I am wrestling with an interesting concept. To what extent does the 'effective' technology security in an organisation depend upon the degree of motivation and morale of the workforce. A traditional view would have it that Security has an independent existence' and that it is founded in 'absolutes' - so that there are no shades of grey and no capacity for individuals to make it work better or less well.
Of course this is nonsense. At the very least a resentful or unhappy workforce is likely to take less care which will - if the security system is 'robust' generate more exceptions and lock-outs. While the Security Manager is dealing with this workload he or she has less time to look for 'real' mischief. If the security system is not as robust as you'd hope it was, the 'pressure' on it will eventually reveal holes, which the workforce is more likely to ignore than exploit, but certainly won't bring to your attention. We are not talking about 'actively' malicious activity, simply the consequences of the organisation failing to build a 'productive open-ended alliance' with their workforce (as opposed to the very un-open-ended relationship defined simply by "I work - you pay me").
If we factor in the possibility of malicious activity by disgruntled employees the significance of employee 'attitude' starts to move to centre stage. And it doesn't have to be employee initiated mischief, but simply collusive behavior where someone on the inside helps someone on the outside. We tend to discount the possibility that internal staff will be able to really do any damage on the basis that they (generally) aren't computer experts. In fact this attitude can lead us seriously astray - while we concentrate our suspicions on the guy in cubicle E13 who is displaying uncharacteristic aptitude with the equipment, we fail to notice the 'computer illiterate' guy at G11 is walking out the door with printouts.
Which gets back to the Security Manager saying, well I can't do anything about 'attitude' but I can make sure that my controls are the best they can be and we'll just have to rely on that (and furthermore even in the 'happiest' workplace there are a few bad apples, so I'll always have to design the systems to take account of the 'worst possible scenario'.) Which is perfectly correct, but the implication for Security Managers is this: If you have the opportunity to make observations about how the design or operation of the organisation is contributing to, or detracting from, morale which in turn is effecting compliance with the technology security protocols, should you speak up?
Comments