Make Security Part of the Culture

Another key element is establishing a culture that values security. That helps keep the honest people honest and makes it easier to deal with people who cross the line. At George Washington University in Washington, D.C., the CIO and his information security officer, Krizi Trivisani, have made computer security part of the university’s code of conduct that students, faculty and staff have to read and sign once a year. "Policy is a great vehicle," says CIO Dave Swartz. "Of course, you have to be ready to enforce the policy, and that’s the problem. What’s the hammer?" Swartz’s department forwards people who break security policies (including students who try to test hacker techniques they’ve learned in class) to the appropriate disciplinary organization, but they prefer to focus on prevention. The IT department hosts regular security forums and invites members of the legal department, compliance office, and audit, policy and student groups. "Education and awareness is a very powerful tool," Swartz says.

CIOs who decide to implement stricter policies for employees should be doubly sensitive to educating users about reasons for the changes. "This is a classic situation where what your culture is and what you’ve done in the past lays a foundation for future efforts," says Mitchell Marks, an organizational psychologist in San Francisco. "If you don’t explain why you are [increasing security], then people will talk about it at the coffee machine, fill in the information voids with perceptions that are probably more negative than reality [and conclude]: Leadership doesn’t trust us."

Watch for Unusual Activity

Despite those precautions, companies also need to protect against the possibility that those levels of security will be broken. At Sony Pictures Entertainment, right before a big movie release like Spider-Man, the hacks start coming from insiders and outsiders who want to get a prereleased version of the movie or see the stars’ salaries. That’s where the company’s intrusion detection system (IDS) steps in, by watching for unauthorized activity. Employees who poke around for inappropriate information on Sony’s network might generate an alert that lands on the desk of Jeff Uslan, director of information protection and security at the Culver City, Calif.-based company. "The system would tell me your machine address and IP address," he says. "You might get a call from myself, saying, ’Is there something I can help you with, because you’re trying to get into these files that you shouldn’t.’" The IDS would also help Uslan find out if a hacker had infiltrated Sony’s system and was using an employee’s credentials or computer to launch an attack.