Security Program Elements

What it is

A security program is the organised set of policies, activities and controls that protect an organisation, and it reaches well beyond technology.

Technology can only do so much, because attacks often go through people, or through a door that someone left open.

This topic covers three elements that sit alongside the technical controls: user awareness, training and physical access control.

How it works

Awareness shapes habits, training builds skills, and physical controls stop unauthorised presence.

User awareness

Awareness is about keeping security in people's minds all the time. It is ongoing and aimed at everyone, using short, regular messages rather than long courses. The goal is to change everyday habits.

Typical awareness activities include:

• posters, newsletters and short reminders
• simulated phishing emails, to test whether people click
• reminders to lock screens, to report anything suspicious and to avoid reusing passwords
• clear instructions on who to tell when something looks wrong

Awareness works because many attacks, such as phishing and phone scams, depend on a person making a mistake. A user who has learned to spot a suspicious message is a defence that no firewall can provide.

Training

Training is more formal and more focused than awareness. It teaches specific skills to specific groups, and it is often recorded and repeated on a schedule. Different roles need different training:

• All staff: acceptable use of company systems, how to handle data, how to recognise phishing and social engineering.
• Administrators: secure configuration, patching, and how to respond to an incident.
• Developers: secure coding.
• Managers: their responsibility for policy and for reporting.

One way to separate the two ideas is this: awareness says be careful, and training teaches how. Awareness is a constant background. Training is a planned event with a defined audience and a defined result.

Physical access control

Even the best software controls fail if someone can walk up to a server, plug a device into a switch or steal a laptop. Physical access control restricts who can enter places and touch equipment.

Controls come in layers, from the outside in.

• Fences, gates and lighting around the site.
• Security guards and reception desks that check visitors.
• Locks, badge readers and keypads on doors.
• Mantraps, which are small entry spaces with two doors where only one can open at a time, so that people cannot follow someone in without being seen. This blocks tailgating.
• Biometric readers, such as a fingerprint scanner, for the most sensitive rooms.
• Locked cabinets and racks for network equipment, so a wiring closet is not open to anyone.
• Cameras and logs of who entered and when, which discourage misuse and help investigation.
• Visitor rules, such as signing in, wearing a badge and being escorted.
• Locking down the network edge, such as disabling unused wall ports and protecting console ports.

Physical controls can be described by their purpose. Some deter (a sign or a camera), some prevent (a locked door), some detect (an alarm or a log) and some help to recover.

How the elements work together

The three elements support each other and the technical controls.

A policy tells people what is expected. Awareness and training help people meet it, and physical controls enforce it where people could otherwise ignore it.

Auditing and testing then check that it all works. A common test is a simulated attack, such as sending a fake phishing message or checking whether a door is left unlocked.

Social engineering examples

These elements are the main defence against social engineering, so it helps to recognise it.

• Phishing: a message designed to trick the reader.
• Pretexting: inventing a story, such as pretending to be from IT support.
• Tailgating: following an authorised person through a door.
• Baiting: leaving an infected USB drive where someone will find it.