Security Awareness and You

1
Security Awareness and You

• Its not just an IT problem!

2
Agenda

• Security Awareness What is it?
• Policies
• Security and You
• Getting things started

3
Security Awareness -- What is it? What does it do?

• Security awareness helps people
• understand the threats that exist in their
  environment
• understand the steps they need to take to guard
  against them

4
Goals of Security Awareness

• Change attitudes and behaviors
• Typical Attitude
• Security is an IT responsibility
• Security is an annoyance
• Typical Behavior
• People choose ease over security
• Get everyone involved
• Organization wide effort

5
Benefits of Security Awareness

• Helps users avoid potential security threats
• Reduces the number of security incidents
• Reduces the amount of time spent on recovery

6
Policies

• A Security Policy is the foundation of security
  for any organization.
• Definition -- http//searchsecurity.techtarget.com
  /sDefinition/0,290660,sid14_gci548251,00.html

7
Why security policies are important

• Security policies outline responsibilities and
  expectations
• Security policies guide behavior
• Security policies clearly detail
• Whats allowed
• Whats not allowed
• Penalties for non-compliance

8
Why people ignore security policies

• Security policies often conflict with the way
  people do their job.
• Some people believe policies dont apply to them.

9
What does security have to do with you?

• Security is everyones responsibility.
• Everyone has an obligation to act in the best
  interests of their organization.

10
Is security part of your day?

• Do you know where to find your organizations
  security policies?
• Do you know what to do if a security incident
  occurs?

11
What are your security habits?

• Could people enter your work area and get access
  to your PC, laptop, PDA, phone, personal items,
  etc.?
• Have you ever left sensitive information out in
  the open?
• Do you lock your workstation when you leave the
  area?
• Do you log off and shut down your workstation
  when you leave for the day?

12
REMEMBER

• Were all potential victims

13
Getting things started

• Identify Responsibilities
• Pick realistic targets

14
Responsibilities

• Users are responsible for
• User Password
• User Email Account
• User Workstation/Desktop
• Physical Security (building, office, etc.)

15
Realistic Targets

• Pick realistic targets
• Concentrate on a few threats
• Make sure policies are in place
• Make sure consequences for non-compliance are
  spelled out

16
Passwords

• Why is password security important?

17
Passwords

• What can happen if you dont have a strong
  password?
• What can happen if you give your password to
  someone else?

18
Email

• Why is Email Security Important?

19
Email

• Viruses
• Keep Anti-virus software up to date
• Phishing
• http//www.fraud.org/tips/internet/phishing.htm
• http//securities-fraud.org/phishing-attacks.htm
• http//www.antiphishing.org
• Identity Theft
• http//www.ftc.gov/idtheft

20
Dont be a spammer.

• Hoax Resources
• http//www.snopes.com
• http//www.breakthechain.org/
• http//hoaxbusters.ciac.org
• http//www.synergypublishing.com/emailhoaxes.htm

21
Workstation Security

• Why is Workstation Security Important?

22
Workstation Security

• Updates/Patches
• Anti-virus/Anti-spyware
• Locking desktop

23
Physical Security

• Why is Physical Security important?

24
Physical Security

• Building
• Your work space (cube/office)
• Laptops/PDAs
• Personal Belongings

25
Reporting a Security Incident

• Trust your instincts
• Reporting suspicious activity could actually
  prevent a security incident.
• Who
• Who can report a security incident? Who should
  you call?
• What
• Gather as much information as possible.
• When
• The sooner the better!
• How
• Phone, Email

26
Expect hurdles and roadblocks

• Introducing change is an immense task and usually
  involves challenging ideas and habits that have
  survived the test of time.
• Security awareness is ongoing.

27
Quick Security Checklist

• Use strong passwords
• NEVER share your password
• Use caution when opening email attachments
• Limit physical access to your computer
• Lock your computer when not in use
• Verify that your antivirus software is up-to-date
• Verify that patches and updates are applied on a
  regular basis
• Report security incidents

28
Questions