Why is this called “the ostrich effect”? “In many companies the security of information rests precariously on the honesty, integrity and care of the staff, and nothing else.” Why is this called “the ostrich effect”? If you have read the module, you will be able to explain to the audience the relevance of the person who made this statement. M11, P15 – Are You Sufficiently Prepared to Meet the Threat?

A 2009 Ponemon Institute report revealed that over 50% of disaffected employees target company information as they prepare to depart. Might this happen in our company, or are we different because all of our employees are contented? How can we begin to address this problem by technical and non- technical means? This slide is designed to elicit discussion. You should have the answers in your head, and you can provide them in writing in the accompanying handout. M11, P42 – Sources and Motivations of Malicious Insiders

Could it happen here? This slide is designed to elicit discussion. You should have the answers in your head, and you can provide them in writing in the accompanying handout. It is an alternative to the one shown previously. How do we protect out databases? Are there any weaknesses in our approach? M11, P42 – Sources and Motivations of Malicious Insiders

Social engineering emails seek to get you to click on links in order to steal your private information. This message is designed to trick recipients into infecting the network. What awareness programmes to we have in place to reduce the risk of users clicking on infected links? This slide is designed to elicit discussion. You should have the answers in your head, and you can provide them in writing in the accompanying handout. If you know how, you could replace this with a phoney email from one well-known person to another. They are easy to create. M11, P37 – Social Engineering

What are these and where might you find one? Is there a company procedure to check the connections on the back of our computers? You can reinforce the point that many such devices have been planted by cleaners and guards, they are left for a few days, and then removed by the perpetrator. If you go to the internet, you will find case studies of where they have been used. M11, P34 – Technical Surveillance

You can reinforce the point that M11, P34 – Technical Surveillance

Which of these presents a better opportunity to today’s information thief? The answer is obviously the right image. It takes effort to copy the documents on the left, but the unattended laptop can be “data-slurped” using a flash drive in under a minute. M11, P39 – Data Slurping

Company Information Security Policy Extract W O R D “All user-chosen passwords must be difficult to guess. You must not use: Words in a dictionary, derivatives of userIDs, names of celebrities, obscene words, and common character sequences such as 12345. Personal details such as birthdays, spouse’s name, car licence plate, social security number or employee number, and birthday. Any part of speech. For example, proper names, geographical locations, common acronyms and slang.” A key element of awareness is company policy, so your presentation should include this. Don’t try to present it all; just take selected extracts. The best passwords are those that include a mix of upper- and lowercase letters, numbers and non-alphanumeric characters. Company Information Security Policy, Section xyz

Company Information Security Policy Extract W O R D P R I V A C Y “All identifying information about customers and staff, such as bank account details, credit card information, credit references, background checks, dates of birth, email and postal addresses etc., must be accessible ONLY to those Company personnel who need such access in order to perform their jobs.” An interactive way to introduce the meaning of the CIA Triad. To share such information with other parties, or to inadvertently or negligently disclose such, may put the Company in breach of data protection legislation. Company Information Security Policy, Section xyz

Let’s go around the room and agree on an action point that each participant is going to take away today…. This is a different approach to Q&A. Q&A has a tendency to place the speaker as the expert and is less empowering of the audience. This approach is better at empowering the audience and it reinforces the key points.