password any character repeated more than twice…. …….

Identification, Authentication, and Authorisation Source –how passwords created ownership –passwords should be uniquely assigned to an individual entry –should not appear on the screen when it is entered storage –must be stored encrypted

Software Security Features Switch-on protection –forces the software to be invoked at boot time –some prevent Ctrl-Alt-Del key combination Log-on restrictions –exclusion after repeated errors password management –configurable length, content, pattern exclusions, expiration, one-way encryption

Software Security Features Audit trail –records all log-ons and log-offs Access rights Selective access –by user, function, or file copy protection –prevent files being copied to or from disk

Software Security Features Screen locking OS access controls Number of users Dual passwords for users and system admins file encryption documentation ease of use ease of administration cost and value for money

Backups and Data Integrity Cost/ Benefit Analysis –how often do we take system backups –how much system availability do backups cost –how much do our backups currently cost –if backups are so important, why don’t we back up so often –if backups are so expensive, why don’t we do them less often –how long do we keep backups –where do we keep backups

Backups and Data Integrity Retaining backups –daily full backups are immediately sent off-site –daily backups are kept for one week –end-of-week backups are kept for 2 months –end-of-month backups are kept for one year –end-of-year backups are kept for 5 years