Security Training and Awareness Brad Reed, IT Security Analyst OIT – Information Security Office Securing the University – ITSS 2015

Our Mission Security and Awareness Activities at Ohio University

Training Guidelines  The training and awareness model will be a centralized model per NIST SP definition (All responsibility resides with a central authority). o The authority will fall under the direction of the OIT Security department with the bulk of the responsibilities centered on the security analyst(s).

Audience and Scope  The audience will consist of all levels and type of users within the Ohio University network. This should encompass and include any entity (local or third-party) having access or interaction with Ohio University OIT systems and data. This scope allows for various trainings and awareness activities to ensure the security of the Ohio University data and digital infrastructure.

Central Authority Training Model

Training Categories  As defined in NIST SP Section 2 and SP800-16, the IT Security Learning Continuum provides a multi-level approach to the types of educational activities offered by this program. All activities should be classified and documented into the following categories: o Awareness o Training o Education o Professional Development

Awareness Awareness is not training. The purpose of awareness presentations is simply to focus attention on security. Awareness presentations are intended to allow individuals to recognize IT security concerns and respond accordingly.

Training Training strives to produce relevant and needed security skills and competencies.

Education Education integrates all of the security skills and competencies of the various functional specialties into a common body of knowledge... and strives to produce IT security specialists and professionals capable of vision and pro-active response.

Professional Development Professional development is intended to ensure that users, from beginner to the career security professional, possess a required level of knowledge and competence necessary for their roles. Professional development validates skills through certification. Such development and successful certification can be termed “professionalization.” The preparatory work to testing for such a certification normally includes study of a prescribed body of knowledge or technical curriculum, and may be supplemented by on-the-job experience.

Proactive vs. Reactive Security and Awareness is meant to be a proactive security function Bring Awareness to potential threat agents Inform and train users of new security functions and procedures A means to move information and communicate with users Deliver new security issues to the community Open a two way street for security concerns and communication

Awareness and Training Cycle

Cycle

What Do We Offer for YOU

Security Office Offerings Securing the Human awareness modules Securing the University training or awareness modules Face-to-Face Awareness or training Sessions Content specialist at events or department meetings

Securing the Human SANS

SANS Provided Materials Currently located in OU Blackboard Access is as easy as contacting the security department

Securing the Human - General

SANS Video

SANS Quiz

Benefits Completing the Securing the Human series: Adds good-faith awareness training for compliance laws (HIPAA, FERPA, PCI) Awareness training is reviewed by Internal Audit process and credit is received for all completed materials Bring awareness to possible security threats to your data

Securing the University Coming Soon

Locally built Created in-house to respond to OU specific risks Can be used a training tool to respond to new technology securely Can be catered to specific requests and directed to requesting department. Custom training can be mixed between Securing the Human and Securing the University videos with administrative access given to requesting department for auditing purposes.

Sample uL3 uL3 Video -

Face-to-Face Brown Bags, Department Workshops, and Staff Meetings

Face-to-Face Delivery Available to train departments Brown bag sessions Department meetings Departmental retreats Orientation Training credit is tracked for Internal Audits Customizable Interactive Q&A

ITSS (Information Technology Security Seminar) Held on an annual basis Focus is given for multiple crowds Technical General University Public Awareness activities with light training

SANS Training

SANS Online Training In-Depth technical modules More technical and catered to IT community and IT policy managers University receives discount on training modules Between 12 and 24 purchased annually

Brad Reed – IT Security Analyst Thank You for your time!