The purpose of Security Awareness Training
is to make all employees aware of information security
policies, help us deal with problems when they arise,
and to meet our compliance training requirements.
We can have all the systems and technical controls
in the world.
But if we, as human beings, fail to follow
our policies and security practices,
then the whole system breaks down.
So first, what's the risk?
What's the big deal?
Well, there's a monetary risk.
Your company could be fined if you're not found compliant
with the laws in place.
There's also a legal risk if an employee violates the law,
knowingly or unknowingly.
And that risk extends to both the company and the individual.
Most importantly, though, there's
a risk of damaging the company's reputation.
You've seen it plenty of times, where very big companies end up
in the news due to data breaches,
and you don't want that to happen.
There are a number of technology-related reasons
for data breaches, such as new viruses or malware.
But the overwhelming number of data breaches
are caused by human error and carelessness.
A sensitive document is left out in the open.
A computer is left unattended for a few minutes
without password protection.
Sensitive information is sent over unencrypted email
without a password.
Another cause of breach is social engineering.
Techniques can be as simple as calling a company office,
claiming to be from another company location,
and asking for protected information.
It's surprising how often this works.
Let's discuss some specific actions you can take.
One, update your anti-virus and anti-malware software.
Two, don't install unapproved software.
Three, keep your computer's operating system current
by installing updates when you are notified of them.
Four, log off, or lock, your computer screen when not in use
and make sure to use a password protected screen-saver.
Five, physically lock up documents
that contain sensitive information when not in use.
Six, adopt a clear-screen, clear-desk approach
to your work.
Seven, never write your passwords down.
A password written on the sticky note on your monitor
is the same as not having a password at all.
And eight, never open email attachments
that come from people you don't know.
The key is to make security a habit
and to report suspicious or potential security issues
to your local information security officer.
Work on making security a habit, and help
protect all of your company's data, resources and reputation.
[MUSIC PLAYING]