Security Training USAID 2000

Information Security

W H Y ?? u Two Reasons: –It’s a responsibility –It’s the law (Computer Security Act 1987)

Training Objectives u What is Computer Security u The Threats u What is your role as a user?

Computer Security u Definition Measures required to protect against: – unauthorized access (accidental or intentional) – malicious modification of data –destruction of data, networks and computer resources –or denial of service to process data.

Data Classifications lCLASSIFIED (CONFIDENTIAL, SECRET, TOP SECRET)  SENSITIVE BUT UNCLASSIFIED (TECHNICAL, PROPRIETARY, PROGRAM SPECIFIC) lUNCLASSIFIED

Computer Security u Confidentiality u Integrity u Availability

Workstation Protection (1) u Comply with the physical security requirements.

u Never leave your computer unattended while you are logged in –log off at the end of the day u Protect sensitive information –store it in a private area Workstation Protection (2)

Password Requirements –Passwords must be at least six characters (alphanumeric) e.g., I8NY2x Dog&Man3 –Passwords must be changed periodically USAID - Cairo requires every 12 weeks Treat Your Password Like A Toothbrush… Don’t Share It, and Change It Often!

Password Protection u NEVER disclose your password! u Personal passwords must remain private –Don’t let anyone else use it –Don’t write it down –Don’t type a password while others watch –Don’t record password on-line or it –Don’t use easily guessed words, like children’s names, spouse, pet, birthday and phone number

Virus Protection u Run antivirus programs on a regular basis. u Do not use any outside floppies/ disks on your system without running a virus scan first. Many viruses are introduced because virus scanning was not performed. u No illegal duplication of S/W rule - this reduces the spread of virus and avoids legal headaches u Do not boot from diskette if possible

Data and File Backups u Backup your important data u Verify your backups

Internet Security u Do not download and install programs from the Internet without consulting DMS –for example, screen savers, chatting programs u Do not remove the Security wallpaper. This is an Agency requirement u Do not pass on Chain Letters, rumors and jokes

What is the Mission doing to minimize Risk? u Server Protection u Workstation Protection u Firewalls u Backups u Training