Security Awareness Training

Here’s a blog post by Simon Herring of Ubersecure which describes how (during an authorized penetration test) he was able to “persuade” a helpdesk agent of a large company to reset his password by pretending to be a salesman in a panic. Once the password had been reset, he was able to log in to their Outlook Web Access system, open a ticket requesting VPN access and, ultimately, gain access to their entire computer network.

Obviously, this is a case where training helpdesk staff about social engineering attacks, and having well-understood procedures for handling urgent requests is critical.

In a blog post last year – The Second Year and Beyond – I described how we recommend the use of a refresher course to fulfill the annual training requirement of regulations such as HIPAA, GLBA, PCI DSS …

Using a refresher course means that students:

• don’t have to repeat the training that they took the previous year; and
• are only taken out of the workplace for a short period of time compared to the more extensive training they receive at the beginning of the program.

Continue reading →

I’ve seen a number of security awareness training programs run into problems when the designers of the program didn’t take into account the limited time that students have. Here are some things to think about when planning your program.

Continue reading →

You have the right subject matter, and a sound plan for presenting your materials. But, like it or not, cost is a major consideration when putting a security awareness training program in place.

Initial price is often the thing people focus on most, but it’s seldom what causes a program to fail. I’ve seen quite a few awareness programs fail because they just cost too much to run on an ongoing basis.

Here are just three of the ways that I’ve seen awareness training programs fail because they were too expensive.

Continue reading →

It’s that time of year again – when fraudulent and nuisance emails, and online hoaxes and scams start making the rounds even more quickly than usual.

Sophos has posted a warning about one such hoax spreading rapidly on Facebook where users are warning each other about a “Christmas Tree” virus – said to be carried by a rogue Facebook application. Here’s a example of the message that’s being circulated:

WARNING!!!!!! ….. DO NOT USE THE Christmas tree app. on Facebook. Please be advised it will crash your computer. Geek Squad says it’s one of the WORST trojan-viruses there is and it is spreading quickly. Re-post and let your friends know. THANKS PLEASE REPOST!

A little research (perhaps a search on a reputable site like Snopes.com) would quickly show that this is a hoax. But that doesn’t stop the message being widely distributed by worried Facebook users, and, at this point, the hoax is probably spreading faster than reports of genuine Facebook viruses (maybe because it has an easy-to-remember name rather than the obscure names given to viruses by software companies?).

Even if you’ve banned the use of Facebook and other social networks, similar hoaxes and scams are likely to be circulating by email in your organization. And they’re often very disruptive in the business environment if they’re distributed widely, and can also make it more difficult for you to warn users about real threats that they might face.

So, what should you do?

Continue reading →