HR Pulse

IT changing HR's role

Although HR management has traditionally stayed away from business IT issues, today’s always-on, always-connected worker (known as the “Facebook Generation”) demands changes to existing HR roles and responsibilities.

According to Herman van Heerden, CEO, N3WORD3R Industries, HR workers can no longer get away with the old adage, “Ignorance is bliss”, when it comes to addressing the company’s IT-related issues. “Even though the technology knowhow falls outside the realm of HR, it becomes relevant as the HR manager has to deal with the repercussions of data leakage. IT might be responsible for the technical side of it, but it is up to HR to educate the staff accordingly and handle disciplinary sessions - in the case of employees leaking corporate data - whether knowingly or unknowingly,” he explains.

The nature of today’s corporate network is one of uninterrupted inter-connectivity, both internally and externally.

Phillip Gerber, MD of Magix Security says that South African companies are adopting mobile computing and increasing worker flexibility in an effort to optimise productivity and profitability.

“Allowing uncontrolled access to company information via these endpoint devices can open the door to data theft and fraud. Moreover, as governments around the globe enact regulations that require companies to publicly disclose data breaches, and often pay hefty fines for failing to secure information, traditional lines of defence, such as firewalls and intruder prevention systems (IPS), are proving inadequate,” he says.

One way to deal with this effectively, Van Heerden explains, is through policies: “It should be included in the policy that employees are not to install software downloaded from the Internet or received from any source outside of the company, as they may be laced with malware and open up all kinds of holes into the company's inner workings."

He also warns that using "cloud services" for official business, or even officially during office hours allows information to be sent through unsecure channels. “Even using services of convenience like Dropbox can become a major security risk. For a company like Dropbox, its first responsibility is to its shareholders, and the data stored on it takes a back seat if it does not fit into the equation.”

“The trend in South Africa is certainly a gradual move towards the Cloud as we make a natural transition along the adoption curve,” says Christelle Hicklin, customer experience manager at Mimecast SA. “The market is also evolving at such a rate that new people are entering the IT space and they have grown up in an environment that trusts the Cloud. Increasingly complex IT environments, faster broadband speeds and increased access as well as the proliferation of mobile devices are all drivers for the “new” kind of worker to emerge - one that demands more flexibility and choice regarding technology use in the workplace. One such example is: wanting the option to use a single device for both work and personal use."

This, of course, creates many security headaches for the companies and many of the new “holes” created are not at all obvious.  

For instance, says Hicklin, using your home laptop at work encourages the employee to check his personal mail within the corporate network, or to use this account to receive business-related correspondence.

“However,” Hicklin continues. “Employees are largely unaware of the risks they are subjecting their company to by bypassing security rules. Neither do they transgress security measures for malicious reasons.”

Part of the new role of the HR manager, says Hicklin, is to make employees more aware of the dangers of modern working environment and perimeters. “In other words, the modern HR manager needs to be sufficiently IT-savvy to ensure there are no miscommunication issues between what management wants and the user wants.”

“HR should educate employees,” van Heerden agrees. “Common sense can go far with a couple of pointers, but it is especially necessary that the manager explain the rationale behind why some processes are in place will bring understanding to the new guy who will measure everything against his old job.”

Van Heerden also believes that top management needs to live by best practices. “Restrictions on social networks might be a good idea,” he says.

According to Gerber, HR needs input from the IT department and vice versa. “You can’t say they are not allowed to perform certain potentially “unsafe” actions, if there is no policy in place to deal with this. The significant challenge here, however, is for business to come up with a policy that suits both business and user optimally.”

 Van Heerden suggests the following points be considered when drawing up a policy to help fortify the company’s security: Replace external cloud services with internal alternatives; Don't use Dropbox or iCloud where data moves off-site where it is out of your control, rather own the system, and thereby own the data as far as it is possible.

Van Heerden also suggests restricting the use of office machines for some personal functions. “While there is no harm in allowing employees to use systems like Internet banking while at work ("real life" practice), restrictions on social networking and services such as Facebook, Twitter, Google Docs, Gmail, etc. must be restricted ("best" practice).”

Finally, Van Heerden advises companies to invest in a good data-loss prevention system. “And even go as far as disallowing writable CDs and USB memory sticks to be used. Networks and official backup solutions are in place, so there should be no need to make copies that can be lost or discarded.”