Do You Trust The Mailroom Clerk?

Apr 1, 2007 12:00 PM, Miki Calero

Job titles can be misleading as indicators of the level of access to sensitive information. Consider a mailroom clerk, a facility maintenance engineer or a receptionist — just three of the many titles held by employees who may be unaware of the value of information they handle routinely. Clerks process “payment due” notices; facility engineers create work orders identifying malfunctioning door locks; and receptionists record the name and the digital image of all visitors.

Can you assign a classification level to “payment due” notices in accordance with your Information Classification Policy? Does your organization's Physical Security Policy cover how to safeguard information about access control systems? Since the law does not regard it as Personally Identifiable Information (PII), should you implement controls for the protection of visitor information?

While you grapple with these questions, you should also look for ways to foster ongoing awareness of these and other nonstandard security subjects. Consider doing so within a framework that is both simple and effective: the elements of adult learning.

You know your audience well: you hold the door open for their mail cart, and ask about their children; you send them a “thank you” e-mail for having replaced the flickering fluorescent tube above your desk; you greet them by name as you enter the building. With these relatively effortless actions, you have tended three of the four elements of adult learning: motivation, retention, transference. By focusing on the last and most challenging element — reinforcement — you establish the foundation for a greatly improved security program.

---

Miki Calero is a frequent speaker and writer on security subjects. He joined American Electric Power in 2000 and was responsible for the implementation of security processes and controls in the enterprise's information security, physical security and business continuity convergence program. He is an associate member of the Security Executive Council (http://www.csoexecutivecouncil.com), which presents this article.

Want to use this article? Click here for options!
© 2009 Penton Media Inc.

This month in Access Control

• Targeting The Customer
• Electronic Pedigrees
• One Hero Among Many
• Who? What? When? Where? Why?
• More from September's issue