Chapter 5. Security Training

There has always been a sizeable gap between what is written about security and what actually happens in the real world no one ever talks about the last time they were broken into, when they had a significant security incident, the multitude of problems that the last security audit found, or the unpleasant fact that their organization's security policy doesn't exist.

Dan Farmer, Security Researcher

You're moving up the chain of command fast. Not because you're buddies with the CEO, but because you have ground-breaking brilliant ideas that continue to place your company in front of the competition. You're not arrogant. You're confident, strong, and have vision. Clients who want things done with superior results put you on the job because you have a Ph.D. in results!

Over the past few months, your ideas have been flowing like a river. At work, you don't give it a second thought as you store your brilliant business ideas, development plans, key investments, and takeover strategies on your powerful desktop computer.

Just this morning, your receptionist informed you that she completed your presentation for the board of directors. You thank her and think to yourself how lucky you were to get such a brilliant MBA summer student as your assistant. You log out of your system, pick up your presentation, and head to the board meeting.

What you don't know is that your lovely MBA summer student is clandestinely collecting all of your brilliant ideas and company secrets. She's a spy! On top of that, she's a world-class underground security expert and could strip the information on your systems bare without leaving a shred of evidence of her presence. You'd be left with no clue that she walked right through the front door of your computer and ripped off your ideas.

As a corporate spy, your receptionist sells competitive information for cash. This time, she didn't have to work very hard for that cash. Your system administrators set up the systems so that anyone could easily read, modify, destroy, or steal the data on your network. They didn't bother enabling auditing or intrusion detection, so no one will ever even know about the security breach. Sound like a movie of the week? Don't be fooled.

Like most people, you've always considered your corporate network a safe haven for your information. Unfortunately, the key to keeping that haven safe is good training, and few people responsible for security get that. Just consider...