Written security policies are administrative controls that identify a security plan. If you’re planning to take the Security+ SY0-501 exam, you should have good understanding of the importance of policies, plans and procedures related to organizational security. Personnel create plans and procedures to implement security controls and enforce the security policies.
For example, can you answer this practice test question?
Q. Dan has been working at your company as an accountant. However, after a disagreement with an executive, he decides to leave the company and work at the local mall. He has a user account allowing him to access network resources. Which of the following is the MOST appropriate step to take?
A. Ensure his account is disabled when he announces that he will be leaving the company.
B. Immediately terminate his employment.
C. Force him to take a mandatory vacation.
D. Ensure his account is disabled during his exit interview.
More, do you know why the correct answer is correct and the incorrect answers are incorrect? The answer and explanation are available at the end of this post.
NDA
A non-disclosure agreement (NDA) is used between two entities to ensure that proprietary data is not disclosed to unauthorized entities. For example, imagine BizzFad wants to collaborate with Costington’s on a project. BizzFad management realizes they need to share proprietary data with Costington’s personnel, but they want to ensure that distribution of the data is limited. The NDA is a legal document that BizzFad can use to hold Costington’s legally responsible if the proprietary data is shared.
Similarly, many organizations use an NDA to prohibit employees from sharing proprietary data either while they are employed, or after they leave the organization. It’s common to remind employees of an existing NDA during an exit interview.
Exit Interview
An exit interview is conducted with departing employees just before they leave an organization. Note that an exit interview isn’t only conducted when employees are fired from their job. They are also done when employees leave voluntarily. The overall purpose is for the employer to gain information from the departing employee. Some common questions asked during an exit interview are:
- What did you like most (and/or least) about your job here?
- Do you think you had adequate training to do your job here?
- Can you tell me what prompted you to leave your current position?
- Can you describe the working relationship you had with your supervisor(s)?
- What skills and qualification does your replacement need to excel in this position?
Exit interviews are commonly conducted by an employee in the Human Resources (HR) department. In addition to seeking feedback from the employee, departing employees are sometimes required to sign paperwork, such as a reminder about a previously signed NDA. The NDA prevents the employee from sharing proprietary information with personnel outside the organization.
From a security perspective, it’s also important to ensure other things occur during or before the exit interview. For example, the user’s account should be disabled (or deleted depending on company policy). Ideally, this should occur during the interview. One way organizations do this is by informing the IT department of the time of the scheduled interview a day before. An administrator then disables the account after the interview starts. The key is that a departing employee should not have access to computing and network resources after the interview.
It’s also important to collect any equipment (such as smartphones, tablets, or laptops), security badges, or proximity cards the organization issued to the employee. This is more than just a cost issue. Equipment very likely has proprietary data on it and the company needs to take steps to protect the data. Additionally, smart cards and proximity cards can allow individuals access to protected areas.
Onboarding
Onboarding is the process of granting individuals access to an organization’s computing resources after being hired. This includes providing the employee with a user account and granting access to appropriate resources. One of the key considerations during the onboarding process is to follow the principle of least privilege. Grant the new employees access to what they need for their job, but no more.
Offboarding is the process of removing their access. When employees leave the company, it’s important to revoke their access. This is often done during the exit interview.
Policy Violations and Adverse Actions
What do you do if an employee doesn’t follow the security policy? What adverse actions should a supervisor take? Obviously, that depends on the severity of the policy violation.
Imagine that an employee sends out an email to everyone in the organization inviting them to his church. The supervisor might decide to verbally counsel the employee and make it clear that sending out personal emails like this is unacceptable. Based on how well the conversation goes, the supervisor might choose to document this as written counseling and place the warning in the employee’s HR folder.
Some incidents require more severe responses. Imagine that an employee begins a cyberbullying campaign against another employee. He has been sending her hateful emails and posting hateful messages on social media pages. In most organizations, this bully will be looking for employment elsewhere once his activity is discovered.
Although it’s possible to document specific adverse actions within a security policy, this is rarely recommended. Actual policy violations aren’t always the same and if the policy requires a specific action in response to a policy violation, it doesn’t always allow supervisors or managers to respond appropriately to a violation.
Q. Dan has been working at your company as an accountant. However, after a disagreement with an executive, he decides to leave the company and work at the local mall. He has a user account allowing him to access network resources. Which of the following is the MOST appropriate step to take?
A. Ensure his account is disabled when he announces that he will be leaving the company.
B. Immediately terminate his employment.
C. Force him to take a mandatory vacation.
D. Ensure his account is disabled during his exit interview.
Answer is D. His account should be disabled (or deleted if that is the company policy) during the exit interview. It’s appropriate to conduct an exit interview immediately before an employee departs.
Employees often give a two-week or longer notice. If their access is revoked immediately, they won’t be able to do any more work.
While some companies do terminate employment when someone gives notice, from a security perspective, it’s best to take action related to the user account.
The purpose of a mandatory vacation is to detect fraud, but if the employee is leaving, any potential fraud will be detected when that employee leaves.
See Chapter 11 of the CompTIA Security+: Get Certified Get Ahead: SY0-501 Study Guide for more information on security policies.