Following a security breach Susan an hr manager
|
Human resource professionals often find themselves balancing the interests of employees and employers while also striving to comply with federal, state and local laws. In some cases, an ethical misconduct definition is clear cut. In others, a human resources manager or director will have to rely on his or her professional experience and ethics to determine a proper course of action. When training human resources employees about ethical misconduct, it is often best to explain with suitable examples of the unethical issues involved in HRM and IT. Show
Overlooking Legal and Compliance LapsesHR workers may be asked to overlook violations of workplace rules or labor laws. Legal compliance, however, is essential to the long-term interests of a business, even if it means embarrassment or losing a valuable employee in the short term. Example: Susan, an HR director, is approached by Dave, a sales manager. Dave is hiring for a position on his team, and he asks Susan to screen out any resumes with "foreign-sounding" names. Susan explains that it is illegal and unethical to do this. Dave becomes angry and leaves. Later that day, Dave's boss, Andy, approaches Susan and explains that Dave will quit his position if Susan refuses to comply. Andy asks Susan to go along with Dave's request, noting that Dave is a "good producer" for the company. Susan refuses and tells Andy that she plans to escalate this situation. Eventually, both the CEO and the board of directors get involved. Both Andy and Dave are let go by the company. The Confidentiality TrapSometimes, HR professionals become aware of violations while talking with employees. This situation creates an ethical dilemma because the HR worker would like to keep an employee's confidence, but the HR rep also has an obligation to report hazards and wrongdoing. Some experts advise HR professionals to be cautious about promising confidentiality. Employees should be told that if they report something to HR that violates the law or places other workers in danger, HR must report what the employee has said. Example: Matt is an HR director for a large restaurant chain. During a site visit, a clearly upset kitchen worker named Cheryl approaches Matt and explains that she needs to tell him something, but is concerned about her job. Matt tells her that he is ethically and legally obligated to report some issues to corporate management. However, anything said to him in good faith will be taken seriously. He also tells Cheryl that she has protection under whistle-blower laws. Cheryl explains that health and safety procedures are not followed in the food storage area and her complaints are ignored by restaurant management. Matt thanks Cheryl for her honesty and files a report. He also arranges for Cheryl to be transferred to another restaurant so that she can avoid having to work in a hostile environment. Collecting and Protecting Employee InformationHR departments handle a lot of sensitive information, including:
Sloppy handling of this information could expose an employee to identity theft, embarrassment and possible harassment. HR departments need to have strict policies for the storage and handling of employee information. These policies should include:
Example: Greg was recently hired as HR manager for a small business. On his first day at work, he notices right away that HR files are stored in an unlocked file cabinet in an easily accessed area. Electronic records are protected only by a password that everyone in the department knows. After Greg brings up his concerns, the company's CEO authorizes the purchase of more secure file cabinets and allows Greg to place them in a locked office. Electronic records are then secured through a proprietary service, and permissions for information access are allocated more carefully. Gartner Predicts 75% of CEOs Will be Personally Liable for Cyber-Physical Security Incidents by 2024Financial Impact of Cyber-Physical System Attacks Resulting in Fatalities Expected to GrowLiability for cyber-physical security incidents will pierce the corporate veil to personal liability for 75% of CEOs by 2024, according to Gartner, Inc. Due to the nature of cyber-physical systems (CPSs), incidents can quickly
lead to physical harm to people, destruction of property or environmental disasters. Gartner analysts predict that incidents will rapidly increase in the coming years due to a lack of security focus and spending currently aligning to these assets. Gartner defines CPSs as systems that are engineered to orchestrate sensing, computation, control, networking and analytics to interact with the physical world (including humans). They underpin all connected IT, operational technology (OT) and
Internet of Things (IoT) efforts where security considerations span both the cyber and physical worlds, such as asset-intensive, critical infrastructure and clinical healthcare environments. “Regulators and governments will react promptly to an increase in serious incidents resulting from failure to secure CPSs, drastically increasing rules and regulations governing them,” said Katell Thielemann, research vice president at Gartner. “In the U.S., the FBI, NSA and Cybersecurity and Infrastructure Security Agency (CISA) have already increased the frequency and details provided around threats to critical infrastructure-related systems, most of which are owned by private industry. Soon, CEOs won’t be able to plead ignorance or retreat behind insurance policies.” Gartner predicts that the financial impact of CPS attacks resulting in fatal casualties will reach over $50 billion by 2023. Even without taking the actual value of a human life into the equation, the costs for organizations in terms of compensation, litigation, insurance, regulatory fines and reputation loss will be significant. “Technology leaders need to help CEOs understand the risks that CPSs represent and the need to dedicate focus and budget to securing them,” said Ms. Thielemann. “The more connected CPSs are, the higher the likelihood of an incident occurring.” With OT, smart buildings, smart cities, connected cars and autonomous vehicles evolving, incidents in the digital world will have a much greater effect in the physical world as risks, threats and vulnerabilities now exist in a bidirectional, cyber-physical spectrum. However, many enterprises are not aware of CPSs already deployed in their organization, either due to legacy systems connected to enterprise networks by teams outside of IT, or because of new business-driven automation and modernization efforts. “A focus on ORM – or operational resilience management - beyond information-centric cybersecurity is sorely needed,” Ms. Thielemann said. Gartner clients can learn more in the report “Predicts 2020: Security and Risk Management Programs.” Gartner Security & Risk Management Summits Gartner analysts will provide additional analysis on IT security trends at the Gartner Security & Risk Management Summit 2020 taking place virtually September 14-17 in the Americas and EMEA and December 2-4 in Japan. Follow news and updates from the conferences on Twitter at#GartnerSEC. Which one of the following is not normally considered a business continuity task?Which one of the following is not normally considered a business continuity task? C. Electronic vaulting is a data backup task that is part of disaster recovery, not business continuity efforts.
Which one of the following security programs is designed to provide employees with the knowledge they need to perform their specific work tasks?Which of the following security programs is designed to provide employees with the knowledge they need to perform their specific work tasks. Security Training, is designed to provide employees with the specific knowledge they need to fulfill their job functions.
Which security event that compromises the confidentiality integrity or availability of an information asset?Threats can be categorised as circumstances that compromise the confidentiality, integrity or availability of an asset, and can either be intentional or accidental.
What are the two best options to avoid security problems caused by attachments?Use an alternate protocol like PEAP or EAP-TLS, and implement Wired Equivalent Privacy to avoid wireless security issues.
|
