As any security professional will tell you, the risk of unauthorized intrusion into corporate IT assets is a very real threat. Any computer that has a connection to the Internet is a potential doorway to exploit. Automated hacking software, bots, and spiders can (and do) find and exploit any found weakness that exists in a system's security.

Computer files almost never go away. Deleted files, e-mail messages and un-installed software can stick around on hard drives and diskettes forever. Discarded corporate assets can be a boon to the "Dumpster diver" willing to invest an afternoon going through the trash bin behind your building.

Do you ever think about how this type of data "garbage" can easily fall into the wrong hands?

You are the weakest link--goodbye

Even with the assurances of firewalls and encryption technologies, the weakest link in any security chain is still the human users and their actions or inactions. A disgruntled employee who passes his login and password via e-mail to another source can compromise a multimillion dollar security installation. No piece of hardware or software is strong enough to withstand the admin who neglects to initialize standard security protocols. The human element of any security system is its greatest weakness.

Does your company have a current security policy? Have you seen it recently? Has anyone outside of IT seen it? How many employees have read it completely? If you don't have a security policy in place, or if the employees don't read it, the odds of them complying with your requirements are virtually non-existent!

Start at the beginning

Training individuals about the security of their desktop workstation should begin during employee orientation. Your company's policy regarding workstation use ("no illegal downloads or porn, please") should already be documented and is probably shared with employees on their first day, so why should other security policies be any different?

The security policy should be translated into a form that is easily understandable for those not in IT. Have this document available in hard-copy format as well as downloadable from a corporate resource, like your intranet. Make it readily available, share it during orientation and record users' acceptance.

If your company uses usernames and passwords as an authentication method, start there. Most users are familiar with the concept and this will act as a good introduction into some of the other concepts you will soon introduce.

Explain to users that passwords are a weak level of security for a variety of reasons--they can be written down and shared, sent over e-mail, or captured via keystroke recording. Even so, they are usually the first line of defense against illegal access.

During orientation, the security policy documentation should outline the company policy regarding passwords--how often they change, how many characters, types of characters, types of access, etc. The new employee should not only have a very clear indication of how they should choose their password, but also the consequences of losing or sharing their passwords.

Keep it to yourself

Consequences are important. When millions of dollars of proprietary data is at stake, it is no longer enough to tell people, "Don't share your password." If tracking logs identify double or triple access points using the same username and password combination, there should be documentation to explain how this should be handled.

Examples or stories of situations should be shared with new employees so that there is no question about what will happen if there is a security breach with their credentials. Ensure compliance with a signature form that is stored in the employee records, documenting that they have heard, understood, and agree to comply with the company's security policy.

The services and Web applications that you have disabled as a part of your corporate security strategy should be clearly outlined to those being trained. For example, they should know that file sharing or chat programs will not function from within the organization and explain how security holes in these applications can be exploited.

Being able to stream audio files or chat with associates at other organizations are not mission-critical applications, and new employees should know up front that these applications won't run.

Watch the mail

E-mail etiquette and functionality should also play a major role in the education of your non-IT staff. It is not enough to explain how to use your particular e-mail software, but the danger of opening mail or attachments from unknown sources should also be addressed. Although IT staff completely understand the danger of unknown attachments, your typical user will likely open an enticing sounding e-mail message with disastrous results.

If your organization has strict standards on what types of files get blocked at the server before being passed to a user's e-mail box, explain which file types will get through and which won't. Nothing frustrates users more than attempting to send a peer an .HTM file, only to have it repeatedly blocked by e-mail protocols. A list of blocked file types should appear in the security policy.

Can i fix this?

Your security policy should indicate whether or not users should be responsible for activating and installing the numerous security patches and fixes to today's operating systems. If the users are responsible for this, then they need training on how to properly install these patches.

When patches become available, a company-wide message needs to go out with explicit instructions on installing and using them. Having a spot on the corporate intranet (or other central communications center) where users can receive direction about how to perform the necessary installation is also a great resource.

This strategy also applies to desktop-based antivirus and personal firewall software. If your organization utilizes these tools, users must have a complete understanding of their operation in order for them to use the software correctly and to provide the protection you expect.

The instruction should also consist of how to install software on a machine protected by a personal firewall or anti-virus software. If your security policy allows users to install software on their machine, potential security problems can be avoided if users understand how to turn their protection off or on.

Leave it to us

The most important training issues to remember when talking security with non-IT employees are: 1)they don't understand the importance of the simple things they can do to protect company assets; and 2)they don't care about the technical details of how everything should work.

Employees need to be trained on how to use the tools that you have installed to protect their computer and the company's assets, not necessarily the technology behind how they work. They need to understand that their actions (or inactions) can have a dramatic effect on the security of the organization as a whole.

They should have access to the security policy and any other documentation or support forms that help them help you keep the company secure. Empower employees through knowledge so that they know what they need to do to protect themselves, their computer and the organization.

While the dangers posed by plugging a corporate computer into the Internet are very real, business professionals need to utilize the Web. The biggest security hole in any organization is employees and their inability to properly protect themselves. Proper training during orientation, access to support materials from a corporate resource, and a documented acknowledgement of compliance will help ensure that your organization stays safe and hack-free.

Thomas Toth is the IT training manager for Belcamp, Md.-based Rainbow Technologies, a provider of transaction security for the Internet and secure remote access solutions.