Organizing Personnel Security

What does computer security have to do with personnel? Verizon’s 20222 Data Breach Investigation Report reveals that 82% of breaches involve people, whether through stolen credentials, phishing, misuse or simply unintentional error. Errors, misconfiguration and incorrect deliveries are mistakes that are solely attributable to internal actors (commonly employees). Lost or stolen laptops, cell phones, documents and backups are commonly left in a car – or elsewhere. Privilege misuse includes people using privileges required to do their jobs to steal information for financial, espionage, or grudge reasons, or may include people bypassing security controls for convenience. Personnel security involve listing probable personnel threats and appropriate preventive, deterrent, detective and corrective controls, documenting security responsibilities for various roles, defining training for security responsibilities, and implementing tools to assist in controlling processes, documentation, and third parties.