Title: Employment Policies and Practices
Course: IN 2001 Principle of Information Assurance > Section: Module 11: Chapter 11

Employment Policies and Practices
1. The general management community of interest should integrate solid information security concepts into the organization’s employment policies and practices.
2. If the organization can include security as a documented part of every employee’s job description, then information security may be taken more seriously.
3. From an information security perspective, the hiring of employees is a responsibility laden with potential security pitfalls.
4. The CISO and information security manager should establish a dialogue with the human resources department to provide information security input to the guidelines used for hiring personnel.

Job Descriptions
1. Incorporating information security perspectives into the hiring process begins with reviewing and updating all job descriptions.
2. To prevent people from applying for positions based solely on access to sensitive information, the organization should avoid revealing access privileges to prospective employees when it advertises open positions.

Interviews
1. The next point of contact with a potential employee is the job interview.
2. An opening within the information security department presents a unique opportunity for the security manager to educate HR on the certifications, experience, and qualifications of a good candidate.
3. For other areas, information security should advise HR to limit the information provided to the candidate about the responsibilities and access rights the new hire would have.
4. For those organizations that include on-site visits as part of the interviews, it is important to exercise caution when showing a candidate around the facility.

Background Checks
1. A background check is an investigation into the candidate’s past that specifically looks for criminal behavior that could indicate the potential for future misconduct.
2. A number of regulations govern what the organization can investigate and how much of the information uncovered can be allowed to influence the hiring decision. The security and HR managers should discuss these matters with legal counsel.
  - Background checks differ in the level of detail and depth with which they examine a candidate. The following are various types of background checks:
    - Identity checks
    - Education and credential checks
    - Previous employment verification
    - References checks
    - Worker’s compensation history
    - Motor vehicle records
    - Drug history
    - Credit history
    - Civil court history
    - Criminal court history
3. There are federal regulations regarding the use of personal information in employment practices.
  - One such regulation is the Fair Credit Reporting Act (FCRA), which governs consumer credit reporting agencies and the uses of the information procured from these agencies
  - These reports contain information on a job candidate’s credit history, employment history, and other personal data
  - Among other things, the FCRA prohibits employers from obtaining these reports unless the candidate is informed in writing that such a report will be requested as part of the employment process
  - The FCRA also restricts the periods of time these reports can address

Employment Contracts
1. Once a candidate has accepted the job offer, the employment contract becomes an important security instrument.
2. Many policies require an employee to agree in writing to monitoring and nondisclosure agreements.
3. If an existing employee refuses to sign these contracts, the security personnel are placed in a difficult situation.
4. With new employees, however, security personnel can institute policies classified as “employment contingent upon agreement.”
5. This classification means the employee is not actually employed until he or she agrees in writing to conform to the binding organizational policies.

New Hire Orientation
1. As new employees are introduced into the organization’s culture and workflow, they should receive an extensive information security briefing.
2. This briefing should cover all the major policies, procedures, and requirements related to information security within the new position.
3. The levels of authorized access should be outlined, and training should be provided on the secure use of information systems.
4. By the time employees are ready to report to their positions, they should be thoroughly briefed and ready to perform their duties securely.

On-the-Job Security Training
1. As part of the new hire’s ongoing job orientation, and as part of every employee’s security responsibilities, the organization should conduct periodic security awareness and training.
2. Keeping security at the forefront of employees’ minds minimizes employee mistakes and is an important part of the information security mission.
3. Formal and informal seminars should also be used to increase the security awareness level of all employees, especially that of security employees.

Evaluating Performance
1. To heighten information security awareness and change workplace behavior, organizations should incorporate information security components into employee performance evaluations.
2. Employees pay close attention to job performance evaluations, and if the evaluations include information security tasks, employees are more motivated to perform these tasks at a satisfactory level.

Termination
1. When an employee leaves an organization, there are a number of security-related issues.
2. Key among these is the continuity of protection of all information to which the employee had access.
3. When an employee prepares to leave, the following tasks must be performed:
  - Access to the organization’s systems must be disabled
  - Removable media must be returned
  - Hard drives must be secured
  - File cabinet locks must be changed
  - Office door locks must be changed
  - Keycard access must be revoked
  - Personal effects must be removed from the organization’s premises
4. Once the employee has delivered keys, keycards and other business property, he or she should be escorted from the premises.
5. In addition to the tasks listed above, many organizations use an exit interview to remind the employee of contractual obligations, such as nondisclosure agreements, and to obtain feedback on the employee’s tenure in the organization.  At this time, the employee should be reminded that should he or she fail to comply with contractual obligations, civil or criminal action may be initiated.
6. Security cannot risk the exposure of organizational information. The simplest and best method to handle the out-processing of an employee is to select, based on the employee’s reasons for leaving, one of the following scenarios:
  - Hostile Departure
    - Hostile departures (non-voluntary) include termination for cause, downsizing, lay-off or some instances of quitting
    - Before the employee knows that he or she is leaving, security terminates all logical and keycard access.  As soon as the employee reports for work, he or she is escorted into the supervisor’s office for the news
    - Upon receiving notice, the employee is escorted to his or her area and allowed to collect personal effects.  No organizational property is taken from the premises
    - The employee is asked to surrender all keys, keycards, and other company property. The employee is then escorted out of the building
  - Friendly Departure
    - Friendly departures (voluntary) include retirement, promotion, or relocation.  In this case, the employee may have tendered notice well in advance of the actual departure date.  This actually makes it more difficult for security to maintain positive control over the employee’s access and information usage
    - Employee accounts are usually allowed to continue with a new expiration date
    - Employees come and go at will and collect their own belongings and leave on their own
    - They are asked to drop off all organizational property “on their way out the door.”
7. In either circumstance, the offices and information used by the employee must be inventoried, their files must be stored or destroyed and all property must be returned to organizational stores.
8. In either situation, employees might foresee their departures well in advance and might begin collecting organizational information or anything that could be valuable in their future employment.
9. Only by scrutinizing systems logs after the employee has departed and sorting out authorized actions from systems misuse or information theft can the organization determine if there has been a breach of policy or a loss of information.
10. In the event that information is illegally copied or stolen, the action should be declared an incident and the appropriate policy should be followed.