- Exemplify the Concepts of Confidentiality, Integrity, and Availability
- Explain Risk-Related Concepts
- Carry Out Appropriate Risk-Mitigation Strategies
- Explain the Importance of Security-Related Awareness and Training
- What Next?
This chapter is from the book
This chapter is from the book
This chapter is from the book
Explain the Importance of Security-Related Awareness and Training
- Security policy training and procedures
- Personally identifiable information
- Information classification: sensitivity of data (hard or soft)
- Data labeling, handling, and disposal
- Compliance with laws, best practices, and standards
- User habits
- Threat awareness
- Use of social networking and P2P
One of the most powerful tools available to a security administrator is the body of network users, who might notice and draw attention to unusual access methods or unexpected changes. This same body of users also creates the greatest number of potential security holes because each user might be unaware of newly emerging vulnerabilities, threats, or required standards of action and access that must be followed. Like a chain, a network is only as secure as its weakest link—and users present a wide variety of bad habits, a vast range of knowledge, and varying intent in access.
User Education
User education is mandatory to ensure that users are made aware of expectations, options, and requirements related to secure access within an organization’s network. Education can include many different forms of communication, including the following:
- New employees and contract agents should be provided education in security requirements as a part of the hiring process.
- Reminders and security-awareness newsletters, emails, and flyers should be provided to raise general security awareness.
- General security policies must be defined, documented, and distributed to employees.
- Regular focus group sessions and on-the-job training should be provided for users regarding changes to the user interface, application suites, and general policies.
- General online security-related resources should be made available to users through a simple, concise, and easily navigable interface.
User training should ensure that operational guidelines, disaster recovery strategies, and operational mandates are clearly conveyed to users and refreshed regularly. Policies may also require refresher training during transfer between organizational components or job duties under the rotation policy. Details such as information classification, sensitivity of data and handling guidelines, legal mandates, best practices, and standards can vary widely between organizational units with the proper protocols for access, storage, and disposal varying accordingly.
User Habits and Expectations
Security awareness training is also key to managing user habits and expectations developed due to the prevalence of computing equipment at home and in their mobile devices.
Passwords
Users must be instructed in the value of their access credentials and the impact that could result from sharing their passwords and logons, using weak passwords (and the ability to identify a strong password), easily guessed passwords and expectations of password expiration schedules to avoid filling up the call center the first Monday morning every 90 days.
Data Handling
User training should address legal or regulatory requirements for accessing, transporting, storing, or disposing of data and data storage devices. This includes encryption systems for mobile and removable storage devices, data access logging requirements under laws such as HIPPA, and review of the retention and destruction policy.
Clean Desk
Training should include details of the organization’s clean desk policy, encouraging users to avoid jotting down hard-to-recall passphrases or details from electronic systems that might contain PII. Users should also understand why taping a list of their logons and passwords under their keyboards is a bad idea.
Situational Awareness
User training should encourage situational awareness at all times. Unbadged individuals wandering in secured areas should be challenged, tailgating at check-points (following an authorized individual in closely to avoid having to provide personal authorization credentials) should be prevented, and guidelines for handling other forms of physical and logical security violations must be conveyed and practiced.
Personal Technologies
Common mobile computing devices, removable media storage key fobs; file-sharing systems such as Dropbox, Box.com, or SkyDrive; peer-to-peer transfer services; and even browser-based social media solutions and games can all introduce a range of vulnerabilities and threat agents to an enterprise without requiring elevated privilege or special equipment. Users must be given training in the proper use of their various personal technologies (or reasons to not use the technologies). Because this area is constantly evolving, convey reminders and updates in the regular security-awareness newsletter.
Users must be trained in critical consideration before providing logon credentials to any service, particularly those that bring personal data interaction into the work-place. Social media services are increasingly used for business purposes, so separation of business and personal accounts become critical in the event of a legal motion for discovery that could otherwise require access to personally controlled data resources. Social media services accessed through encrypted web access also offer a route through which protected information could be inadvertently disclosed without passing in readable form through normal boundary content review systems.
Peer-to-peer (P2P) services also present a danger to intellectual property and system availability protection by allowing direct connections between random endpoints using a wide variety of protocols and service ports, making firewall and packet-shaper management much more difficult for technicians and potentially sharing otherwise secure data stores to unknown parties as in the case of a misconfigured P2P client such as BitTorrent. P2P encrypted data streams can also result in contraband content being placed on a system within an organization without proper review, potentially exposing the organization to legal action based on the type of contraband.
Threat Awareness and Zero-Day Threats
Emergent viruses, worms, Trojans, rootkits, phishing attacks, and other threats should be identified and conveyed to users as rapidly as possible before dozens of calls come in asking why the “I Love You” email didn’t show its attached greeting card properly when opened. Personalized spear-phishing attacks are becoming more prevalent, requiring vigilance on the part of the users to avoid the natural response of opening everything that seems to be coming from their family members, boss, or co-workers. This must be tempered, though, as the million-plus new viral versions every year will rapidly overwhelm users into a state of helplessness or disinterest in the face of apparent inevitability. When a new Zero-Day threat emerges that has not been specifically considered in response planning, the same communication channels can be used to alert users of actions being taken by the IT group to correct, recover, repair, or patch systems and data.
Cram Quiz
Answer these questions. The answers follow the last question. If you cannot answer these questions correctly, consider reading this section again until you can.
Which of the following is not going to be part of a standard password policy?
A. Establishing a minimum password length- B. Selection of a strong password
- C. Establishing password expiration schedules
- D. Barring keeping written passwords
When conducting data handling training and reviewing disposal practices, what consideration must be primary?
- A. Breaches of health and safety protocols
- B. Remnants of data that may remain accessible
- C. Accidental disposal of equipment that is necessary to read archived legacy data
- D. Disposal costs and penalties arising from regulatory mandates
_____________ training teaches users not to download links from social media sites.
- A. Data handling
- B. Clean desk
- C. Situational awareness
- D. Personal technology
- When an employee discovers someone wandering around a secured area without a badge or escort, which user-awareness training topic should provide them with knowledge of the proper response?
- A. Data handling
- B. Clean desk
- C. Situational awareness
- D. Personal technology
Cram Quiz Answers
- D. The clean desk policy includes details regarding written residue of passcodes, PII, and other sensitive data that might be jotted down during normal business. Answers A, B, and C are all incorrect because the question asks which is not a part of the password policy, and all three would be found in the password policy: password length, strength criteria, and password duration before expiration.
- A. Because of the materials involved in the manufacturing and construction of electronic equipment, health, and safety protocols take precedence over the other considerations. Health and safety must always come first. Answer B is incorrect because it is concerned with data confidentiality. Answer C is incorrect because it is concerned with data availability, and answer D is incorrect because it focuses on risks and costs arising from regulation.
- D. Personal technology training should cover social networks, peer-to-peer networking, and mobile technologies owned by the employees but present in the workplace. Answer A is incorrect because the data handling training would be focused on how to manage data stored on organizational systems rather than personal ones. Answer B is incorrect because the clean desk policy provides guidance for data sanitization of the work environment. Answer C is incorrect because situational awareness training involves developing strategies and skills for dealing with physical access violations and similar events rather than addressing which personal technologies are appropriate and how they should be used properly.
- C. Situational-awareness training focuses on strategies and skills for dealing with physical access violations, variations from normal operational routines, and similar events. Answer A is incorrect because data handling training is focused on how to manage data stored on organizational systems rather than how to deal with unauthorized personnel in secure areas. Answer B is incorrect because the clean desk policy provides guidance for data sanitization of the work environment to protect against unauthorized data disclosure should an unauthorized individual gain access. Answer D is incorrect because personal technology training provides strategies for dealing with personal technology and services within the organizational enterprise environment.