Page 163 - CISSO_Prep_ Guide

access control, DAC, MAC, information classification, and
single sign-on.

Human Resources Security

People and Security

An organization can have the best tools, the best policy, and the
most up-to-date technologies - and still, be a victim of a security
breach. That is because, in the end, security is primarily a people
problem. It is people that will either make or break a security
implementation. Whether by accident (error), negligence (taking
a short cut or bypassing procedures), or intention (overtly
bypassing an organization's security), most security breaches can
be tied to a people-related problem.

Skills
Security is not a naturally known skill and requires training,
awareness, and diligent monitoring. Naturally, most people
would rather deal with trust or ease of use rather than in fear,
caution, or taking extra steps to ensure security. When a person
has a responsibility, they need sufficient training to be able to
execute that responsibility effectively. No one can be expected
to do a good job of something that they know little or nothing
about. This especially applies to the use of information security
tools.

There are many excellent tools available to an organization
today, ranging from next-generation firewalls to Intrusion
Detection and Prevention systems, switches and routers, to