-: User education,
you know being in IT would be great if it wasn't
for all the users.
My job as a security professional would be so easy
if there weren't any users.
I've heard people say this stuff all the time.
The problem is we have to realize in IT,
we're in customer service,
if there were no users, there'd be no need for our network,
and we'd be out of a job!
So, it's important that we have these users.
The problem is, users are our number one vulnerability
in the network, as a security professional,
I can install all the technology I want,
but if I don't fix the user, it's all going to be for nothing.
I can put firewalls and intrusion prevention systems,
and host based security systems and all sorts of other
stuff to protect my network,
but if the user clicks okay or accept,
and let's the bad guy in, it's just going to go
right through all of it, right?
Think about when we talked about a firewall,
a firewall blocks things from coming in from the outside.
But, when you're using a stateful firewall and somebody
goes to a website, it actually opens a port on
the firewall, and requests them to come back in.
And that means if you go to a malicious website,
it can go in through your firewall that way, right?
And so this is something you have to make sure
you're training your users.
There's a lot of things we need to cover when we're
talking with our users.
Some of the big basics here.
First, teach them to never give out
their authentication details.
That means don't let people give our their passwords,
their PIN numbers, showing their ID badges from their
company that people can make copies of,
giving out their security tokens like their RSA key fobs,
or their smart cards, none of that, never share details
of your authentication or your authentication systems.
Next, any time you're entering in a PIN number
or a password, you want to make sure people can't see
what you're doing.
Think about it, if you went to the ATM to go
take out $50, you're going to make sure nobody is seeing you
putting your secret PIN number, right?
I know I kind of put my hand like this to make sure people
can't see it, that's the idea here.
You always want to shield those key pads,
the same thing when you're entering in your PIN number
for a smart card, or you're entering in your
password on your machine.
Also, you want to make sure your organization sets up what's
known as a clean desk policy
and you want to enforce this.
Now, what's a clean desk policy?
It means at the end of the day, your desk is clean.
All of your files and folders should be put away
in locked drawers, that way, when you leave the building,
nobody can come in and look through your files.
Next, you want to screen your e-mails and your phone calls
carefully and you want to keep a log of any events
that seem suspicious to you.
So if I call out and asking you questions about how
you get your shipments or how people get into your company,
or what kind of toner you're using,
or any of those other pretexts that I may use,
you want to log that and let your security personnel know.
Another thing you want to train your users,
is how to protect their e-mails
and they do this by using encryption.
You as the technical person are going to set up that
encryption, you're also going to set up encryption for
your voice calls, through voipt.
And you're also going to set up encryption for data at rest,
data in transit and data in use
but you have to train your users on
how to use that encryption.
So, that's on you to make sure they're getting that
in their annual training.
Also, you want to train your users to never pick up
and never make use of any removable media.
If you find a DVD, a CD, or a thumb drive on the floor
or in the parking lot, they should take it to security
and it should be disposed of, it should never be plugged
into your system because that might have malware
and malicious things on there
that are going to infect the network.
Also, when you're dealing with physical paper,
want to make sure that physical paper is shredded
when you're not needing it.
So any sensitive information doesn't just go in the trash
or recycling, it gets shredded first.
That includes things like phone lists, personnel records,
password logs, anything like that.
All of it needs to be shredded.
Next, you want to make sure you're complying with
company policies for data handling and disposal
and teaching those policies to all of your users.
So when you start talking about data handling and disposal,
how are we going to destroy things
when we no longer need them?
How are we going to get rid of hard drives
that are no longer needed by the organization?
Are we going to format them?
Are we going to wipe them?
Are we going to degouze them?
It all depends on your policies,
whatever those policies are,
make sure people in the organization know it
and you train that to your users.
When you're doing things for shipment,
you want to make sure you're preventing diversion theft.
How do you do that?
You track those shipments and you know when they're
coming and where they're going.
And finally, teach your users good web security.
Any time they're using a web browser,
they need to be extremely careful.
Anything they click on could be bringing malware
into your organization
so you want to make sure they understand
what is allowed and what isn't.
And personally, I prefer inside your organization
if you use a white list approach to using the web.
That means you give them authorized sites they can go to
instead of trying to block sites that they can't go to.
Because when you try to block sites that they can't go to