BM2201B: Threat to Information Systems.

Unintentional acts are those acts with no malicious intent. One of them is Human Errors and represented by far the most serious threats to information security.

Human Errors

There are different categories of organizational employees. First category is comprised of regular employees, who span the breadth and depth of the organization, from mail clerks to the CEO, and in all functional areas. The higher the level of employees, the greater the threat the employee poses to information security. This situations exist because higher-level employees has greater access on organizational information systems.

The second category includes contract labour, consultants, and janitor and guards. Contract labour such as temporary hires, may be overlooked in information security. However, these employees often have access to the company’s network, information systems, and information assets. Consultants, although technically not employees, do works for the company. They also may have access to the company’s network, information systems, and information assets.

Human errors or mistakes by employees pose a large problem as the result of laziness, carelessness, or a lack of awareness concerning information security. This lack of awareness usually comes from poor education and training efforts by the organization. Human mistakes manifest themselves in many different ways.

Human Mistakes

1. Tailgating.

A technique designed to allow the perpetrator to enter restricted areas that are controlled with locks or card entry. The perpetrator follows closely behind a legitimate employee and, when the employee gains entry, asks them to ‘hold the door’.

To deter tailgating, many companies have anti-tailgating doors protecting the entrance into high-security areas. Note that only one person at a time can go through this door.

1. Shoulder surfing.