PERSONNEL SECURITY PRACTICAL ADVICE FOR HR AND SECURITY MANAGERS
|
|
|
- Lynette Sullivan
- 10 years ago
- Views:
Transcription
1 PERSONNEL SECURITY PRACTICAL ADVICE FOR HR AND SECURITY MANAGERS
2 A DELICATE BALANCE Every year brings stories of organisations falling victim to the embarrassing, costly or disruptive consequences of staff misusing their access and privileges. But with the appropriate personnel security measures in place organisations can significantly reduce their exposure to intentional and unintentional insider acts. The Human Resource team has a pivotal role to play, balancing security risks against the need to ensure employees remain able to perform their duties and buy in to any new measures. It is essential that HR executives recognise the vulnerabilities and are in a position to offer advice and best practice to colleagues, amidst potentially difficult and sensitive circumstances. CPNI s range of advice and guidance can help HR and security teams to: About CPNI The Centre for the Protection of National Infrastructure (CPNI) is the government authority that provides advice on protecting the country s essential services, facilities and networks from terrorism and other threats. Though its focus is on securing the national infrastructure energy, transport, health, telecommunications etc. many businesses and organisations can benefit from its general advice for protecting staff, property and IT systems, much of which is available from Identify security measures in proportion to the risk. Reduce the risk of employing personnel likely to present a security concern. Establish that applicants and contractors are who they claim to be. Close down opportunities for abuse of the organisation s assets.
3 Practical security advice for personnel managers Staff who may look to exploit their legitimate access for unauthorised purposes can take a variety of forms: disaffected individuals, activist groups, journalists, competitors, those with links to organised crime or even those involved in terrorism. In many organisations, personnel security is still regarded as a recruitment issue rather than something to address throughout a staff member s time in employment. But ongoing personnel security measures can not only reduce vulnerabilities, they can also encourage a hugely beneficial securityconscious culture amongst staff at every level of the organisation. Identifying the right measures can be a significant challenge involving complex strategic decisions. There are legal and resource implications to consider, whilst implementing the wrong measures can prove costly and disruptive. And then there is the need to ensure changes are transparent and understood at stake is the relationship and level of trust between an organisation and its staff. CPNI advice can help personnel and security teams understand and prepare for the challenges involved. Building on the experiences of the organisations who contribute to our research, our products offer practical tips, checklists and advice to help managers adopt the right personnel measures for their own circumstances.
4 Personnel security: threats, challenges and measures Introductory guidance for those with new security, recruitment or line management responsibilities: What is personnel security Why it is important What is involved Ongoing personnel security Advice and best practice to reduce the risk of insider activity: Engaging with staff Managing contractors and short-term staff Conducting investigations
5 Document verification guidance How to distinguish genuine employee verification documents (passport, qualifications) from forgeries. Pre-employment screening guidance A one-stop guide to best practice for screening applications, including: Authenticating identity Verifying the right to work in the UK Confirming employment history and qualifications Checking criminal records These documents are available to download at Risk assessment for personnel security Using a fictional case study, this guidance document helps security and human resource managers to: Conduct personnel security risk assessments Identify insider threats Prioritise the risks Choose the appropriate counter-measures
CEOP Relationship Management Strategy
Making every child child matter matter... everywhere... everywhere CEOP Relationship Management Strategy Breaking down the barriers to understanding child sexual exploitation Child Exploitation and Online
Compliance Toolkit. Protecting Charities from Harm. Chapter 2: Due Diligence, Monitoring and Verification of End Use of Charitable Funds SUMMARY
Compliance Compliance Toolkit Protecting Charities from Harm Chapter 2: Due Diligence, Monitoring and Verification of End Use of Charitable Funds SUMMARY The Charity Commission The Charity Commission is
CYBER SECURITY AND RISK MANAGEMENT. An Executive level responsibility
CYBER SECURITY AND RISK MANAGEMENT An Executive level responsibility Cyberspace poses risks as well as opportunities Cyber security risks are a constantly evolving threat to an organisation s ability to
TELEFÓNICA UK LTD. Introduction to Security Policy
TELEFÓNICA UK LTD Introduction to Security Policy Page 1 of 7 CHANGE HISTORY Version No Date Details Authors/Editor 7.0 1/11/14 Annual review including change control added. Julian Jeffery 8.0 1/11/15
ATINER's Conference Paper Series COM2013-0428. The Use of Honeytokens in Database Security
Athens Institute for Education and Research ATINER ATINER's Conference Paper Series COM2013-0428 The Use of Honeytokens in Database Security Penny Ross Senior Lecturer University of Portsmouth UK Amanda
Report to the Council of Australian Governments. A Review of the National Identity Security Strategy
Report to the Council of Australian Governments A Review of the National Identity Security Strategy 2012 Report to COAG - Review of the National Identity Security Strategy 2012 P a g e i Table of contents
The purpose of this Unit is to develop an awareness of the knowledge and skills used by ethical and malicious hackers.
National Unit specification General information Unit code: H9HY 45 Superclass: CC Publication date: September 2015 Source: Scottish Qualifications Authority Version: 02 Unit purpose The purpose of this
The Cambridge Executive MBA - Seeking Employer Support
- Seeking Employer Support An Executive MBA is a programme designed for people who have excelled in their career to date and have proved their ambition and drive to succeed and wish to invest in their
St. Peter s C.E. Primary School Farnworth Email, Internet Security and Facsimile Policy
Learn, sparkle & shine St. Peter s C.E. Primary School Farnworth Email, Internet Security and Facsimile Policy Adopted from the LA Policy April 2015 CONTENTS Page No 1. Introduction 1 2. Guiding Principles
Business Case. for an. Information Security Awareness Program
Business Case (BS.ISAP.01) 1 (9) Business Case for an Information Security Business Case (BS.ISAP.01) 2 Contents 1. Background 3 2. Purpose of This Paper 3 3. Business Impact 3 4. The Importance of Security
Regulation of Investigatory Powers Act 2000
Regulation of Investigatory Powers Act 2000 Consultation: Equipment Interference and Interception of Communications Codes of Practice 6 February 2015 Ministerial Foreword The abilities to read or listen
Helping you to protect yourself against fraud and financial crime
Helping you to protect yourself against fraud and financial crime first direct takes fraud & other financial crimes very seriously. Even though we have market-leading fraud detection systems, we want you
HMG Security Policy Framework
HMG Security Policy Framework Security Policy Framework 3 Foreword Sir Jeremy Heywood, Cabinet Secretary Chair of the Official Committee on Security (SO) As Cabinet Secretary, I have a good overview of
Corporate Security in 2016.
Corporate Security in 2016. A QA Report Study Highlights According to ThreatMetrix, businesses in the UK are at greater risk of cybercrime than any other country in the world. In a recent survey carried
Managing risk, insurance and terrorism
COUNTING THE COST Managing risk, insurance and terrorism produced by NaCTSO wishes to acknowledge the contributions made by many individuals associated with the following organisations: Home Office: The
How To Design A Project
Introduction to Procurement Why is procurement important? Client needs are unique and consequently each project meeting those needs has unique characteristics. This means that achieving the right project
Small businesses: What you need to know about cyber security
Small businesses: What you need to know about cyber security March 2015 Contents page What you need to know about cyber security... 3 Why you need to know about cyber security... 4 Getting the basics right...
SPEAR PHISHING UNDERSTANDING THE THREAT
SPEAR PHISHING UNDERSTANDING THE THREAT SEPTEMBER 2013 Due to an organisation s reliance on email and internet connectivity, there is no guaranteed way to stop a determined intruder from accessing a business
WHAT YOU NEED TO KNOW ABOUT CYBER SECURITY
SMALL BUSINESSES WHAT YOU NEED TO KNOW ABOUT CYBER SECURITY ONE CLICK CAN CHANGE EVERYTHING SMALL BUSINESSES My reputation was ruined by malicious emails ONE CLICK CAN CHANGE EVERYTHING Cybercrime comes
HUMAN RESOURCES POLICIES & PROCEDURES
HUMAN RESOURCES POLICIES & PROCEDURES Policy title Application IT systems and social networking policy All employees and students CONTENTS PAGE Introduction and scope 2 General points 2 Authorisation to
ESKISP6054.01 Conduct security testing, under supervision
Overview This standard covers the competencies required to conduct security testing under supervision. In order to contribute to the determination of the level of resilience of an information system to
SCOTTISH CHILDREN S REPORTER ADMINISTRATION
Part 1 - Policy for Fraud Prevention, Detection and Investigation 1. Introduction 1.1 SCRA like other public bodies, has a duty to conduct its affairs in a responsible and transparent way and to take into
ISO27001 Controls and Objectives
Introduction This reference document for the University of Birmingham lists the control objectives, specific controls and background information, as given in Annex A to ISO/IEC 27001:2005. As such, the
Head of Information & Communications Technology Responsible work team: ICT Security. Key point summary... 2
Policy Procedure Information security policy Policy number: 442 Old instruction number: MAN:F005:a1 Issue date: 24 August 2006 Reviewed as current: 11 July 2014 Owner: Head of Information & Communications
Business Plan 2012/13
Business Plan 2012/13 Contents Introduction 3 About the NFA..4 Priorities for 2012/13 4 Resources.6 Reporting Arrangements.6 Objective 1 7 To raise the profile and awareness of fraud among individuals,
CLOUD-BASED BIM AND SMART ASSET MANAGEMENT: ADOPTING A SECURITY-MINDED APPROACH
CLOUD-BASED BIM AND SMART ASSET MANAGEMENT: ADOPTING A SECURITY-MINDED APPROACH March 2016 Disclaimer Reference to any specific commercial product, process or service by trade name, trademark, manufacturer,
The rise of new e commerce channels: Shoppers Delight or Gangsters Paradise?
The rise of new e commerce channels: Shoppers Delight or Gangsters Paradise? 2011 Introduction from Michael Norton Managing Director, PayPoint.net As evidenced by the IMRG in May 2011, the online retail
Professional issues. Una Benlic [email protected]
Professional issues Una Benlic [email protected] Aims Give a precise meaning of the terms profession and professional Discuss the obligations and privileges which membership of a profession carries Consider
Driving License. National Insurance Number
STAR has teamed up with Prevention of Fraud in Travel (PROFiT) and the Fraud Intelligence Network (FIN) to offer our members the best advice about fraud prevention. We recognise the increasing threat of
ISO 27001 Controls and Objectives
ISO 27001 s and Objectives A.5 Security policy A.5.1 Information security policy Objective: To provide management direction and support for information security in accordance with business requirements
Use and Change of Names
Use and Change of Names 16 August 2016 Issued by International and Immigration Policy Group Home Office Contents Introduction... 3 Policy Rationale... 3 What is the requirement of the policy?... 3 What
28400 POLICY IT SECURITY MANAGEMENT
Version: 2.2 Last Updated: 30/01/14 Review Date: 27/01/17 ECHR Potential Equality Impact Assessment: Low 1. About This Policy 1.1. The objective of this policy is to provide direction and support for IT
Introduction. Clarification of terminology
Initiating a dialogue about the security of digital built assets: a guide for managers (with regard to PAS 1192-5, A Specification for security-minded building information modelling, digital built environments
ADVANCED ANTI-MONEY LAUNDERING COURSE. Course Notes
ADVANCED ANTI-MONEY LAUNDERING COURSE Course Notes Course Provider: Course: Riliance Training Limited Advanced Continuing Professional Development (CPD) The person undertaking this course has been awarded
low levels of compliance with the regulations and POCA by negligent HVD operators are enabling criminals to launder the proceeds of crime
6.185 Under the regulations HMRC must maintain a registry of HVDs. However the regulations do not enable HMRC to conduct a fit and proper person test on those who seek to register as an HVD. From 2004
For Discussion Paper No. 9/2011 on 3 November 2011 DIGITAL 21 STRATEGY ADVISORY COMMITTEE. Cyber Security
For Discussion Paper No. 9/2011 on 3 November 2011 DIGITAL 21 STRATEGY ADVISORY COMMITTEE Cyber Security Purpose This paper briefs Members on the global cyber security outlook facing governments of some
MANAGE THIRD PARTY RISKS
SECURITY FOR INDUSTRIAL CONTROL SYSTEMS MANAGE THIRD PARTY RISKS A GOOD PRACTICE GUIDE Disclaimer Reference to any specific commercial product, process or service by trade name, trademark, manufacturer,
How To Behave At The Britain Council
Our Code of Conduct Trust is not given. It s earned www.britishcouncil.org Contents Foreword from Chief Executive...01 Our values...02 Introduction...03 Our code of conduct...04 1. Legal compliance...
How To Pass Cambriac English: First For Schools
First Certificate in English (FCE) for Schools CEFR Level B2 Ready for success in the real world Cambridge English: First for Schools Cambridge English: First, commonly known as First Certificate in English
Department for Business, Innovation and Skills 1 Victoria Street London SW1H 0ET. 7 th May 2014. Dear Sir or Madam,
Department for Business, Innovation and Skills 1 Victoria Street London SW1H 0ET 7 th May 2014 Dear Sir or Madam, The Federation of Small Businesses (FSB) welcomes the opportunity to respond to this consultation
COMPUTER USAGE - EMAIL
BASIC BELIEF This policy relates to the use of staff email at Mater Dei and is designed to provide guidelines for individual staff regarding their use. It encourages users to make responsible choices when
Keynote. Professor Russ Davis Chairperson IC4MF & Work Shop Coordinator for Coordinator for Technology, Innovation and Exploitation.
Keynote Professor Russ Davis Chairperson IC4MF & Work Shop Coordinator for Coordinator for Technology, Innovation and Exploitation 6 & 7 Nov 2013 So many of us now don t just work online but live part
DISCIPLINARY PROCEDURE
DISCIPLINARY PROCEDURE INTRODUCTION These procedures are compliant with the ACAS code of practice and are designed to help and encourage staff at Pilgrims Hospice to achieve and maintain required standards
Specification for Learning and Qualifications for Common Security Industry Knowledge
Specification for Learning and Qualifications for Common Security Industry Knowledge December 2014 Security Industry Authority PO Box 49768 London WC1V 6WY E-mail [email protected] www.the-sia.org.uk
Monitoring and Logging Policy. Document Status. Security Classification. Level 1 - PUBLIC. Version 1.0. Approval. Review By June 2012
Monitoring and Logging Policy Document Status Security Classification Version 1.0 Level 1 - PUBLIC Status DRAFT Approval Life 3 Years Review By June 2012 Owner Secure Research Database Analyst Change History
Incident reporting procedure
Incident reporting procedure Responsible Officer Author Date effective from Aug 2009 Date last amended Aug 2009 Review date July 2012 Ben Bennett, Business Planning & Resources Director Julian Lewis, Governance
University of Sunderland Business Assurance Information Security Policy
University of Sunderland Business Assurance Information Security Policy Document Classification: Public Policy Reference Central Register Policy Reference Faculty / Service IG 003 Policy Owner Assistant
2015 Information Security Awareness Catalogue
Contents 2015 Catalogue Wolfpack Engagement Model 4 Campaign Drivers 6 Offerings 8 Approach 9 Engaging Content 10 Stakeholder Change Management 12 Bundles 13 Content 14 Grey Wolf -Track compliance with
INSIDER THREAT DETECTION RECOMMENDATIONS. www.alienvault.com
INSIDER THREAT DETECTION RECOMMENDATIONS www.alienvault.com Insiders, Moles & Compromises According to the second annual SANS survey on the security of the financial services sector, the number one threat
Overview TECHIS60441. Carry out security testing activities
Overview Information, services and systems can be attacked in various ways. Understanding the technical and social perspectives, how attacks work, the technologies and approaches used are key to being
The UK cyber security strategy: Landscape review. Cross-government
REPORT BY THE COMPTROLLER AND AUDITOR GENERAL HC 890 SESSION 2012-13 12 FEBRUARY 2013 Cross-government The UK cyber security strategy: Landscape review 4 Key facts The UK cyber security strategy: Landscape
IT Professional Standards. Information Security Discipline. Sub-discipline 605 Information Security Testing and Information Assurance Methodologies
IT Professional Standards Information Security Discipline Sub-discipline 605 Information Security Testing and Information Assurance Methodologies December 2012 Draft Version 0.6 DOCUMENT REVIEW Document
DVLA ELISE GSi Closed User Group Code of Connection
DVLA ELISE GSi Closed User Group Code of Connection Security Warning Notice The following handling instructions apply to this document: - Handle, use and transmit with care - Take basic precautions against
INSTANT MESSAGING SECURITY
INSTANT MESSAGING SECURITY February 2008 The Government of the Hong Kong Special Administrative Region The contents of this document remain the property of, and may not be reproduced in whole or in part
Module 4. Risk assessment for your AML/CTF program
Module 4 Risk assessment for your AML/CTF program AML/CTF Programs Risk assessment for your AML/CTF program Page 1 of 27 Module 4 Risk assessment for your AML/CTF program Risk assessment for your AML/CTF
RISK ASSESSMENT FOR PERSONNEL SECURITY A GUIDE 3 RD EDITION
RISK ASSESSMENT FOR PERSONNEL SECURITY A GUIDE 3 RD EDITION Contents Introduction 2 Overview 3 The organisation level risk assessment 8 Organisation level risk assessment case study 17 The group level
HIPAA Compliance Evaluation Report
Jun29,2016 HIPAA Compliance Evaluation Report Custom HIPAA Risk Evaluation provided for: OF Date of Report 10/13/2014 Findings Each section of the pie chart represents the HIPAA compliance risk determinations
Catalyst Consulting & Events (CCE) takes seriously its commitment to preserve the privacy of the personal information that we collect.
PRIVACY POLICY 1. Introduction Catalyst Consulting & Events (CCE) takes seriously its commitment to preserve the privacy of the personal information that we collect. We will only collect information that
Newcastle University Information Security Procedures Version 3
Newcastle University Information Security Procedures Version 3 A Information Security Procedures 2 B Business Continuity 3 C Compliance 4 D Outsourcing and Third Party Access 5 E Personnel 6 F Operations
Cyber Security Strategy
NEW ZEALAND S Cyber Security Strategy 2015 A secure, resilient and prosperous online New Zealand Ministerial Foreword The internet and technology have become a fundamental element in our lives. We use
ID3 Applications. 800 million people One solution. Forward thinking solutions for a global industry. because identity matters
ID3 Applications Forward thinking solutions for a global industry because identity matters 800 million people One solution ID3 Applications Forward thinking solutions for a global industry Background As
INFORMATION SECURITY PROCEDURES
INFORMATION AN INFORMATION SECURITY PROCEURES Parent Policy Title Information Security Policy Associated ocuments Use of Computer Facilities Statute 2009 Risk Management Policy Risk Management Procedures
Information Security Team
Title Document number Add document Document status number Draft Owner Approver(s) CISO Information Security Team Version Version history Version date 0.01-0.05 Initial drafts of handbook 26 Oct 2015 Preface
Report on Pre-Appointment Screening Procedures employed by the National Recruitment Service for the Health Service Executive (HSE)
Report on Pre-Appointment Screening Procedures employed by the National Recruitment Service for the Health Service Executive (HSE) February 2013 September 2007 Contents Introduction... 3 Commission s Code
Human Resources Trainee
Human Resources Trainee SUMMARY INFORMATION HR TRAINEE (Vacancy Number 351) Duration 3 years Salary 16,131 to 18,588 per annum Entry qualifications English and Maths Highers What is HR? Human Resources
UoB Risk Assessment Methodology
[Type here] UoB Risk Assessment Methodology The Risk Assessment Methodology describes how information security risk will be managed, including guidance for assessing, scoring, choosing acceptance or treatment
Use of Social Networking Websites Policy. Joint Management Trade Union Committee. ENDORSED BY: Consultative Committee DATE: 14 February 2013
Use of Social Networking Websites Policy START DATE: March, 2013 NEXT REVIEW: March 2015 COMMITTEE APPROVAL: Joint Management Trade Union Committee CHAIR S SIGNATURE: STAFF SIDE CHAIR S SIGNATURE: DATE:
Risk Management Policy
Risk Management Policy Responsible Officer Author Ben Bennett, Business Planning & Resources Director Julian Lewis, Governance Manager Date effective from December 2008 Date last amended December 2012
Intellectual Property
Intellectual Property Protection Helpsheet When running a business you need to consider protecting your intellectual property which could be anything from your logo to inventions, products and designs.
Information Security: Business Assurance Guidelines
Information Security: Business Assurance Guidelines The DTI drives our ambition of prosperity for all by working to create the best environment for business success in the UK. We help people and companies
How To Deal With Social Media At Larks Hill J & I School
LARKS HILL JUNIOR & INFANT SCHOOL Social Media Policy Written: Reviewed Autumn Term 2015 Larks Hill J & I School Social Media Policy 1. Introduction For the purposes of this policy, social media refers
INFORMATION TECHNOLOGY SECURITY STANDARDS
INFORMATION TECHNOLOGY SECURITY STANDARDS Version 2.0 December 2013 Table of Contents 1 OVERVIEW 3 2 SCOPE 4 3 STRUCTURE 5 4 ASSET MANAGEMENT 6 5 HUMAN RESOURCES SECURITY 7 6 PHYSICAL AND ENVIRONMENTAL
Mobile Devices: Know the RISKS. Take the STEPS. PROTECT AND SECURE Health Information.
Mobile Devices: Know the RISKS. Take the STEPS. PROTECT AND SECURE Health Information. Mobile Devices: Risks to Health Information Risks vary based on the mobile device and its use. Some risks include:
Information sharing. Advice for practitioners providing safeguarding services to children, young people, parents and carers
Information sharing Advice for practitioners providing safeguarding services to children, young people, parents and carers March 2015 Contents Summary 3 About this government advice 3 Who is this advice
Officers Code of Conduct
Officers Code of Conduct Effective from: 17 th September 2014 Approved by Council on 17 th September 2014 1. INTRODUCTION 1.1 The Council believes that its activities demand the highest standards of confidence
GUIDANCE NOTE FOR DEPOSIT-TAKERS. Operational Risk Management. March 2012
GUIDANCE NOTE FOR DEPOSIT-TAKERS Operational Risk Management March 2012 Version 1.0 Contents Page No 1 Introduction 2 2 Overview 3 Operational risk - fundamental principles and governance 3 Fundamental
Introductory Level Management Training Programme
Introductory Level Management Training 2016 Foreword January 2016 Managers and supervisors across the career development sector, be this in the context of career education, career guidance/development,
Template for Automatic Number Plate Recognition (ANPR) Infrastructure Development Privacy Impact Assessment
Template for Automatic Number Plate Recognition (ANPR) Infrastructure Development Privacy Impact Assessment This template is provided to support the police service and other law enforcement agencies (LEA)