16. Education of Users

This does not come under either physical or logical methods of protecting an IT system. However, it is every bit as important as all of the other methods that we have discussed.

Remember at the beginning, we said that employees or users of the system were the most likely people to cause damage to the data. Thus, it is vital that companies ensure that users are educated in how to use the system correctly.

Education of users might cover things such as:

• Not giving out passwords to other people
• Not leaving your computer logged in while you are away from your desk
• Making sure that you log off and shut down your computer at the end of the day
• Making sure that others can't see your screen or keyboard easily if you are working on confidential information
• Not taking copies of important or confidential information out of the office unless absolutely necessary
• If files have to be taken out of the office on either a laptop or memory stick, ensure they are encrypted
• Password protect or encrypt important files on the system
• Don't try to use proxy bypass sites to access sites which have been blocked or restricted by the network manager

All users should sign a Code of Conduct agreement.