Security Awareness Training at your workplace?
Discussion
Hoping the mods will leave this here because I really want answers from people who use IT but may have zero interest in IT...
We need to put in place an ongoing programme around security awareness relating to IT, so in layman terms telling people how to help keep themselves and in turn the business secure by not doing things like clicking links, opening dodgy emails etc.
There are a number of approaches from locking people in a room and making them watch computer based stuff and testing them as they go through to getting people in to do stuff in person and everything in between.
What does your employer do and what do you like about it and what don't you like about it?
We need to put in place an ongoing programme around security awareness relating to IT, so in layman terms telling people how to help keep themselves and in turn the business secure by not doing things like clicking links, opening dodgy emails etc.
There are a number of approaches from locking people in a room and making them watch computer based stuff and testing them as they go through to getting people in to do stuff in person and everything in between.
What does your employer do and what do you like about it and what don't you like about it?
I worked for a local authority housing department from 1997 to 2008; obviously there was 9/11 during this period, following which we were all issued latex gloves for opening suspect mail.
One colleague was noted to be wearing said gloves in the office soon after 9/11, we asked him why? "I'm opening my emails!" was his deadpan reply
.
Security awareness training? Not as per the OP, no
.
One colleague was noted to be wearing said gloves in the office soon after 9/11, we asked him why? "I'm opening my emails!" was his deadpan reply
.Security awareness training? Not as per the OP, no
.We have in-house compulsory online training to be filled out every year.
It's like one of those pre-flight videos you get on Virgin planes and teaches you all the things you need to know.
It takes a good 15 minutes.
You then get a series of multiple choice questions.
Should you fail, you have to start all over again. There's no fast forward.
We have these for Health and Safety as well as Security.
Don't do them and you'll get marked down for any pay review that year.
It's like one of those pre-flight videos you get on Virgin planes and teaches you all the things you need to know.
It takes a good 15 minutes.
You then get a series of multiple choice questions.
Should you fail, you have to start all over again. There's no fast forward.
We have these for Health and Safety as well as Security.
Don't do them and you'll get marked down for any pay review that year.
b
hstewie said:
hstewie said:Trabi601 said:
We have a combination of online training and deliberate 'phishing' type emails sent as tests by IT.
Do you know who the provider is please? Do you like it (as that kind of thing goes)?I don't mind it - just find it a pain having to renew every couple of years.
toasty said:
Don't do them and you'll get marked down for any pay review that year.
We have a slightly different approach. Non-completion gets escalated to manager and their manager.You then have to explain in your review why you haven't completed the easy 15 min mandatory training. I can't sign off staff reviews if they haven't completed them and that impacts bonus payments.
Draconian - maybe - but it's client data as well as company data at risk.
I have either my desktop (in house) or my laptop (in the field) on all day every working day. I travel all over the world using the laptop on various hotel and customer's WiFi systems. Often use 'rogue' USB keys and receive many emails from unknown sources.
The computers are protected by a simple password and free AVG.
In 8 years I have had one virus attack which was lurking in an email from our head office!
I often wonder if the seriousness of viruses etc. is exaggerated by those seeking to sell software or services to 'protect' our computers?
The computers are protected by a simple password and free AVG.
In 8 years I have had one virus attack which was lurking in an email from our head office!
I often wonder if the seriousness of viruses etc. is exaggerated by those seeking to sell software or services to 'protect' our computers?
PoleDriver said:
I have either my desktop (in house) or my laptop (in the field) on all day every working day. I travel all over the world using the laptop on various hotel and customer's WiFi systems. Often use 'rogue' USB keys and receive many emails from unknown sources.
The computers are protected by a simple password and free AVG.
In 8 years I have had one virus attack which was lurking in an email from our head office!
I often wonder if the seriousness of viruses etc. is exaggerated by those seeking to sell software or services to 'protect' our computers?
Depends on your company. We have serious, targeted and sustained attacks on us on a daily basis, as do many of our clients including, but not limited to:The computers are protected by a simple password and free AVG.
In 8 years I have had one virus attack which was lurking in an email from our head office!
I often wonder if the seriousness of viruses etc. is exaggerated by those seeking to sell software or services to 'protect' our computers?
DDoS
Virus / Malware / Ransomware (Ransomware is a b
h at the moment)Social engineering
We don't like spending money, but it is a critical issue that we have to mitigate.
PoleDriver said:
I have either my desktop (in house) or my laptop (in the field) on all day every working day. I travel all over the world using the laptop on various hotel and customer's WiFi systems. Often use 'rogue' USB keys and receive many emails from unknown sources.
The computers are protected by a simple password and free AVG.
In 8 years I have had one virus attack which was lurking in an email from our head office!
I often wonder if the seriousness of viruses etc. is exaggerated by those seeking to sell software or services to 'protect' our computers?
The seriousness certainly isn't exaggerated, the risk of it happening to you almost certainly isn't as well.The computers are protected by a simple password and free AVG.
In 8 years I have had one virus attack which was lurking in an email from our head office!
I often wonder if the seriousness of viruses etc. is exaggerated by those seeking to sell software or services to 'protect' our computers?
Keep in mind though that often at home scammers want your money, at work it may be that or depending who you are they want your employers data (or to prevent them being able to access it with things like Cryptolocker and other variants).
Anyway, be fascinated if anyone can remember/share the actual providers they're using or being sent to to do this stuff.
Mandatory online training regarding data protection.
Social engineering consultancy send phishing type emails and attempt to physically get into work areas and pinch stuff off desks.
If you leave your screen unlocked when you leave your desk and the data protection officer spots it, you're likely to find your computer has had its language setting changed to something unintelligible by the time you get back.
Noticeboards above each printer with regular security reminders on them (gives people something to read whilst they're waiting for their printing to come out).
Social engineering consultancy send phishing type emails and attempt to physically get into work areas and pinch stuff off desks.
If you leave your screen unlocked when you leave your desk and the data protection officer spots it, you're likely to find your computer has had its language setting changed to something unintelligible by the time you get back.
Noticeboards above each printer with regular security reminders on them (gives people something to read whilst they're waiting for their printing to come out).
bhstewie said:
hstewie said:Fittster said:
And who has mandatory online training where you just press next, next, next without looking at the screen to complete the course so the firm can put a nice tick in a box?
Which whilst we need a tick in box, is what I don't want us to be doing.Gassing Station | The Lounge | Top of Page | What's New | My Stuff