-: User Awareness Training.
Users are our biggest threat to our networks,
but they're the whole reason we have networks
in the first place, right?
So we have to make sure we train our users
on what is and is not acceptable on our networks,
because that will help secure our networks
more than any other thing.
In fact, studies have shown that
proper security training for your users
is the most cost-effective control that
you can apply inside your organization.
All the firewalls, all the intrusion detection
and protection systems, all the antivirus in the world,
all those technical controls, they won't do any good
if your user's going to open up the door
and let the bad guy right in, so you've got to
make sure you train your users on
what is and is not allowed on your networks.
So, some of the areas you want to discuss
inside your training is things like
your acceptable use policy, what is
and what is not considered acceptable.
Are they allowed to bring in CDs
and listen to music at work?
Well, that also brings a threat, right,
so you may or may not want your drives
to be allowed to read or write music or read or write CDs.
What about USB film sticks, are you allowed to use those?
What about taking data home and working on it there?
How about playing on Facebook, is that allowed?
All of these things are part of your acceptable
use policy and should be discussed as part
of your annual security training.
You also want to talk about things like
threats that are facing the organization.
Maybe you guys have been recently
targeted for spearphishing attacks or phishing attacks
or any of numerous other scams that are are out there.
These are things you want to make sure
your employees know about so they can protect themself.
You also want to talk about what do they do
when they report a security issue.
Who do they call and how do they put it in?
Is there a 800 number you guys call 'cause
you're a huge organization or do they just run down
the hall and get the IT system guy, right?
This is going to depend on your organization,
so you want to make sure they know
how they can report an issue.
You also want to talk about physical security concepts,
things like locking the door behind them,
only badging in themself if you use RFID badges
and not letting somebody piggyback.
All of these security concepts that I know
you're already aware of but your users, they're not,
so make sure you train them on them.
What about Bring Your Own Device?
Does your company allow you to bring your cellphone
and connect to their wireless network?
Well, that's a thing that you're going to have
to think about and decide are you or are you not,
but whatever the answer is make sure you train
your users on how they can protect your network
if they are bringing in their own device
or keeping those devices off your network.
The next thing we want to talk about
is data handling requirements.
How are they supposed to store data?
Do they need to encrypt the files?
Do they share them to a share drive or on the local machine?
Do they save them to a disc?
Can they print them out?
What are your requirements?
All of that is information that you need
to tell your users and finally give them
best practices for emails, passwords, remote work,
secure web browsing, and all these other things.
For example, should their password be upper case,
lower case, special characters, at least 14 characters?
That's a best practice, tell them to do that, right?
Tell them not to use their dog's name
or their birthday or any of that kind of stuff,
because those are the easy ways to crack things.
Remember, you as a cyber security professional
are probably the smartest guy on this information,
and so you need to pass that information to your users
and usually we'll do that as an annual training
or some kind of online learning and design program
that you guys will make everybody watch at your office.
It just depends on how your office wants
to go about doing it.
And the last thing I want to talk about,
just more specifically, is spearphishing and phishing.
Remember, spearphishing and fishing
is one of the huge threats against our networks.
We talked about that all the way back
in Domain One of the CSA course,
but it is also one of the most effective ways
that bad guys are getting in your networks.
So if I create a really convincing spearphishing email
and send it to your users and they click on that link,
it opens the port to the firewall
and lets my malware come in, right?
You've got to make sure you shut that stuff down.
You can do that through email filtering
with technical controls, but that's not 100% effective,
and so really the best thing is teaching your users
all about phishing and spearphishing and how to detect it
and not click those links in emails.