Teaching Computer Security Policy

by Marc

Years ago I was teaching a computer security class to a room full of new employees for a sub-prime mortgage company. The point of it was to let them know what resources they would have available to them in the I.T. group, as well as what the company policies for email and Internet use were, proper etiquette for email, guidelines for password creation, and how to protect the information that they had available. They were, after all, going to have access to some pretty sensitive information from the customers.

At that time (late 1990's) there were not a lot of options on the market for isolating what web sites a person on your network could or could not access. At least not cheaply. I'm not now, nor have I ever been a big advocate of that kind of control anyway. A person who is not being productive, whether it's because they are surfing the web too much or because they are just lazy or incompetent, usually manifests these traits regardless of what kind of lock down you put on them. I know the other arguments, but that's not the road I'm going down at this moment.

So while I'm discussing the guidelines, I had a question about pornography access. The company was young enough that we had only discussed such a thing at the rudimentary level so far, but it seemed like common sense to me: You're not paid to look at porn, so just don't do it. But my opening statement was "Don't. You're not here for that. There's no moral judgment here, and as far as I'm concerned, most people who look at porn are just…" But before I could finish that statement, one of my trainers who was assisting with this class blurted out "SICK!"

I couldn't help it, I laughed. I finished my original thought with, "Well, I was going to say 'curious, and will get bored with it pretty quick', but at least we now have a couple of opinions on the subject. Either way, don't."

The class in general laughed. The company was in a southern, bible belt town, not big, but not a small town. Policies being what they are, most people know what they should and shouldn't be doing on company time, and the question was bold to ask in a corporate setting to start with, even for that early in the game of company Internet access.

In this one meeting I got to witness curiosity, naivete, boldness, and to some extent wrath. Over the course of the years, my opinions have evolved, but my love of getting a group encouraged and fired up to do a job hasn't. I don't ever like to beat folks over the head or use a threat to keep actions in line with a corporation or organizations guidelines. Guide and amuse, inform and engage, but never beat someone over the head with an idea. It works on me, too. The people who are most influential to me always handle me with a positive opinion, repeating the idea until I have it, but never condemning my shortfalls, and introducing new ideas and showing examples about how to incorporate them in to my work.

©2010 Analytical Life. All rights reserved except as licensed to the commons.