Page 145 - (ISC)² CISSP Certified Information Systems Security Professional Official Study Guide

not drift or encroach on those of another. Likewise, managers should

audit privilege assignments to ensure that workers do not obtain
access that is not strictly required for them to accomplish their work
tasks.

Candidate Screening and Hiring

Employment candidate screening for a specific position is based on the
sensitivity and classification defined by the job description. The

sensitivity and classification of a specific position is dependent on the
level of harm that could be caused by accidental or intentional
violations of security by a person in the position. Thus, the
thoroughness of the screening process should reflect the security of the
position to be filled.

Employment candidate screening, background checks, reference
checks, education verification, and security clearance validation are

essential elements in proving that a candidate is adequate, qualified,
and trustworthy for a secured position. Background checks include
obtaining a candidate’s work and educational history; checking
references; verifying education; interviewing colleagues, neighbors,
and friends; checking police and government records for arrests or
illegal activities; verifying identity through fingerprints, driver’s
license, and birth certificate; and holding a personal interview. This

process could also include a polygraph test, drug testing, and
personality testing/evaluation.

Performing online background checks and reviewing the social
networking accounts of applicants has become standard practice for
many organizations. If a potential employee has posted inappropriate
materials to their photo sharing site, social networking biographies, or
public instant messaging services, then they are not as attractive a

candidate as those who did not. Our actions in the public eye become
permanent when they are recorded in text, photo, or video and then
posted online. A general picture of a person’s attitude, intelligence,
loyalty, common sense, diligence, honesty, respect, consistency, and
adherence to social norms and/or corporate culture can be gleaned

quickly by viewing a person’s online identity.