Employee Security Awareness Tuesday, April 9, 2019 Louis Stramaglio IT Ops Supervisor

Are You Vulnerable? What is the greatest vulnerability in your organization? Electronic Security Perimeter IT Network OT Network Permissions Physical Security

YES! Employees End users Clients Customers Contractors

Question Does your company have an Employee Security Awareness Program?

IT Security Program Understand and comply with company security policies and procedures Be appropriately trained in the rules of behavior for the systems and applications to which they have access Work with management to meet training needs Keep end users aware of actions they can take to better protect their company’s information

Security Program Contents Security Policies Designed to protect the data Business needs Known risks 2. Define responsibilities Who is responsible Staff responsibilities IT/Security responsibilities 3. Establish Processes Monitor the program Review results IRP(Incident Response Plan)

Question Do you believe your current Employee Security Awareness Program has Management Buy-in?

Management Buy-in Support Budget Reporting Feedback

What is Awareness? Not training Addresses concepts and behaviors Terminology Informational

Best Asset/Biggest Vulnerability

Create the Awareness Plan Strategy and Plan Feedback from key groups Assess current materials Create a baseline Review current metrics Analysis of findings and recommendations Current trends Prioritize Schedule, but remain flexible Make it “So Number One”

Ransomware

We Are Done, Right? Awareness

We Are Done, Right? Awareness Training

Who Needs Training? Stay flexible End users IT Executives Everyone Training everyone equally doesn’t always mean training everyone the same way. Stay flexible

Where Does Training Come From? In-house LMS Outsource

NOW We Are Done, Right? Awareness Testing & Education Training

Why Test Me? Measure your success Report your success to management Remember, stay flexible Prioritize weak points, add new content Continue the cycle

Participant Challenge Obtain Management buy-in Create your awareness plan based on your IT Security Program Generate a security baseline and prioritize Train everyone Test everyone Stay flexible and prioritize

Lou Stramaglio IT Ops Supervisor lstramaglio@wecc.org