Risk Possible Impact Mitigations
Bad Training
If the staff has not been trained
properly, there can be profit loss
when reconciling accounts.
Intellectual property could be lost.
There can be a leak of customers'
information if not shared, saved or
stored correctly. They could bring
something into the system that can
cause a security risk if not properly
trained.
Have an extensive training
program in place explaining
procedures that keep the
information technology system
safe. Having refresher courses to
remind staff of the methods and
having a complete training when
things change in keeping the
information technology safe. If
staff are not able to comply with
the training, restrict their access to
the information technology. Have
a safe environment where if the
staff has questions, they can go to
their superiors to get clarification.
Building Security
With buildings becoming adding
technology to enter, a building
staff could allow someone in
without having them go through
the safety procedures in place.
Even if they know them as an
employee of the company, the staff
person will not know if that is
current employment or if they have
been let go.
Do not be complacent with staff
allowing others in the building
without passing the security
measures. Make sure all staff
understand the expectations on
them with entry security. If a staff
member can not follow the
procedure after an acceptable
amount of warnings, the staff
member should be terminated.
Network Security
Staff can accept emails from
unknown people. Navigate to an
un-secure webpage that leaves the
network security at risk and
vulnerable. Staff could download
unverified information, software or
data that can corrupt the network.
Have security systems in place
that require a higher clearance in
order to go to un-secure web
pages to download files not
located on the network. Have a
standard for what the staff is
allowed to do and communicate
that effectively to them, so they
know the expectations with
accessing things outside of the
network.
