Security Policy: Five Keys to User Compliance

White Pa Per Security Policy: Five Keys to User Compliance ExEcuTIvE SummAry Human factors play a central role in security. Recent research confirms what it managers have long suspected: users, as they naturally go about trying Business users are a key part of a company’s to do their work, present grave security risks. One study, for example, security, and even the most conscientious found users do everything from downloading data onto unsecured mobile employees can introduce serious breaches devices (61%) to using web-based personal email for business documents (52%)1. Such activities present security risks and probably violate company of security policy. IT can do everything security policy. in its power to secure the company’s confidential documents — provide first-class it too often is portrayed as the security heavy, forced to try to halt such security infrastructure, develop reasonable activities by imposing what users view as onerous steps in the name of security policies and engage in extensive security. Feeling these steps hinder their productivity, users go to great communication and training — yet still lengths to avoid or circumvent even the most reasonable security measures, people fail to comply. The solution is to creating significant vulnerabilities in the process. provide security that helps people do their jobs more efficiently, thereby inducing users it is hard to blame the users; they are just trying to get their jobs done as to follow best security practices without quickly and effectively as possible — something both IT and the business want. even knowing it. Still, that leaves IT having to force security compliance on people, which is the most difficult and thankless security task of all. IT can do everything right: provide first-class security infrastructure, develop reasonable security policies and engage in extensive communication and training, yet still people fail to comply. What more can it do? The solution is to provide security without making it difficult for users to do their jobs. For example, if IT can offer easy group collaboration within a transparently secure setting, or eliminate the need for users to send sensitive documents by email, users can be as productive as ever, or even more so. And since the environment is inherently secure, users are following best security practices without even knowing it. In the paper that follows, you will find five ways IT can facilitate user productivity while automatically ensuring safe security practices. In each case, users are unhindered by security procedures, yet their work is conducted in a transparently secure environment. Even better, the environment actually streamlines processes and improves efficiency, leading users to make it their preferred work environment. 1 Trends in Insider Compliance with Data Security Policies: Employees evade and ignore Security, Ponemon institute, June 10, 2009 White Paper – Security Policy In some cases, such as those involving negotiations [see #3 below], the secure environment actually gives workers a distinct advantage. And as people experience the advantages of working within such an environment, advantages like increased efficiency or negotiation leverage, they readily return to make use of these advantages. Suddenly, IT no longer needs to force compliance with document security procedures. users willingly comply, often without even realizing it. The following table illustrates unsafe behaviors resulting from human factors that can be reduced or eliminated through a transparently secure environment, which also makes work easier or more efficient for the users. in all the cases above, security is built into the online environment where it is centrally managed and transparently enforced. Users experience the security as a by-product of the efficient and effective technology. The security, if they are aware of it at all, is viewed not as a hindrance, but as a convenience that simplifies their work. Human factors become far less of a security issue.