-: Personnel Security, so we look through our policies,
our processes, and our standards,
these are all the foundations of our administrative controls
and they include things like change control,
configuration management, monitoring and response,
business continuity, disaster recovery,
and most importantly, personnel security controls.
And that's what we're gonna focus on in this lecture
is personnel security controls,
there's a lot of 'em and a lot of things
you need to think about, because humans
are the biggest weakness in our networks.
So when we talk about this we need to start thinking first
about separation of duties.
Separation of duties is when I require more than one person
to perform a task by breaking into smaller parts,
and this is gonna provide a system of checks and balances
to prevent fraud and abuse.
For example, in my company not one person can sign a check,
it requires two different people by going through
and one person will authorize the payment,
the other person will sign the check.
That way you have two persons looking at it
and making sure that it's probably being accounted
and no one is stealing the money, right?
Now the next thing we're gonna talk about is dual control.
We'll take this example just a step further
on our checkbook, instead of somebody authorizing it
and the other person signing for it
you've seen some checks that require two signatures, right?
Some large corporations with anything over
maybe a 5,000 dollar check would require two signatures
and that's to make sure that two people have looked at it
and approved it and that there is dual control
and two people to blame.
This helps prevent fraud big time.
So this is the process when two individuals
perform the same action, in this case both of them
are signing the check, to make it happen.
Another good example of this is you may have seen
in all these war movies, right, you look at
Hunt For Red October or Crimson Tide
and they go to launch the nuclear missile from the submarine
they take two keys, both people put it in,
and they both have to turn the key at the same time.
That's an example of doing this.
Unlocking a safe at the same time
or unlocking a server room at the same time
that requires two different combinations
and two different keys, that ensures that two people
are always there doing that action.
Now when we start talking about succession planning,
this is another big concept that you need to think about
in your organization.
This focuses on ensuring that important duties
will always have someone who can perform them.
If you have an organization that has very high turnover
this is critical for you because you need to make sure
that there's no issues of a task not being completed
because of personnel people, personnel turnover
and somebody quitting and leaving
and now you have nobody who can do that job.
An example of this would be having a primary
and a backup administrator on a server,
or other such functions that are critical.
You wanna make sure there's always at least two people
who know how to do that job.
For example, if I'm in a company and I'm the CIO
and I'm gonna be leaving, they probably should have
my replacement there onboard and we can do a turnover
of hey, here's the information I did,
here's how I did things, so that they understand
what's going on, that's succession planning.
The company may even know that hey, if the CIO gets fired
or whether he quits we're gonna promote
the Director of Information Technology up to his position,
and you have this succession, this line of succession.
Just like in the United States, if the President quits,
gets fired, or dies, the Vice President takes over,
that's good succession planning.
Now the next one we wanna talk about
is cross training your employees,
and this helps in succession planning, right?
Because it focuses on teaching employees skills
to cover other tasks that other coworkers can perform.
So this can be done through on the job training
or other skillsets and it's used to ensure
that you have additional resources in a big project
for the future or if someone walks out the door and quits.
For example, if you only have one System Administrator
and he quits, how are you gonna revoke his access?
Nobody else knows how to be a System Administrator, right?
That would be a problem, so you wanna make sure
you're cross training your employees
and they understand different facets of the job.
The next one you wanna talk about is background checks
and background checks are conducted before somebody
is hired into your organization hopefully,
you may be looking at their criminal past
or you may be looking at their financial past.
And which kind of background checks you do
is gonna be dependent on your organization.
For example, if I'm running a bank we have access
to large sums of money, right?
And in that case we wanna run credit checks on our people
to make sure that they're not highly in debt
and more likely to steal money from us, right?
That would be a good idea.
If I'm gonna be operating any kind of business
I probably wanna know if the person I'm hiring
was a felon or a convict before,
and it doesn't mean I'm not gonna hire them,
but I need to know that information.
And so conducting background checks
is gonna help me do that.
The next one we wanna talk about is mandatory vacation time.
Now this sounds kind of silly, but you actually
want to force your employees to take vacation,
and it's not just because it's good for their mental health,
but by making people take vacation it allows us
to identify any issues that could be hidden
by them being there continuously.
So let's go back to our System Administrator,
let's say that he is really doing bad things,
he's letting bad guys in the network all the time,
and he's stealing information and he's forging
the accounting records where he can steal money
and siphon off to his account, if you make him go
on vacation for two weeks the next person who comes
to take his place to cover his duties for that two weeks
will probably see that and detect it.
And so by doing mandatory vacation time
it forces other people into other job roles,
going back to cross training, right,
and they may come across something
and that will be brought to the front.
This is an idea that a lot of security experts recommend
and most companies will do it anyway
because it's just good for your employees' mental health.
Now the next thing is what do you do
when you find that bad System Administrator?
Well you fire 'em, right, you terminate 'em.
These are the policies and procedures that focus on
what to do when you fire or terminate an employee.
Now there's a lot of things you probably wanna do,
you wanna get laptops back from them,
you wanna get data back from them,
you wanna get cellphones that you've issues to them back,
you wanna disable their accounts and change security codes
and lock them out of the building,
and make sure that if there's any shared codes
like a safe that that gets changed too.
All of these things should be in writing and in a checklist
so you don't forget it when you go and fire an employee
and you can make sure you follow them correctly
because that's key to having good security,
otherwise, you may have a disgruntled employee
who comes back to cause harm for you.