5.6 User training

Question 1

Security awareness training

Answer 1

• Before providing access, train your users– Detailed security requirements
• Specialized training– Each user role has unique security responsibilities
• Also applies to third-parties– Contractors, partners, suppliers
• Detailed documentation and records– Problems later can be severe for everyone

Question 2

User guidance and training

Answer 2

• Policy/handbooks– Document all security requirements– Provide access online in policy guidelines– Reference the policies in the employee handbook
• Situational awareness– Users should always be looking for threats– Software attacks: Email links, attachments, unusual
  URLs, text messages, etc.– Physical attacks: USB drives in a FedEx envelope,
  unlocked building doors, etc.– Be ready for anything
• Insider threat– Difficult to guard against– Add multiple approvals for critical processes– Monitor files and systems as much as possible– It should be very difficult to make an unauthorized
  change
  © 2023 Messer Studios, LLC
• Password management– Many standards to choose from– Guide users with standard requirements
  (length, complexity, etc.)– This is often controlled using technology (Group Policy)
• Removable media and cables– Unknown USB drives can contain malware– Unknown cables can be connected to a
  malicious system
• Social engineering– Extensive and ongoing training– The attackers are very good– The users are your front line defense
• Operational security– View security from the attacker’s perspective– Users need to identify sensitive data– Keep the sensitive data private
• Hybrid/remote work environments– Working at home brings unusual security risks– No access to family and friends– Additional endpoint security– Security policies for VPN access