69

(I am not sure, if this question fits the security.stackexchange-board, but the list of askable topics does not exclude this question imho and there are some examples)

I've worked for several different companies of which some had outsourced their IT-department. This means that the people at the company mostly use technology, but have no deeper understand of it, especially when it comes to security.

Therefore I was toying with the idea to offer 1 or 2 small workshops / trainings, so they can get at least an idea of WHY computer security is important and WHAT exactly is important. I would like to do this because I think, human knowledge should be shared, no matter the recipient and both sides might learn. My colleagues might understand security better and I might understand their point of view better.

So I sat down and tried to come up with a list of necessary and useful topics, keeping the target audience in mind.

Am I missing topics, should there be other topics? What is necessary to learn, when you deal with computer security?

Topics:

  1. Why computer security? (Costs, Ransomware stopping a complete company, ...)
  2. Passwords (What is a good password, how to store, never use same PW on different accounts, ...)
  3. Lock the screen when leaving the workplace (Because...? Did not find good examples of what could happen, also is this a high priority?)
  4. Should I show a hacking example to visualize what it is? For example older phones / tablets are crackable pretty fast with open source software.
  5. Social Engineering (2 colleagues got a call and became victims to the CLSID-Scam, door gliding, USB sticks in the parking lot, ...)
  6. Internetsecurity (NoScript, deactivate Flash / JS, what's phishing, ...)
  7. Backups
  8. Email encryption
  9. Protective measures (keep OS updated, use antivirus-software, dont use the admin-account as a default, ...)

I dont know which topics should be mandatory and in which order. The training might take 1 or even 2 hours. I would also create some cheat-sheets, so they can take away some written information, further reading etc.

Community
  • 1
hamena314
  • 2,007
  • 1
  • 15
  • 23
  • 8
    Relating to 3. you can pull some numbers on how many crimes are done by insiders. And how it would be an life-changing issue if a real security issue was tracked down to an innocent person that had his user do act X while he was fetching coffee. I am sure many would not want to spend prison-time for forgetting to hit Windows + L. – Simply G. Apr 06 '16 at 11:51
  • @SimplyG. I thought kind of the same, but did not find a good example. If the worker leaves his place unlocked, another user could use his computer and do...X? While X would take only a short period of time (surfing to a special website) and have a high impact. – hamena314 Apr 06 '16 at 11:56
  • On #5 I'd definitely also mention spear-phishing, which seems to be more and more common (http://krebsonsecurity.com/2016/02/phishers-spoof-ceo-request-w2-forms/) – Fluffy Apr 06 '16 at 11:59
  • 3
    Find a flash drive with a virus in its firmware, then demonstrate it with a test computer. Starting off with a demonstration that "nothing is benign" can easily prime people to think about all the benign things they do... – iAdjunct Apr 06 '16 at 13:22
  • 4
    This question is very, very broad. What to cover in a corporate sec awareness program is up to the business objectives of the organization, the technical level of the audience, and the resources available. How to present security awareness is up to all those factors plus a lot of other factors, including culture, demographics, etc. – schroeder Apr 06 '16 at 19:12
  • 1
    It might help if you provided some criteria or what specific effects you hope to achieve from awareness training. For instance, you don't mention phishing. Is there a reason for this omission? Have you looked at free online resources that provide SecAwareness materials? – schroeder Apr 06 '16 at 19:15
  • 1
    You could take a look at the us govt's basic computer security training for ideas. It's an ~2hour interactive flash program that covers basic operational security (ex don't let the random person banging on your office door in), as well as basic computer security. It's a few years old (flash based, has a phone that looks like a blackberry, etc) but gives good, if on the paranoid side, basic coverage. (Unless you've worked with it before, skip the part on protecting classified info, you won't have the vocab to understand it.) http://iatraining.disa.mil/eta/cyberchallenge_v3_fy15/launchPage.htm – Dan Is Fiddling By Firelight Apr 06 '16 at 20:48
  • 3
    #3 - A "good" hacker could steal your identity with 90 seconds on your computer. Forward a bunch of sensitive documents from your machine... Copy all your passwords you have stored in your browser... etc. – mkingsbu Apr 07 '16 at 01:10
  • @schroeder: I did not think of a complete program over several days or even weeks. I'm just doing a short project in this company and will then be gone to another. But you are right, the target audience alone is a huge parameter. ... For the phishing part: in point 6, last entry I mentioned "What's phishing". – hamena314 Apr 07 '16 at 07:23
  • 1
    @iAdjunct if you like that kind of things, why not use the so-called USB Slayer? See https://www.indiegogo.com/projects/usb-slayer#/ (I'm not affiliated with this guy). You might want to buy another computer, though. – A. Darwin Apr 07 '16 at 12:05
  • @A.Darwin that's not particularly helpful for hacking a computer though... Unless you're comparing it to hacking with an ax. – iAdjunct Apr 07 '16 at 13:04
  • 2
    @iAdjunct I was both kidding and suggesting that this may be a more impressive way to teach people that "nothing is benign". Moreover, imagine that your company had an unprotected webserver, managed by an incompetent admin. If someone convinced the admin to insert a USB Slayer into the webserver, wouldn't the result be a complete loss of integrity? I agree that it is a very crude attack, but then even a DoS attack can be considered so. – A. Darwin Apr 07 '16 at 13:16
  • @A.Darwin - good point. Plus, left in a parking lot, somebody might think it's just a flash drive - and statistically plug it into a corporate network. – iAdjunct Apr 07 '16 at 14:05
  • 1
    One thing i have noticed people do not understand the concept of automated. So tend to think security in terms of human speed. It would be a good idea to show them that with little effort a simple task the audience can understand can be replicated thousands of times within a timeframe where a human does not have time to do anything. Once thy understand this they begin to understand why they would be targetted. – joojaa Apr 08 '16 at 08:32
  • @iAdjunct *"Find a flash drive with a virus in its firmware"* Have you ever found one of those fascinating marvels/abominations of technology? I haven't - it's all been shoddy malware that resides in executables, jars, pdfs and what have you. I've never been close enough to a high value target for anyone to attempt NAND hacking or some low level stuff of that calibre (or maybe I just didn't realize it) but I'd be curious to see an example of it. – jDo Apr 09 '16 at 14:53
  • Like the deactivate Flash idea in particular – RedEagle2000 Apr 09 '16 at 21:09

7 Answers7

42

I actually did a presentation similar to this a little over a year ago, and spent quite a bit of time deciding how to structure it. My target audience did include developers and other people quite knowledgeable in IT, but also managers and other non-programmers, so I tried to keep it fairly general, and not to technically complicated. As someone else pointed out, I think one important thing is not to come across as boring; you want this to be an enlightening talk that helps people realize that this is something they ought to keep in mind, and not just another list of dreary tasks that will get in the way of actual work.

To this end, I tried to center the whole presentation around the concept of security culture instead of jumping straight into too many technical details. With that in mind, I still managed to touch upon many of the themes you mention in your question.

Some of the stuff I mentioned in my talk

(or would touch upon today if I was to hold another similar talk):

  • Confidentiality, Integrity and Availability (CIA): The central themes of information security, and a few should-be-obvious words about why these are important both to your company, and to individuals (if you can give people a little guidance that will help them stay safer beyond the workplace too, then that is only a plus, right? It might also make some pay more attention to you too - especially if you touch upon the safety of their kids/family too).
  • A few words about the concept of "security culture" ("culture" as in "a set of ideas, habits and social norms, common to a specific group of people", or something like that, and the idea that security awareness should be a conscious part of this).
  • Goals of thinking about security: Reducing the risk of unwanted incidents, preparing to handle them if / when they occur anyway.
  • Keeping cost in mind (or return on investment if you like); thinking about what measures will be easiest to get started with, and which make the most sense. I would include a few words about good habits here; such things as update your systems, use good passwords, and avoid clicking suspicious links, be conscious of physical security (tailgaters!) etc. Perhaps include a few examples from real-world events, including screen shots of news articles about breaches, etc?
  • Throw out a few questions related to what type of vulnerabilities or threats might be relevant to your particular company, and more. Examples: What are the "crown jewels" of our business? What is most important to us, and what may threaten them? How secure are we today, how secure would we like to be, and how can we get there in the future? In what areas would we want to improve our security stance? The point here is not to give people a checklist of things to do, but to get them thinking about the whole realm of security in general, and help take responsibility for parts of it, themselves.
  • Give a few examples of typical security guidelines, and ask your audience if any of them (or similar) should be considered for your workplace.

Oh, and one more thing: Including a few appropriate real world examples of security problems will help keep your audience entertained (but don't overdo it).

I don't know if this is exactly what you were after, but I hope it may be of some use. Good luck with your presentation.

Kjartan
  • 999
  • 11
  • 17
  • 2
    Did you include threat modeling in the talk, or is what what you meant with the second to last bullet point? – forest Apr 07 '16 at 00:10
  • 1
    @forest Not really, at least not in any detail. I only touched uponit by providing a few off the top of my head-examples of areas where we might have room for improvement. In essence, my message was as follows: "*Security is important. Do we know enough about it, or should we perhaps to try to do some proper threat-modeling to clarify our own security stance, and consider further steps?*". – Kjartan Apr 07 '16 at 07:44
16

None of the existing answers mention this and its too long for a comment even if its not a thorough answer.

One thing you will absolutely need to avoid engendering in your audience is nihilism (i.e. I will get hacked no matter what I do). Its quite easy to scare people s@#$less (and temptingly entertaining depending on circumstances). But big part of selling security culture, as you put it, will be convincing the audience that meaningfully improving security is both a) not overly painful and b) possible.

All too often the attitude I encounter especially among millenials is that security is impossible, or if possible then so difficult as to be unworkable. Hell, I know better and still feel that way at times myself.

I recommend that each real world example (whether story or live demo) be presented with some easy steps (preferably 'step' singular) to avoid the same fate.

Jared Smith
  • 1,978
  • 1
  • 10
  • 12
  • 3
    I think this is a very important point I will definitely include! My colleagues, that got their accounts hacked, were too embarassed to tell anyone for 2 full days since "being hacked" might mean that they did something stupid like using a bad password. Would the hacker be smarter or more evil, he could have done a lot more things. When you get attacked, you need to stay calm and try to mitigate the damage as much and as fast as possible, while analysing what happened and close that security hole. – hamena314 Apr 07 '16 at 07:17
  • 1
    Exactly. Dispel some FUD. – Jared Smith Apr 07 '16 at 14:02
  • 2
    That said, it may very well be that "security culture" is a net loss. There was a great paper on the topic by Microsoft Research - http://research.microsoft.com/en-us/um/people/cormac/papers/2009/SoLongAndNoThanks.pdf You don't want to ignore security, but you want to put much of it *outside* of the competence of the actual user (e.g. the system admin should maintain proper certificates etc.). I don't want to simplify the paper, but it's basically an issue of risk-reward analysis and opportunity costs, as well as the practicality of much of the security advice. – Luaan Apr 07 '16 at 14:18
  • 2
    @Luaan after reading the abstract I'd say that despite the age of this question and number of extant answers you should probably write an answer with data from the paper as a cautionary counterpoint. – Jared Smith Apr 07 '16 at 14:21
  • 1
    @Luaan: The paper was quite interesting ("dancing pigs!") as it had some ideas that others might find controversial. One of the main points is that we train users to ignore overly complicated rules to harden the security, which in turn often has the contrary effect. I think, Jared Smith's advice to write a controversial answer might bring some valuable points to this question! – hamena314 Apr 13 '16 at 13:24
  • 1
    One of the tactics you might use to avoid scaring your audience is to use an analogy of old fashioned physical security. You cannot stop a motivated thief from stealing a car or breaking into a house. But you can make it harder for them than someone else's car or house. Security is never absolute, and there are almost always mitigations you can use when the worst happens. Backups to restore a nuked system. Insurance for a stolen car. Life doesn't come with a safety guarantee; shit happens. In self defense classes the most important thing to teach is not specific techniques, it is awareness. – Mark Ripley Jul 30 '16 at 09:06
6

It's so unreal for them
that the only way to have it stick
is by showing them by real life example.

Ask them: Who knows what phishing is?
Ask them: So what kind of information leaked would be Problematic?
They say: If document ThisIsImportant.doc with accounting info about customer C would be leaked.
Ask them: Who has access to ThisIsImportant.doc?
They say: Patrick

Then tell them: SO, lets all together send a phishing email to Patrick pretending to be Patrick's boss!

Open Terminal (with green font, important!) in front of their eyes.
LIVE "Hacking"! They Love it!

1) ssh into the mail-server
2) touch mail.txt
3) vim mail.txt 

To: partick@yourCompany.com
Subject: Patrick, I need customer C info.
From: Patricks Boss<patricksBoss@yourCompany.com>

Dear Patick,
I'm a little bit in a hassle, as customer C just called.
Please send me ThisIsImportant.doc so I can prepare a response.

Best regards,
Your BOSS!

4) :x!
5) sendmail -vt < mail.txt

Now ask Patrick to open his email and everyone will see an email form Patricks Boss that you wrote in front of their eyes.

Lesson Learned for them:
They should not blindly follow a Name/Brand/Uniform/etc. and use common sense.

After that you can tell them all the other stuff because now they believe you how real it actually is.

A year later however, they will still tell the story of how you "hacked" partick by impersonating his boss.

MPS
  • 911
  • 1
  • 7
  • 12
  • 1
    Very good example; I agree this would *definitely* get across. Wondering, though, why you bother to `touch mail.txt` before opening it in `vim`? :) – Wildcard Apr 08 '16 at 04:09
  • I'm not a legal, but I wouldn't do this without being authorized at least by Patrick's boss. – A. Darwin Apr 08 '16 at 20:41
  • @A.Darwin, if Patrick is in the audience, I don't see why it would matter. – Wildcard Aug 08 '18 at 02:50
3

On the one hand you say you want to run workshops while on the other, you dive into some some quite hard-core topics with people who have limited knowledge of security. While I applaud your efforts, if it were me I would be looking to raise awareness and get people thinking about security rather than just presenting death-by-powerpoint / something which comes across as another tick-the-box compulsory training compliance exercise.

I'm not suggesting you shouldn't talk about all the things you've listed, but if you spend a day just on these you're going to bore your audience. OTOH if you can win their hearts and minds, then they'll think about security in their everyday work.

Exploring how they might be attacked as private individuals is one way to address this. Another is to get them to plan an attack on an arbitrary target.

symcbean
  • 18,278
  • 39
  • 73
  • Which topics would you consider hard-core? And yes, not becoming boring might be one of the biggest challenges there. – hamena314 Apr 06 '16 at 14:09
  • @hamena1234 I think #4 could be considered hard-core by a non-technical audience. – A. Darwin Apr 06 '16 at 18:35
  • @A.Darwin: Hm, I thought more of it as a demonstration "I will start this tool ... and 20 seconds later I have access to your device.". The recent iOS bug, which gave people access to the pictures on the phone by simply using SIRI and NO password might be such a demonstration. I do not want to show the people how to program a buffer overflow or any such detail. – hamena314 Apr 07 '16 at 07:19
  • 1
    @hamena314 I wasn't thinking about buffer overflows, at all (that would be an overkill). I personally think that explaining how a tool works could be more satisfying than simply showing what the tool can do (which at times may look like black magic), and if this is the case, there are some attacks which require some technical knowledge. However, if you think your audience can be satisfied by explaining that certain attacks exist and by showing a brief demonstration, you should go for it. You could try, for example, by showing a phishing attack. – A. Darwin Apr 07 '16 at 07:50
2

Show them a Password Manager like LastPass or KeePass.

Most everyone I know has a TON of user ids and passwords. To help remember them they do things like use all the same passwords, write them down on sticky notes, or store them in unencrypted text documents.

Instead show them how to use a password manager. I showed a few of my non-IT friends how to use LastPass. Now they use a very strong passphrase to get into the password manager and let it manage all their logins. They love it!

Adam Dewing
  • 41
  • 1
  • 1
    I'm pretty sure this question is about professional security *training*, not about teaching your friends how to be a bit more secure from some dude logging into your email and stealing your nudes. – forest Apr 07 '16 at 00:08
  • 9
    If one of the topics is "What is a good password, **how to store**, never use same PW on different accounts", then the audience is clearly on a level where explaining password managers makes sense. – Guntram Blohm Apr 07 '16 at 06:39
  • My company's IT security team actually provides a password manager and online training for it for use in our enterprise environment. It's a small part of their overall security plan apparently. – Adam Dewing Apr 07 '16 at 19:52
2

Generally speaking, the more security measures you can abstract away from the user - the better!

For example:

  • File storage should, if available, be done on a centralized server. Assuming you have resources with sufficient competence to set this up correctly, it is easier to maintain company-wide backups done by trained people than teaching each employee how to do private backups (and getting them to remember to do it!)

  • If your environment supports it, use Windows Domain / Active Directory management policies where applicable (for example to introduce screen timeouts with password-only unlocking, or enforcing password length/character content as well as periodic password changes).

Comments to your suggestions:

1. Keep it simple - computer security = protecting your firm's assets. Information is power and information may even be money in a more direct sense (trade secrets, etc). Your specific argument will depend on what kind of work your company does and what/how you store it, but the essence should always be that unauthorized access to a computer system can do great damage to your company, either by destruction or theft (or both).

2. Definitely do this, but as mentioned earlier, use technical tools to enforce as many rules as possible to lessen the responsibility on the end-user.

3. Absolutely! It's not a very common attack vector, but it's one of the easiest "fixes". Therefore, it should be implemented immediately. Put up reminders near the workstations or at the exits.

4. Avoid this unless you can find specific examples that your employees can directly relate to (because you use the same hardware/software, or something similar). If you go this route, KISS - don't get lost in technical jargon. Use general concepts and non-technical terms as much as you can. Spend less time on explaining the problem and more time on describing the correct behavior for the user.

5. This can easily be among the most dangerous attack vectors and simultaneously the one that is hardest to teach your employees how to guard against. Save it for last - you want your employees to embrace the "security-minded culture" before you delve into this particular topic. The more they already know and think about safe procedures and the importance of ensuring authorization and correct protocols, the easier it will be to understand how a third-party can try to sneak past these barriers.

6. Definitely - use group policies to block Flash, Active-X, or enforce NoScript, etc., if at all possible! Again, the more of these mitigations you can add without the user having to do or manage anything, the better.

9. Again, if you can do this centralized, it would be all the better. Judging by your question, it sounds as this may not be the case for your company?

As for the order - I would recommend the same order as the problems might arise in. That is to say: 

user login (passwords, lockscreen) 
  --> program startup (viruses, backups) 
    --> program use (phishing, social engineering, "bad" downloads/attachments).
Vegard
  • 243
  • 1
  • 6
  • Very interesting ideas, I especially like point number 9 ... I could even start a step earlier: Leaving the car in the parking lot (dont pick up suspicious USB sticks), entering the building (dont let people tailgate you) etc. Seems like my "collegue Bob" will have a work day full of hacking attacks and we will watch him recognize and defend against them! (Having some sort of avatar experiencing those events might help people to get another point of view) – hamena314 Apr 07 '16 at 11:59
  • 1
    If you think it is a real threat, you can start as early as when the employee wakes up in the morning! Any caller or email arriving to the employee's personal phone/inbox/doorstep asking about work-related things, even inconspicuous ones, should be redirected to the relevant Chief, etc. – Vegard Apr 07 '16 at 12:06
1

I think kjartan's answer is spot on, but in more general terms of security awareness training there are just a few main components

  1. What are you protecting? Information, data, and knowledge - the drivers of every aspect of your business.
  2. Why does it need to be protected? CIA + non-repudiation. I think it's important to explain why it's important that users not share credentials.
  3. How users can help you protect it. Simply a few basic rules about not clicking links, giving out information, picking up flash drives and plugging them in - the basic stuff.
  4. Examples of incidents that happened and the associated cost in monetary and reputational damage.

If you need to go further than that, it's a great idea to explain what policies & procedures are and why they should be followed. Put it into simple terms for non-IT and non-business driven individuals. And then put it into business terms for the higher tier of employees and how what has been agreed upon has been deemed the correct level of security and business operations (e.g. Why these things exist besides just being an obstacle that they need to overcome to simply do their job). I think that's the key that regular users struggle with - "just let me do my job!"

Community
  • 1
Raystafarian
  • 135
  • 6