It would be interesting to follow up on situations where the "risks" were hired and performed long enough to see if they were statistically more risky than "non-risks". Most of the detetected problems were by people who would have passed security checks.
It may not be reasonable to assume that all criminals are "addicted" and thus a significantly greater risk. In fact, I would argue that knowing that "risky people" are present instills a discipline that aids prevention and discovery.
It just go to show on how the upper management feel about security. He's doing the job, let it go etc. A good Security Manager who is well verse in both the phyiscal and personal aspects of security would have pushed to have a back ground check done prior to hiring anyone with in his or her company. But as usual, upper menagement were just trying to cover up what should have been done in the first place.
All of your "hiring horror" examples have nothing to do with hiring practices or background checks and none would have been prevented by them.
I'm further not sure what an "update" background check is. Does their background change? Either this could be eliminated with a proper procedure up front by HR staff, or you might mean a psychological evaluation every few years. I'm not sure what the value that would be. Anything else like being on top of whether they've been arrested outside of work should be in the manager's realm of responsibilities.
I do like the point of this article, however. Have hiring practices and make sure they get followed! Unfortunately, this can only go so far. Almost all organizations are economically biased and I think all of them will eventually accept a risk if they can't properly fill a position otherwise or if he is adding value to the position.
How Not to Hire an Information Security Officer Who's on Parole
After learning that HR "forgot" to do a background check on a security staffer with a felony record, a leader reexamines his organization's policies
» View Article
FYI, (ISC)2 recently released a hiring guide to the information security profession:
https://www.isc2.org/Documents/HiringGuide/HiringGuide08.pdf
They also have a resource page for HR people: https://www.isc2.org/cgi-bin/hiring_guide.cgi
It would be interesting to follow up on situations where the "risks" were hired and performed long enough to see if they were statistically more risky than "non-risks". Most of the detetected problems were by people who would have passed security checks.
It may not be reasonable to assume that all criminals are "addicted" and thus a significantly greater risk. In fact, I would argue that knowing that "risky people" are present instills a discipline that aids prevention and discovery.
It just go to show on how the upper management feel about security. He's doing the job, let it go etc. A good Security Manager who is well verse in both the phyiscal and personal aspects of security would have pushed to have a back ground check done prior to hiring anyone with in his or her company. But as usual, upper menagement were just trying to cover up what should have been done in the first place.
All of your "hiring horror" examples have nothing to do with hiring practices or background checks and none would have been prevented by them.
I'm further not sure what an "update" background check is. Does their background change? Either this could be eliminated with a proper procedure up front by HR staff, or you might mean a psychological evaluation every few years. I'm not sure what the value that would be. Anything else like being on top of whether they've been arrested outside of work should be in the manager's realm of responsibilities.
I do like the point of this article, however. Have hiring practices and make sure they get followed! Unfortunately, this can only go so far. Almost all organizations are economically biased and I think all of them will eventually accept a risk if they can't properly fill a position otherwise or if he is adding value to the position.
Dirty Tricks: Social Engineers' Favorite Pickup Lines
Tabletop Exercises: 3 Sample Scenarios
19 Ways to Build Physical Security Into Your Data Center
Get instant notifications when whitepapers, webcasts and case studies are added to our library. Sign up for a Resource Alert now!
CSO Corporate Partners
» More blogs
CSO Perspectives
Santa Clara, California
(ISC)2 members can earn up to 24 CPE Credits!
Trend Micro ranked #1 against real-world malware. Read more.
64-page prescriptive guide to security, compliance, and IT operations.
Removing Barriers To Better Server Virtualization Efficiency
Mining for Gold: Cybercrime Prevention and the Role of Log Management
The Executive Guide to Data Loss Prevention
Organizations can spend up to 50% more on compliance efforts than necessary.
White Paper: A Security Blueprint Delivered From within the Network
Read the RSA report: Security for Business Innovation
Upgrading to VMware vSphere with vWire
Explore the increasing importance of log management as cybercrime threats grow.
The Tripwire HIPAA Solution: Meeting the Security Standards Set Forth in Section 164
Implementing Best Practices for Web 2.0 Security
Five Ways to Reduce Your IT Audit Burden
THE IDG NETWORK