Our employee awareness
and training critical.
Your security is generally implemented
through user behavior and employee behavior and activity.
An organization needs to train the
employee on how to properly do their job, know how to defend themselves in the
organization against threats, to follow security policies, who to
contact in the event of a breach or security threat,
can identify the nature of the database on data classification, protecting physical
and informational assets in the organization.
There's a couple of different flavors of security training.
You have education, awareness, and then training.
Really quickly, awareness is general awareness.
Hey, there's these things called phishing emails, or hey, there's
spam, or people impersonating help desk over the phone, etc.
So general awareness.
Training is specifically training you how
to do your job in accordance with the policy.
And then security education is
something you employ typically for training an employee for a job role that
they may ascent to or something that exceeds their current skill.
All right, employee awareness, security policy.
Policy training teaches employees how to
perform their duties to comply with security policy.
I just talked about that.
Physical security.
Proper training should be given to educate employees about physical security.
Don't let people in with your ID badge, for example.
Maintain general awareness of parking lot areas, stay in well lit areas.
Don't allow people to look over your shoulder, etc.
Train increases the knowledge and awareness about physical security.
Helps to minimize data breaches,
identify elements that are more prone to hardware theft, assess the risks handling
sensitive data, ensure physical security of the workplace.
All right, awareness and training.
Social engineering.
Social engineering is one of our biggest
security concerns because people are easy to deceive and con, plain and simple.
So the areas of risk that need to be addressed
over the phone and email are the two primary social engineering attack vectors.
So either call up on the phone,
impersonate help desk, network support, or whatever, or send you an email, a phishing
email, and you do some pretty scary stuff with email.
Now, you're going to be doing a phishing email creation in one of your labs.
You'll be using a utility called the
Social Engineering Toolkit for that, and you'll be pretty amazed how easy it is
to clone a login page and steal credentials.
Dumpsters.
You also want to be certain not to throw anything sensitive into the trash.
Shredding documents before putting in the trash or erasing magnetic data.
Data classification.
I may not have access to top secret
information, but I should certainly know that that is sensitive information.
And if I see something laying out on a coffee table in the lobby with a label of
proprietary on it, I know that's not right.
The organization should train employees on
how to tell if information is confidential.
The typical information classification levels, again, top secret, secret,
confidential, sensitive, unclassified, restricted, unclassified.
These are military classification schemes.
There's also private.
Security labels are used to mark the level
requirements for assets and controls to access it.
Those are both logical and physical.
Organizations use labels to manage access clearance to information assets, primarily
in a mandatory access control model, which we will talk about.
All right, and that's going to wrap up our
module for Module 5 for Network Security Controls of the Administrative Variety.