The key to an effective data security policy, however, is not data but people. No security controls and processes will be effective unless all employees adhere to them. This means defining a clear security policy and obtaining employee buy-in and commitment. The policy should be enforceable, realistic, acceptable to users and should not violate personal privacy laws.
User education is essential, which means training everyone in your organisation – including senior management – about different types of threats and how to prevent them. You should make sure that they know exactly what to do and who to contact should the worst happen. They need to feel able to ask for help if they think they’ve mistakenly clicked on something malicious, rather than burying their head in the sand and hoping for the best.
Some of your policies may be unpopular, such as disabling the use of USBs or other mobile storage devices. To obtain user commitment you need to explain why they’re needed and make sure that secure alternatives are available.
It’s also vital to obtain commitment at the top of the organisation. Security policy needs board level commitment and HR support before implementation, executive sponsorship during implementation and HR defined penalties for policy violations. These penalties should be equally applicable at all levels of the organisation.
Finally, you need commitment from the various data owners in your organisation, as they should be responsible for managing and keeping their data safe once the security solutions have been implemented. They can use Data Lifecycle Protection (DLP) tools, for example, to enforce policy and reporting requirements appropriate to their needs. Typically the security problems we see occur where users are allowed to store data on their own machines. Data owners should also be given responsibility for ensuring that data is consolidated in a central network location, as DLP works best when data is organised and structured.