• United States

Probation? Probably not

Sep 09, 20032 mins

* Is employee probation ever a good idea, from a security perspective?

In discussions of employee management and security, key areas of concern are hiring and firing. However, ongoing management also provides challenges to information assurance; for example, how should IA professionals handle proposals to offer an employee a probationary period?

There are two kinds of probationary period:

* A period at the start of employment designed to evaluate a new employee’s skills and decide on permanent employment.

* A period following a serious problem, possibly leading to termination of employment if the problem or its equivalent recurs.

Both types of probation raise problems for IA.

In the preliminary probationary period, the candidate’s employment is contingent on approval. When assigning access privileges to such a candidate, security staff should evaluate managers’ natural desire for productivity but weigh the benefits of thoroughgoing access against the possibility that the employee will soon disappear.

As for probation for the error-prone or the lazy, I can accept the idea of a probationary period for employees who may be making too many mistakes or who need a kick in the pants to be motivated for better performance. However, a probationary period for an employee who has given cause to worry about security violations is far more problematic.

When would it make sense to allow an employee who violates clearly stated security policies to be put on probation? There’s certainly nothing wrong with correcting someone’s behavior using advice, criticism or even reprimands if appropriate. What doesn’t make sense to me, though, is telling someone who has committed such a serious violation of security that they could be fired, “Well, we won’t fire you right now: we’ll give you and fire you at the end of that time if we don’t like your behavior.”

If someone is not worthy of trust, why would you give them access to sensitive and critical resources at all, let alone do so while putting them on notice that they may lose their job soon?

I recommend that probation for employees you don’t trust simply not be an option. Either express your support and trust in your employees or fire them right away if they no longer merit your confidence in their honesty.