Tools of Defense Drill #1 Flashcards
firewall:
Hardware or software designed to block unauthorized network access while permitting authorized communications.
cloud computing:
The practice of using remote servers on the Internet to store, manage, and process data, rather than a local server or a personal computer.
Cloud servers get all the latest software and security updates, making them less vulnerable to attack.
Example: The use of Google Apps (gmail, docs, calendar, etc.)
SAT
security awareness training.
Any training that raises the awareness of a user to potential threats, and how to avoid them.
The goal of SAT is to get users to make smarter security decisions and help their organization manage the ongoing problem of social engineering.
The user is the last line of defense in an attack by the bad guys!
Kevin Mitnick:
In the mid-nineties, he was known as the “World’s Most Wanted Hacker.” Today, Kevin’s positioned as “The World’s Most Famous Hacker.” Kevin is a very successful Fortune 500 security consultant, part owner and the Chief Hacking Officer of KnowBe4.
Based on his 30+ years of first-hand experience with hacking and social engineering, KnowBe4 created KMSAT, which stands for “Kevin Mitnick Security Awareness Training.”
Kevin’s main contribution to KnowBe4 is his experience!
LMS
learning management system
A system for the administration, documentation, tracking, reporting, and delivery of e-learning education courses or training programs.KMSAT (Kevin Mitnick Security Awareness Training) uses an LMS.
Note: You are using an LMS right now while doing this course! It’s called Bridge.
ROI
return on investment.
Measures the amount of return on an investment relative to the investor’s cost.
In IT security, ROI is measured as “reduction in risk,” not as a concrete financial gain. Without proper security awareness training, a company can experience a loss of reputation, productivity, and revenue.
SCORM
Shareable Content Object Reference Model
A technical standard that governs how online learning content and Learning Management Systems communicate with each other. Note: Our customers access our security awareness training modules through an LMS. Those modules are follow the SCORM standard.
Security Awareness Training - The Six Steps
Step 1:
Have a security policy, and have each employee read and sign it.
Step 2:
Have all employees take mandatory SAT (online), with a clear deadline and reasons why they’re taking the training.
Step 3:
Make SAT part of the onboarding process (the process of integrating new hires in a company).
Step 4:
Regularly test employees to reinforce the SAT its application.
Step 5:
Have employees who fail phishing tests meet privately with a supervisor or HR; reward employees with low failure rates.
Step 6:
Send regular security hints and tips via email to all employees.
Why Organizations Outsource Security Awareness Training
There are 7 reasons why an organization would outsource security awareness training (why they seek our product):
- Reduce costs
- Access to talent
- Geographic reach and scalability
- Compliance
- Mitigate risk
- Business Focus
- Leverage the cost of technology
Reduce Costs:
It’s cheaper for organizations to purchase training than to create it.
Access to Talent:
Organizations use professionals, rather than internal (staff who may have limited skills and/or understanding).
Geographic Reach and Scalability:
Online training content can be done anywhere there’s an internet connection. It’s easier for organizations to grow and manage increased demands for training by using a provider who has content on demand.
Compliance:
Training is required for organizations who must comply with specific laws or industry guidelines, including security awareness training.
Mitigate Risks:
There are less risks and problems with training when using a professional service.
Business Focus:
Training is not the main focus for most organizations.
