1. Personal Security Chapter :7
Muhammad Rafiq

2. Predictability Predictability is the key
Information assurance process involves technology, processes, and people
Any of these can cause a breakdown in the security, however:
Technology is predictable - well-designed processes are, at least, consistent
Human behavior is hard to predict and control
Disastrous effects of employee-based actions:
Organizations should have mechanisms in place to ensure the secure behavior of the employees

3. Origin of Threats Threats that center on people:
Outsiders – these threats are commonly recognized
Insiders – fraud, misuse, theft, and human error
More serious threat to information assets than outsiders

4. Personnel Customers Visitors Employees Executives
Contractors & Consultants
Unauthorized persons

5. First Step, First
Involves those measures taken to safeguard a company’s employees and those coming to a place of business either for business reasons or as a guests.
Can further include access control systems that control access in and out of specific premises.
Various identification card systems, passes, and permits used by companies are considered personnel control.

6. Ensuring Personnel Security Behavior
Personnel security behavior falls into three categories:
Routine activities – individual actions to secure the space that they control from any threats
Operational functions – activities that are performed to ensure the security of the entire system during day-to-day operation
Management responsibilities – actions which guarantee that the information assurance and security strategy is implemented properly

7. Hiring Practices (Cont.)
At a minimum, the screening process should include a series of comprehensive interviews that emphasize integrity as well as technical qualifications.
References from former employers should be examined and verified.
This includes former teachers, friends, co-workers, & supervisors.

8. Hiring Practices (Cont.)
Former employers are usually in the best position to rate the applicant accurately, providing an assessment of strengths and weaknesses, personal ethics, past earnings, etc.
Use of a reference authorization and hold-harmless agreement oftentimes provides the necessary information.
Be sure reference authorizations have: signature of applicant, releases former & prospective employers

9. Hiring Practices (Cont.)
What to Look For? A Straw person Perhaps?
Education
Training
Experience
Stable Work History
Professional Certifications
Clear Criminal Record
Fiscal Responsibility
Background Continuity
Physical Fitness