1. Information Security Awareness Campaign
CIO Council
February 23, 2017

2. Information Security Awareness
Strategy
Spring 2017 Focus
Communications Overview

3. Strategy “The Big Four” “One Action at a Time” Use Two Step
Raising Awareness ( )
Changing Behaviors (2016-)
“The Big Four”
“One Action at a Time”
Identify an insecure behavior based on risk data
Choose a measurable action users can take to mitigate this risk
Promote this behavior change
Measure the results
Concept
Actions
Use long passwords
Enable 2-Step
Follow the Policy
Delete Unneeded Data
Fall 2016
Use Two Step
Verification
Recognize Phishing
Report Harvard Phishing
Spring 2017
Report
Phishing
Enable Auto-Update
Reboot Frequently

4. Spring 2017 Focus – Report Phishing
“Forward phishing s to
Why Phishing?
Phishing is extremely common
“You’re only safe behind the gates.”
Phishing is being used to install malware
It is a risk that is heavily dependent on user behavior vs. technology
Why Reporting?
To put the numbers game in our favor
To help members of the community who fall for phishing s
To streamline our response to phishing attacks university wide

5. Spring 2017 Focus – Public View
s from local leadership, posters, and in-person talks
Communicator’s toolkit for customizable approaches
Rewards for phish reporters to spur discussion of the program
Phishing stats page to show how phish reports are used and effective (planned)
CADM internal phishing assessment (mid-March)

6. Spring 2017 Focus – Behind the Scenes
Manual Phishing Review Process
Create Ticket
Phish Monitor Actions
Phishing?
Block Link in Proofpoint
Yes
Block File in Proofpoint
Review for Escalation to Security Operations ?
Criteria for Escalation
Harvard Related Content
Sent from Harvard Account
New File / Interesting File Family
Probable Spear Phishing No
Investigate by checking links and files in sandbox environment
Store for future “Phishy looking” guidance.
Security Operations Actions
Block domain via DNS
Recall Message from Exchange / Filter in g.Harvard
Lookup recipients in Proofpoint for contact / review

7. Communication Overview
Key Dates
Posters and signage up first week of March
s sent throughout week of 3/6
Rewards to phish reporters begin delivery 4/1
More dates included on communication plan