Re: key topics to include in security awareness training materials

[Adam Stone <adstone () LBL GOV>]

We drive our awareness program from our incident statistics and those
of institutions we work closely with.  Our annual awareness training
includes multiple paths based on answers to questions (like do you use
SSH?)  The things that are forked are in brackets below.

Our current topics are:
Risks and Threats
-> Introduction
-> Social Engineering (Specifically highly targeted social engineering)
-> Stolen Credentials
-> {... in SSH specifically for SSH users}
-> Application Attacks (normal apps like adobe, ms office, etc)
-> Personal Info (PII)
-> {Webserver Security for web server administrators and web application coders}

Policies
-> General
-> Min. Security Requirements
-> {Policies specific to System Admins (responsibilities, no spying, etc) }
-> Incident Response
-> {Supervisors (security is an oversight responsibility, etc) }

Full training here: http://www.lbl.gov/cyber/training/csar/item1.html


-------------------------------------------------------------
Adam Stone
Policy, Assurance, and Risk Management, Office of the CIO
Berkeley Lab, University of California
510.486.4650(o) 510.593.7507(c) http://www.lbl.gov/CIO/Policy/