Mark Nicholas

UK

Security and Business Continuity Consultant

Dear Merlin. You've obviously missed the point. Social Engineering is all about circumnavigating common sense to use tactics to obtain information. Of course people aren't going to hand over keys etc because they have personal ownership over them and they also appreciate the consequences or impact. Now, lets consider 'fatmans' comments that the data doesn't belong to them. You therefore need to educate them, because if the business isn't responsible, who is? Are you going to leave it to every individual employee to use their common sense?? No chance, that's what anti virus etc is for, to remove the doubt, that's the business being proactive. Which is what information security primarily is, 'Proactive Risk Management'. You assume too much of an employee. They want to do their role without worrying about this stuff and where they do they need education, then as a final slap, to use the Corporate Policy on them, because if you're into disciplinary, you've failed already as they must have already committed a breach.