1. Stop!! THINKClick

2. Who must complete this training  All Users: This training is required for all individuals, including contractors and vendors, with security access to sensitive or confidential systems owned by the Department for Aging and Rehabilitative Services (DARS). New Users: Each individual must complete this training when security access is granted. Annually: Refresher security training is required annually.  Certification: Supervisors must certify and report completion of training to their DARS system administrator or contacts. FRS-Support/LTESS-EES: Donna Bonessi Div for the Aging: Leonard EshmontStop! THINK Click

3. Accessibility  This program is designed to meet standards for accessibility for individuals with disabilities.  This presentation is adapted for use in a small class or staff meeting that allows individuals to participate by listening to the narrator or reading the content directly from each slide. This program is also formatted for use with screen readers. The program should be narrated directly from the slide presentation. For individuals that are deaf or hard of hearing, closed captioning is not required and interpreters are not needed unless external discussion is included.Stop! THINK Click

4. Learning Objectives In this program you will review:  Policy: Review and understand current security policies that govern your use of COV and DARS systems and data.  Threats: Identify common threats to COV systems, confidential data and sensitive information.  Your Role: Understand what you can do to improve security, and how to report incidents and suspicious activities.

5. Section One: Overview of Cyber Security Policies Stop!THINK Click This section reviews current scope of policies for the Commonwealth of Virginia (COV) as they relate to devices and files, logons and passwords, security updates, physical security, and protected data.

6. Section One-Policies: Scope of Policies  All COV agencies, contractors and vendors with access to sensitive or confidential systems are required to adhere to policies governing personally identifying data, protected health information, and sensitive data, including policies published by the Virginia Information Technology Agency (VITA).  All Users with access to COV networks and DARS systems must follow these policies.  The Information Security Access Agreement (ISAA) is required to be signed by all individuals requesting access to COV and DARS systems.Stop!THINK Click

7. Section One-Policies: Logons/Passwords  COV requires enforcement or the following standards Use of “strong passwords” which include upper case alpha, lower case alpha, numeric (0-9) and non-alphabetic characters (~ ! # $ % ^ & *) in positions 2-6. Passwords must be changed every 90 days. Passwords cannot be changed in less than 7 days. and cannot have been used within last 4 changes. Five unsuccessful attempts will lock your account.  These are secure standards you should also apply to all of your accounts, including personal accounts.

8. Section One-Policies: Logons/Passwords (continued)  Your Role: The policy also states that end users are responsible for enforcement of certain standards: Your system or browser may not be configured to remember passwords. Passwords will not be written down and posted in plain sight.  You may NEVER share your passwords with anyone else for any reason.

9. Section One-Policies: Security Updates  VITA enforces the following standards for security updates and patches: Operating systems will be protected by applying automatic security updates and patches. Applications are configured for automatic security updates and patches ( For example, for Microsoft Office, Outlook, Internet Explorer, Adobe Reader). Security Software such as McAfee and Norton Antivirus will be kept up to date and configured for regular scans. Security software should be set to scan Internet pages, email, attachments, and downloads.  Your role: You should not change automatic settings or over-ride security updates.

10. Section One-Policies: Devices and Files  Devices, including external digital storage devices, must be owned or approved by your organization to be connected to sensitive DARS systems.  PC’s will be manually locked when unattended, automatically locked after a period of inactivity, for example, fifteen minutes, set to require a password to re-activate, logged off overnight.  Files must be stored and backed up on your server and must be encrypted when shared over network connections.

11. Section One-Policies: Physical Security  Physical security policy requires protection of your work space, physical devices and files. You must: Lock or shut down your workstation when you leave your desk or leave your laptop/mobile device unattended. Lock sensitive paper documents and materials in a file cabinet. Dispose of sensitive materials appropriately. Never share your building access key, card or fob. Always question unescorted strangers.  You must always report incidents and suspicious activities to your manager and security officer.

12. Section One-Policies: Protected Data Certain types of data are protected and regulated by the:  Social Security Administration (SSA) Controls the use of social security numbers (SSN’s)  U.S Department of Health and Human Services (HHS) Administers the Health Insurance Portability and Accountability Act (HIPAA)  Virginia Information Technology Agency (VITA) Responsible for the information security standards commonly referred to as “Sec 501”  Library of Virginia (LVA) Governs all records, including electronic files, under the authority of the “Virginia Public Records Act”)

13. Section One-Policies: Protected Data (continued ) Types of protected data can include:  Protected Health Information (PHI) Such as data contained in medical and health records and is governed by HIPAA.  Personally Identifiable Information (PII) Includes use of Social Security Numbers (SSN) governed by the SSA, and can include the SSN in combination with other identifying information such as name, date of birth, employment, insurance, residence and telephone numbers. If lost, compromised, or disclosed without authorization, this information could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual.  Sensitive data Defined as data, documents, or files which, if compromised, would have an adverse effect on the COV, your agency or organization, and is governed by VITA (Sec 501) and the Library of Virginia (Records Act).

14. Section One-Policies: Protected Data (continued ) Required Protections by Users: All PHI, PII and sensitive data must be protected by:  Storing data and files in a secure physical environment,  Storing files only on devices owned and approved by your organization,  Encrypting mobile and external storage devices that contain these files, including laptops, external hard drives, USB “thumb” drives and CD’s.  Encrypting files that are “in transit” which includes files sent via email and non-secure direct file transfer

15. Section One-Policies: Summary Your role: Always be aware that COV/DARS systems are governed by security policies and regulations, and follow safe practices that are in your control.  Do not share your access with anyone, including your passwords, keys, badges, and access codes.  Keep your PC desktop locked when you are not using it, and lock your mobile devices in a secure location.  Protect your files and do not send them via email or share them electronically without encryption.  Be aware of your work area and physical surroundings and report suspicious activity.

16. Section Two: Common Cyber Security Threats Stop!THINK Click This section reviews common cyber security threats with suggestions on what you can do to protect yourself and COV/DARS systems from harm.

17. Section Two-Threats: Two Basic Concepts  Concept One: Electronic systems may not be secure. VITA and DARS, and your organization attempt to provide protections with firewalls, electronic enforcement and monitoring systems. But that does not completely protect you from interacting with malicious and harmful software. You can still be targeted directly and persistently by email messages, texts, and malicious Internet links.  Concept Two: You control what you click. Even with all the security COV/DARS and your organization can apply, most end user threats are targeted specifically in hopes that you will go ahead and click on a harmful link, attachment, picture, video or icon in an email or web page, including social media applications.

18. Section Two-Threats: The Key to Your Role  Stop!: Pause before you click Your work relies on email and Internet interactions. Take a moment and remember that each click could be potentially harmful. Even if it at first appears to be from a legitimate source.  Think!: Verify and Validate You must be aware, be alert and diligent. Always look for the signs that external entities are trying to gain access to your PC and your network.  Click: Proceed only if you are confident it is safe

19. Section Two-Threats: Email Threats  Phishing, Spoofs, Hoaxes, Malware, Scams and Spam The most prevalent and persistent threats to your security arrive in your Inbox. They come by different names and may even appear legitimate and even supposedly from people you may know.  The Common Threat: Malicious emails appeal to your greed, your fear, your sense of humor, your curiosity, and even your compassion. They are designed to get you to click on an item such as an attachment, link, picture, or video.  Result: If you click, you may launch a harmful program or be directed to a harmful web site. You may then find your personal information compromised, and you may subject your organization’s network to malicious software and possibly direct infiltration.

20. Section Two-Threats: Email (continued)  Stop!: Pause before you click. Do not assume that links in your email are automatically safe, Especially if the link is requesting you to provide personal information.  Think: Look at emails carefully If you cannot identify the source and attachments as legitimate, or you cannot be sure the links are safe by looking at the actual destination web address, you can logically conclude that you should be cautious.  Click: Only after you are confident that the action is legitimate and safe. Protect all of your email accounts. Report all incidents and suspicious activity to security.

21. Section Two-Threats: Internet Threats  Browsing Can Hazardous To Your PC The Internet is a significant resource for business and government services. However, some of the same issues that attack email can create security issues that you need to be aware of while browsing directly on the Internet.  The Common Threat: On the web, the threats mainly come from malicious links. Most of the threats come when you click on a link, icon, picture, video, etc., that launches malicious programs or re- direct you to dangerous sites.  Result: If you click, you may then find your personal, client, and sensitive business information compromised. You may also subject your network, PC and other devices to malicious software.

22. Section Two-Threats: Internet (continued)  Stop: Pause before you click Do not automatically click on Internet links until you have confidence in them. This includes pictures, videos, and navigational elements.  Think: Look at the actual address for the links Look at the actual address for the links in question. For instance if the link indicates “Click Here” be sure to identify the actual destination web address before you proceed. Look for external web addresses that are secure. The address should begin with “http s ://” instead of “http://”  Click: Only after you are sure the destination web site is safe. Browse Safely Report all suspicious links and web sites to security.

23. Section Two-Threats: Social Media  Social Media can be un-sociable While usually relatively safe (for instance, DARS Face Book and Twitter pages) the rapid increase in social networking and collaborative sites like Face Book, LinkedIn, You Tube, and Twitter have offered new opportunities for hackers and thieves.  The Common Threat: It is PERSONAL! By nature these sites are personal. You may be sharing highly personal information, including information about yourself, employer and perhaps even about clients. You are communicating with others in a highly interactive, very public, and non-secure environment.  Result: You could find highly personal and sensitive information compromised. When visiting and using these sites always use the highest level security settings and be careful of the personal information and even images that you post.

24. Section Two-Threats: Social Media (continued)  Stop: before you, “like,” “share” or “post” Assume that everything you post can possibly be re-posted and used without your permission  Think: Is it secure and appropriate? Use the highest security and privacy settings for your personal social media accounts Be careful of sharing work related information and in particular do not share any information about clients or violate the mandate against dual relationships Be aware that malicious links, videos, and other harmful items can be posted on social networking sites Check to see if links posted by others are designed to take you to alternate sites that appear suspicious  Click: Only after you are sure the action is legitimate and appropriate and that you are not compromising your personal information or others Be social, but also be careful, and appropriate Report all suspicious postings and information breaches to security

25. Section Two-Threats: Files  Files Require Protection and Encryption The DARS business process requires sharing of information that is confidential, personally identifiable and sensitive. This information must be secured and maintained according to federal standards, COV security standards and Library of Virginia requirements. Information that is being digitally shared is termed “In Transit” and must be encrypted. This includes files that are being sent via email. If digital encryption is not available the policy allows for files to be faxed.  The Common Threat: Data Leak and Data Breach Unprotected files may be leaked and data may be stolen.  Result: Potential financial and legal penalties Data leaks and breaches may result in identity theft, financial loss, and other malicious uses. Incidents come with legal and financial implications to the COV and DARS, and to individuals.

26. Section Two-Threats: Files (continued)  Stop: Before you save or share a file Assume there is a potential for a data leak or data breach. Understand that sending unprotected files via email is not secure. Be cautious that transferring files on the Internet may also not be secure, depending on how the site is configured. For instance, https versus http.  Think: Is it Secure? When you are saving a file, are you storing it on a secure server, an encrypted PC or external device that is owned and approved by your organization? Assume that sharing any file is potentially a data leak. If sharing a file using email, are you able to use encryption?  Click: Only if you are saving the file to a secure location Only if you are sharing a file using encryption. If not, use fax Share Files Securely. Report immediately all suspected data breaches and data losses

27. Section Two-Threats: Telework/Internet Connections  For mobile workers: be careful with your connections The ability to work away from the office is beneficial and flexible. But mobile workers need take special note of the inherent risks when connected to public access points including wireless connections. Special care should taken when working with these connectopms.  The Common Threat: It is Public! Public access points, or Internet connections, are just that: Public. All your activity is potentially exposed. Especially if it is wireless.  Result: Compromised systems and data breaches Individuals with the knowledge and ability can take over an unprotected PC and load malicious software or steal information including passwords.

28. Section Two-Threats : Telework/Internet Connections (continued)  Be sure to connect securely to public access points Virtual Private Network (VPN): ○ VPN allows you to launch a secure Internet connection so that even with a public access point, you are able to work connected securely to DARS systems, connect to your own organization’s applications and file shares with a greater level of confidence. Device Encryption: ○ Always make sure your Laptop, Tablet Smart Phone or other mobile device is password-protected. ○ Device encryption and anti-virus software should be installed on all mobile devices that connect to COV systems.

29. Section Two-Threats : Telework/Internet Connections (continued)  Stop: Check your connection Assume all public Internet connections are not secure, including all wireless access points.  Think: Is it Secure? When you are prompted to connect to a public access point, be sure you know what you are connecting to. It is not secure unless you connect to a public access point using VPN.  Click: Only if you are confident in the connection and you are using VPN. Telework Safely! Always use VPN when you are mobile

30. Section Two-Threats : Reporting Incidents  Report incidents and suspicious activities including potential data leaks and data breaches to: Your Manager Your Organization’s Security Officer Your DARS System Administrator or Security Contact ○ For ESO’s (LTESS/EES): - Donna Bonessi or Ella Barnes ○ For AAA’s (NWD): - Leonard Eshmont

31. I, _____________________________________________ Date: _________________ PLEDGE to:  Stop, and Think (consider appropriateness and risk) before I Click on links, attachments and other objects that connect to the Internet or launch programs.  Take personal responsibility for security, follow my organization’s security policies, and adhere to sound security practices.  Lock my computer whenever I leave my work area.  Safeguard portable computing equipment when I am in public places.  Create and use strong passwords, and never share my password(s) with anyone.  Never leave a written password (sticky note, etc.) near my computer, or easily accessible.  Promptly report all security incidents or concerns to my organization’s security officer or other appropriate contact.  Safeguard Protected Health Information (PHI), Personally Identifiable Information (PII) and sensitive data from any inappropriate disclosure.  Work to the best of my ability to keep my organization’s staff, property and information safe and secure.  Spread the message to my friends, co-workers and community about staying safe online DARS Cyber Security Pledge

32. Remember: Security is a shared responsibility. Take the time and care every day to protect yourself, your organization, your clients, and your family, through your own cyber-safe practices.

33.  VITA http://www.vita.virginia.gov/security/toolkit/ http://www.vita.virginia.gov/security/toolkit/  OnGuardOnline.Gov: Securing your computer: http://www.onguardonline.gov/topics/secure-your- computer http://www.onguardonline.gov/topics/secure-your- computer  NIST: 7 Practices for Safer Computing http://csrc.nist.gov/groups/SMA/fasp/documents/security_ ate/stopthinkclick.pdf http://csrc.nist.gov/groups/SMA/fasp/documents/security_ ate/stopthinkclick.pdf Additional Resources