Social Media Safety

 

 

The Top 5 Social Media Threats ;

  1. Hidden URLs 

    – These are quite common, often times leading to a site that then asks for login information.

  2. Requests 

    – Someone may send you a warning or a request to take action or follow some link. Do not be fooled by these people, they will often try to manipulate emotions to get victims to react without thinking.

  3. Fake online surveys and contests 

    Take this quiz to find out X!” These sort of posts on social media are effective bait to lure users into unsafe sites, where cyber criminals may install malware, spyware, or gather your information to misuse.

  4. Fake customer service accounts – 

    Scammers on social media often pretend to represent legitimate organizations in order to steal sensitive information.

  5. Live Streams

    – Luring users to scammer ran websites with the promise of being able to view sports games, movies, etc…Once they have lured victims to their sites, they install malware, spyware, or get users to input credit card numbers. After all this they almost never even have the live stream they claimed to.

 

Security Awareness Training & Education Program, Crucial Elements to Incorporate

Does your organization take security awareness seriously? Would your employees be able to defend against social engineering attacks? Is the effectiveness of your organizational security frequently tested? You should be answering a resounding “Yes” to all of these questions.  If you answer “no” or “I don’t know” this may be a sign that your organization has serious security vulnerabilities. The following is a high level overview of important elements in an effective security awareness training and education program.

 

Executive Support

This should be pretty obvious but is nevertheless quite important. When creating a security awareness program, you need to garner the support of C-Level decision makers.  How can you gain their support? Simple. Most CISOs, CIOs, CTOs, etc.… are experienced in information security and already know that the vast majority of security breaches are due to human error.  Furthermore, having a security awareness training and education program in place is often a legal requirement. So if you come to them with a solid plan, solving issues and making their life easier, they should (hopefully) be quite receptive. Now that you have the executives involved, employees lower down the chain will likely follow suit.

 

Establish a Security Awareness Baseline

Establish a baseline by staging phishing attacks (of various types), testing employee awareness. The metrics gained on each employee will not only help to identify who is putting your organization at risk but also quantify the success of your security awareness program over time. When conducting your baseline, it is important to stage attacks of varying difficulty (Nigerian, Spear, etc…)

 

Ongoing Training

Security awareness training and education is steadily moving away from the binge training of the past. The problem with binge training as we all know and have most likely experienced, is that we are forced to memorize questions and answers for a test once a year (or longer) and then slowly forget about it.  Nowadays, organizations develop SATE (security awareness training and education) programs to be ongoing and therefore significantly more effective.

 

Make Training Relatable

Demonstrate to employees how poor security practices can lead to harm not only for the organization but also to themselves, by clearly articulating the risk associated with specific actions. Keep the training short and to the point, teach users by using emotion when possible. Security awareness training should incorporate phish from real life attacks. By doing this you will know that your employees can fend off what is currently being used to attack other organizations in your industry. When you hear about a real attack currently targeting your industry – launch that attack against your users first before the bad guys do.  Remember if you aren’t attacking your users then only the bad guys are.

 

User Insight

Knowing specifically which individuals are putting your organization at risk is incredibly important. With this knowledge you will be able to give attention to the employees that need training and education the most, while minimizing disruption to those that behave securely. Furthermore, this metric can be of great value to management in decision making processes involving access and privileges.  Any respectable Security Awareness Training and Education Program should at a minimum answer the following questions;

  • Who are my high risk employees?
  • Who are my most secure employees?
  • Do I have any employees with high level access who are high risk?

 

Measure Everything

You will use this data to create two types of secure reports. One that is a concise overview, which C-Level executives often prefer. The second report should be a more in depth version that shows details of how each employee is performing in various areas. Examples of metrics to maintain for each user, which help to continuously improve your SATE program include;

  •  Retention
  •  Focus
  • Engagement
  • Risk
  • Severity of Risk
  • To What Types of Phish is Each User Most Susceptible

 

Customize

Ok, so this one is not absolutely necessary but is huge a plus if you can pull it off, with the metrics now in hand, the data can be used to enhance user learning significantly. Use metrics such as relapse frequency to indicate how often each employee should be training. User focus will tell you how long training should be and utilizing Phish Susceptibility Type can help you decide which type of phish will be most effective for training each employee.

Information Security Awareness Tips from a Newborn

While the linked post may be stretching a correlation, the points are accurate, entertaining, and what Information Security loving expert doesn’t want to buy that onesie.  The top tip, Putting in only 45 minutes a year is bad, PeopleSec is in full agreement.  A single 45-minute training a year is not a good practice.

Phishing with emotion and stress results in bad choices

Recently on one of my personal sites, I received the below phishing attempt:

Phishing

I see a ton of phishing examples as part of PeopleSec’s Security Awareness Training and Education (SATE) program.  It is not often a phish in the wild catches my eye and looks like anything other than spam.  This email is an excellent example.  It causes stress that invokes an emotional reaction which in turn solicits an emotional response.

“Emotions can cloud our judgment and influence our decisions when triggered by the [stressful] situation at hand,” stated by Harvard Business Review (https://hbr.org/2015/05/dont-let-emotions-screw-up-your-decisions).

Emotional responses are at the core of successful social engineering and phishing attacks.  As an aside, the success of emotional responses is why we use so many of them in PeopleSec’s SATE program.

In summary, it is hard to keep emotions in check, and they cloud your ability to think.  So when you are stressed and emotional, Think Before You Click.

 

Social Engineering Attacks Driving Security Awareness

Social engineering and cybercrime are on the rise around the world. Business owners need to pay attention to current trends in the world of information security (infosec).

In 2005, the United States Bureau of Justice Statistics reported that 60 percent of American companies had detected at least one instance of cybercrime. Tech giant IBM believes that businesses are much more likely to be targeted by cyber attacks than they were 10 years ago.

Despite the sophistication of today’s infosec strategies, the global cost of cybercrime is expected to elevate to $6 trillion on an annual basis by 2020.

The Human Aspect of Infosec

Business executives who are concerned about the security and integrity of their information systems, should start paying more attention to their greatest source of weaknesses and vulnerabilities: their own employees.

Some of the most brazen and successful cybercrime groups take pride in their their social engineering prowess. In mid-September, the FBI arrested two suspects believed to have gained access to the email accounts of CIA Director John Brennan and National Intelligence Director James Clapper. These criminals are part of the cybercrime outfit known as “Crackas with Attitudes”.  They tricked government intelligence employees into giving them username and password credentials by pretending to be Verizon technicians.

Through a series of telephone calls and electronic communications, malicious actors gain entry to networks. These threat actors also harvest key information about how a business operates; this is known as social engineering, and it is something that average employees may not be familiar with.

Preventing Social Engineering Through Security Awareness

One of the greatest weaknesses of infosec is that it often falls short in terms of outreach and employee engagement. IT security procedures are often presented and enforced in a stern and ominous manner. This does not appeal to employees because they don’t know much about it.

Practicing good infosec in the workplace comes down to awareness. Malicious hackers overwhelmingly target employees because they know that the average worker does not know much about infosec. Companies cannot expect entry-level clerks to be familiar with social engineering and read their CIO subscriptions during lunch breaks.  

Employees do not realize that they can unwittingly become attack vectors because they lack situational awareness. In other words, they are not familiar with how cyber-crime groups operate.

Security awareness programs in the workplace need to go beyond drilling employees on their knowledge of infosec policies. Staff members must know why it is important to protect the information of their company, their customers, and their colleagues. The best information security measures will not help a company if employees remain vulnerable. Starting with simple steps can get most employees moving in the right direction.

7 Steps for Success with Security Awareness Training and Education (SATE)

The term “company culture” is a buzzword that has been floating around for the last few years. While that brings to mind images of ping pong competition and in-office happy hours, there’s another element of company culture on the rise: security. Even companies with the best product or service can fail with a weak security culture. The best way to prevent this is by creating a strong security awareness training and education program, often called a SATE program for short.  A strong SATE program is important. If you’re wondering where to start, here are the essential components of a good plan.

A Plan for the Plan

Sounds redundant, right? You can’t put together a good plan without a plan. Some companies opt for long-term plans that span a year or more, but using a shorter 90-day plan is more effective. This allows you to reinforce what you’re teaching employees, while reevaluating goals to see what is most effective every few months.

Remain Realistic

Part of putting together a strong security awareness training and education (SATE) program is being realistic. Clearly there are something things that just will not be tolerated, but banning all social media, for instance, is unrealistic. Chances are, employees will spend some time on social media, particularly if your company leverages social media marketing. Instead of hoping people will stay off, offer useful tips on how to minimize security risks while using social media.

Creativity is Key

Companies with big budgets might find putting together a plan a lot easier than smaller companies on a tight budget. For small companies, that just means using a little creativity. For example, during the next team building event, set up a booth with common security violations. Teams that can identify all of the violations the fastest win a prize, the points, etc.

Mix Up the Materials

Being creative also means using mixed materials to drive home the main components of the program. Too many companies think just sitting employees in front of standard security modules is enough. Aside from being boring, this type of teaching often doesn’t help people retain the information. Consider using varied materials like blogs, games, and newsletters.

Partner Up  

Creating a successful security awareness training and education (SATE) program requires working with other departments like marketing and human resources. Often, these departments have interests that crossover with your own. Instead of trying to do it alone, reach out and see how you can work together. The outside input will also help bring new and fresh ideas to the table.

Get the C-Suite Involved

Pretty much any project backed by a C-Suite will be easier to pursue—it will also be easier to get other departments involved. This can be more challenging in bigger companies, and you might have to settle for senior management. In small companies, however, you might start by creating special materials or a presentation highlighting why implementing a security awareness training and education (SATE) program is important.

Measure and Metric

You only know if your efforts are successful if you measure them. Before setting the ball in motion, you will need to get a baseline of employees’ awareness. This can even include taking the temperature of people’s attitudes toward security. It is also important to know how many security incidents have occurred prior to the program. Then, as you start to implement phases of the plan and see measurable results, you can share those with the C-Suite as justification for the program and your efforts.

 

Why Implement a Security Awareness Training Program?

Security systems are only as strong as their weakest link. When it comes to modern information security, that usually means humans. Even the best security system is defeated when a user gives away their password. The way to prevent this is by making sure everyone in the company has an adequate level of security awareness.

What Can Security Awareness Accomplish?

The primary purpose of security awareness training is ensuring that everybody in the company understands how to avoid security breaches. Hackers can still do some damage even if everyone does everything right, but it makes their job a lot harder. Employees who learn to recognize the warning signs of an attack can also take steps to minimize the damage. Which includes making sure that they don’t do anything to make it worse before the security professionals solve the problem.

Understanding is Important

Some companies try to save time by giving their employees a list of rules to follow in order to prevent problems. Instead they should be  teaching them about security risks. That approach is better than nothing, but it suffers from a few fundamental problems.

People who follow a strict list of rules without understanding why they are in place cannot deal with unexpected situations. Even people who make every effort to follow rules to the letter can have trouble when they run into something that the rules do not cover. Nobody can hope to think of every problem that could possibly happen when they write a list of rules, so this problem is inevitable.

Of course, not everybody is going to follow the rules perfectly. People tend to ignore rules that they think are arbitrary. This can make it hard to achieve perfect compliance without teaching employees why the rules matter. Any company that takes the time to explain why each rule is relevant can probably get better results by teaching a broader understanding of information security issues.

Why Security Awareness Training and Education is Important?

Keeping up with the changing modern security landscape, by providing Security Awareness Training and Education (SATE), is vital to business owners. Not only do professionals need to stay on top of potential security threats on the outside, but also within the company. When employees have access to all types of data, business owners need to make sure to optimize their security approach. This is crucial in protecting the company’s information and assets. In today’s modern age, the introduction of cyberspace has revolutionized business processes. Unfortunately, this has also opened up companies to a variety of concerns, including phishing and information leaks. Therefore, the right Security Awareness Training and Education (SATE), sometimes called Cyber Awareness Training, is paramount to the success of the business. 


Security is Never Guaranteed 

Taking the extra steps to move towards comprehensive and reliability human security is a must because the company’s security is almost never guaranteed. The behavior of the company’s employees will always affect information and data breaches. Many business owners were surprised to learn that so many threats from the inside could occur as a result of accidental information breaches. While employee mistakes may be the biggest source of data breaches in the country, it is also one of the best ways to prevent outright losses as well. Everything begins and ends with the company’s employees.  It is up to business owners to educate employees with proper Cyber Awareness Training. 

Practicing Awareness 

It is just not feasible to turn system processes off. Connectivity is a must in today’s day and age. However, it can be made easy to train employees in practicing proper security awareness. One of the best ways to improve long-term information security and protect the company from malware and other internal threats is to invest in good Security Awareness Training and Education (SATE). The right educational processes can have a tremendously positive effect on your business. Even more so if business owners have a smaller group that focuses on security. 

Awareness is the Law 

Staying aware of potential security risks is not just an important aspect of managing the company. Moreover, it is a legal requirement. There are numerous regulations that require for business owners to stay on top of their cyber security. Even more so, if business owners work in a certain sector. Examples include the federal government, the healthcare industry or any variety of financial institutions. Investing in the appropriate cyber security training can allow professionals to avoid potential legal issues as well as company breach problems. Staying on top of the security basics allows owners to hedge their business investment against all types of long-term problems and concerns. 

Applying Training Programs 

In order to successfully transition from a weaker cyber security model into a stronger ones. It is crucial for business owners to organize application-specific training and general support system training for the business. These procedures assure that business owners improve overall awareness. They also specify exact programs and procedures as they apply to the company. Additionally, refreshers make sure that that employees keep up with technological changes in the workplace.

Starting a successful Security Awareness Training and Education (SATE) program starts with a few easy steps.