Book Image

Information Security Handbook

By : Darren Death
Book Image

Information Security Handbook

By: Darren Death

Overview of this book

Having an information security mechanism is one of the most crucial factors for any organization. Important assets of organization demand a proper risk management and threat model for security, and so information security concepts are gaining a lot of traction. This book starts with the concept of information security and shows you why it’s important. It then moves on to modules such as threat modeling, risk management, and mitigation. It also covers the concepts of incident response systems, information rights management, and more. Moving on, it guides you to build your own information security framework as the best fit for your organization. Toward the end, you’ll discover some best practices that can be implemented to make your security framework strong. By the end of this book, you will be well-versed with all the factors involved in information security, which will help you build a security framework that is a perfect fit your organization’s requirements.
Table of Contents (19 chapters)
Title Page
Credits
About the Author
About the Reviewers
www.PacktPub.com
Customer Feedback
Preface

Training


In our modern era, human interaction is a key vector used to exploit an information system. Whether you are looking at attacks such as ransomware, or exploits against critical infrastructure, the easiest avenue into a system is by tricking the user to run a piece of software. The key way that we can make sure that our users are prepared for these attacks is by implementing an effective training and awareness program.

Key components of an effective training and awareness program

An effective training and awareness program is necessary to ensure successful implementation of your information security program. A training and awareness program will be the primary mechanism used to communicate organizational user roles and responsibilities from an information security perspective:

  • Secondary media products:
    • This includes things like giveaways (squeezy balls), alert notifications, posters, or social media.
    • These serve to remind users about information security principles that you are communicating through other mechanisms.
    • The key here is to keep information brief and manageable. If you need to read for more than ten seconds, it is too long.
  • Primary media products:
    • This includes things such as email newsletters, websites, and inclusions in corporate magazines.
    • These have more contact and are distributed on a periodic basis.
    • The key here is to not overwhelm the user. If you send out an email newsletter every week, you may find your newsletter in the spam folder.
  • Yearly information security awareness training:
    • This is training provided every year, where you communicate all of your information security requirements for the user into a single presentation
    • The preferred method for implementing this training is computer-based, through a learning management system:
      • This helps you to easily record users that have completed training and their scores
    • This training should include a mechanism to test the users' understanding:
      • The test should not be an information security vocabulary test:
        • The user should know not to click on URLs and attachments they do not trust
        • The user does not need to be test on the difference between phishing or spear phishing
    • Use the yearly training as an opportunity to have your users validate or revalidate their acceptance of your organization's acceptable use policy:
      • The training should cover every aspect of the Acceptable Use Policy
  • Events:
    • This includes lunch time presentations, webinars, and presenting at corporate, divisional, or team meetings
    • It is very important to deliver the information security message to your organization in person where possible:
      • Webinars are useful in geographically-distributed organizations
    • Getting 15 minutes to speak at the finance or HR teams quarterly meeting is a great way to answer questions that an entire group may have

For example, payroll and benefit processors may have questions on PII handling and protections.

References: