Information Security Awareness Training for Employees

Introduction:

Even the best information security policies, procedures, or controls are useless if employees are tricked not to follow them. Through 'social engineering', cybercriminals aim to do just that. Enjoy this sample of a training course which explores common social engineering techniques, and the information security awareness training countermeasures to defeat them. It was designed for broad deployment across a sponsoring organization, at a low per-user cost. This sample is limited in that it describes various social engineering techniques, but it does not provide any security awareness training countermeasures. The techniques covered include: surveillance, shoulder surfing, eavesdropping, dumpster diving, phishing, baiting, piggybacking, tailgating, identity theft, and pretexting. Consider licensing the full course (at https://www.opensesame.com/c/social-engineering-information-security-awareness-training-quiz-training-course) to maximize your organization's investment in information security by empowering and enlisting every employee to help defeat cybercrime!

Course Objectives:

- Foster cybercrime awareness amongst employees.

- Emphasize the duty of employees to help prevent cybercrime.

- Emphasize the importance of adhering to organization policies & procedures.

- Train employees to recognize social engineering techniques.

- Train employees to respond with social engineering countermeasures.

- Task employees to apply what they've learned.

Course benefits:

- On-demand.

- Brief and focused.

- Low per-user cost.

Supports the information security awareness training requirement of many regulations and frameworks:

- Health Insurance Portability & Accountability Act (HIPAA / HITECH) [45 CFR §164.308(a)(5)]

- Federal Information Security Management Act (FISMA) [4 U.S.C. §3544(b)(4)(A)/(B)]

- Sarbanes-Oxley Act (SOX)

- Gramm-Leach Bliley Act (GLBA)

- Payment Card Industry Data Security Standard (PCI-DSS)

- ISO/IEC-27001 ("Information Technology: Security Techniques, Information Security Management Systems")

- ISO/IEC-27002 ("Code of Practice for Information Security Management")

- National Institute of Standards & Technology Special Publication 800-50 ("Building an Information Technology Security Awareness and Training Program")

Course components:

- A narrated training presentation.

- A post-training competency assessment.

Policy agnostic:

- While employees are trained in good practices, they are explicitly instructed to learn and follow institutional security policies.