A
A
A
A
When working for sensitive nuclear sites, employees should be sensitised to the need for information security, as well as physical security. As part of joining such organisations, employees are often required to forego certain rights by signing non-disclose agreements or other legal implements such as national secrecy acts.
The discussion of sensitive security information should always be within the confines of ‘need to know’ principle, both inside and outside of an organisation. Social media certainly is an inappropriate forum for these discussions as once publicised it cannot be removed. Even within closed groups, participants cannot guarantee the security of the medium, and once discovered organisations may have to undergo considerable changes to render any leaked information obsolete. Discussion of sensitive security-related work information may also identify other staff members as employees of a nuclear site, potentially placing them and their families at risk from malign actors either physically or through means such as ‘social engineering’.
The discussion of sensitive security-related work information on social media represents a potentially serious lapse of information security and staff who notice this should reports the incident to security team who can investigate.
In most cases, however, it is not the responsibility of staff member or contractors to conduct their own investigation. Rather, it recommended that such incidents are reported to the organisation’s security or human resources team who can record the incident and investigate wider behaviours. Nuclear organisations should consider establishing human resources or security teams where matters can be reported in confidence, and where employees may seek direction for financial or medical assistance.
Further Reading:
Bisson, D., ‘5 Social Engineering Attacks to Watch Out For’ on Tripwire. 5 November 2019
