Introduction To Security Awareness Campaigns

Understanding how awareness offers tangible results in reducing the likely hood of successful social engineering attacks

Last updated 2022-01-10 | 4.4

- Choose the right security policy to begin with (if starting out)
- Communicate the components and why you have them on the security policy
- Use Awareness to lower risk of social engineering attacks

What you'll learn

Choose the right security policy to begin with (if starting out)

Communicate the components and why you have them on the security policy

Use Awareness to lower risk of social engineering attacks

Communicating basic security principles

Understanding how

what and why (criminal) hackers attack

* Requirements

* Be familiar with basic principles of Security and Information Technology

Description

Security Awareness Campaigns is about the components and reality of what makes awareness campaigns successful and which components are needed in it. This course will cover the basics of a security awareness campaign that is aimed at increasing security levels by addressing social engineering attacks and communicating the basics of awareness and threats companies face today.

Learn the basic concepts of security awareness campaigns, quickly and easily!

This course goes through relevant research into successful and failed attempts at increasing awareness, also going through complex standards and making them simple and easy to understand.

The full version gives you research, tips and information you need to be successful in creating your own security awareness campaign.

There are over 22 lectures in the full version that cover:

Introduction to security awareness campaigns
What components are needed
Security Drivers
Vulnerabilities that companies face
Business value of campaigns
Components of the awareness campaign
Security Policy
Laptop and Desktop
Mobile Devices
Data Security and Encryption
Incident Response
Change Management
Security Organization
How awareness mitigates risks
Practical examples of how awareness has stopped attacks in reality

This course goes through materials and actual projects and gives you the simple scoop on how to create great awareness campaigns that work and which elements you can use in your awareness campaign. It also goes through information that is also important for everyone to know, even if you do not create an awareness campaign, it will help you understand basic concepts.

Who this course is for:

People who work in security, management and business
Directors, CIO's, CISO's, Consultants

Course content

5 sections • 25 lectures

Basics of Security and Awareness 5 lectures

Introduction Preview 10:08

In order to understand why and what is needed in a security awareness campaign, we first need to understand what security principles are important and what they mean to the business and users.

Security Drivers of Awareness Preview 04:00

Objective of awareness campaigns Preview 02:23

This lecture discusses the objectives of a security awareness campaign.

Areas of Vulnerability in an enterprise, agency or institution Preview 08:50

This lecture goes through some of the areas that are vulnerable in a company. These areas are also used as a guideline (depending on which ones come up in either internal or external audits.

Training & Communication Plan, Training Methods and Schedule Preview 06:07

Training methods and a schedule enable the security team to plan and tailor the message to various different groups and skill sets. Tailoring the campaign is one of the best ways to ensure that all groups accept and understand the policy and recommendations.

Components of Awareness Campaigns 13 lectures

Executive Buy-In Preview 01:06

Executive buy-in in security awareness campaigns is critical to its overall success, only when executives support an initiative will it actualy result in the desired behavioral changes.

Risk Management (Assets, what risks the company faces, etc.) Preview 11:48

Identifying assets that need to be protected and how they will be protected is a vital part of any security initiative.

The Security Policy Preview 5 pages

Security policies are the glue to an organization and the security teams effort to keep things safe. When people understand the policy and its mechanisms then an organization can more easily identify threats and stop them. This section includes some examples of complex and really good (simple) policies that are accepted faster than more complex ones.

Logons and password security Preview 07:21

Passwords and applications seem to go hand in hand. Most attacks are aimed at cracking passwords in order to obtain data or critical information from an enterprise. When users understand the risks associated to weak passwords and their information, then they can make the right decisions to create better passwords that protect themselves and a company.

Anti Virus, Personal Firewalls and Co. Preview 06:12

Some components in the campaign equate to savings faster than others. Antivirus and personal firewalls are a basic component in any policy or awareness campaign. As cyber threats increase, so does the importance on detection and remediation. The caveat is that this software only helps to an extent as many cyber threats are starting to circumvent traditional scanning methods in order to infect a users laptop or desktop.

Laptop and Desktop Security Guidelines and Best Practice Preview 03:48

Many people forget that others can look over your shoulder when you use a computer. With basic precautions everyone can increase personal security and protect their data and information from criminal hackers.

Mobile Security Guidelines and Best Practice Preview 02:21

In 2015 (more than ever) we can no longer picture a world in which smartphones and tablets don't exist. As these mobile devices have gotten faster and have more memory, companies look at these devices to take over certain areas thought to be excusive to laptops. With added features we also have more risks when using these devices on the road or at your local café. Don't get scammed by cyber threats because you don't know the threats.

Secure Internet usage and secure searches as well as browsing Preview 04:29

We hear a great deal about threats every day but what and how do they happen when you browse the internet? Some way is attackers are successful is by using infected websites that "host" malware downloads, other areas that you can use to secure your activities is by using secure and encrypted connections when browsing. We don't have anything to hide, but making things harder for a criminal hacker is the objective.

Email Security Preview 03:42

You get an email from someone you don't know, asking you to download a "critical" update or financial document. What do you do? If you are aware of the threats involved with this seemly "harmless" email you will know its how many devices get infected. Don't be conned into clicking on emails and links or files you don't know. Email is not always your friend!

Data Security and Encryption Preview 03:42

This area has only recently become mainstream privately and in the enterprise. Data is the basis for many decisions and task both in our private as well as working lives. By using encryption technology and also being aware of the threats of using usb memory sticks, we can protect ourselves against some of the simpler attacks.

Physical Security (The office, other buildings, perimeter and data center) Preview 01:44

This lecture discusses the physical security aspects of security policies. When aspects such as tailgating , access card misuse and other aspects of social engineering attacks used by an attacker to get unauthorized access to a building are discussed, it helps everyone be aware of those risks.

Change Management Preview 04:05

Campaigns usually forget how changes and the change management process works in an enterprise, but there are so many advantages in talking about the change management process. When people know the process and how to suggest changes, it reduces risks and also speeds up the process in general (making it cheaper). Its a win-win situation!

Incident Response and Team Preview 12:40

Including information on how and to whom people should respond when an incident or something suspicious happens just makes sense. When we discuss what everyone can do to stop or limit the damage from an attack on the enterprise or institution, then we also reduce the downtime and costs associated with it. Awareness campaigns can be used successfully to lower costs drastically by helping the incident response teams gather information, identify an attacker or be aware of suspicious events. Everyone can help by being responsible for security, its a mindset needed in today's "cyber" world.

Deriving Value from Security Awareness 4 lectures

Deriving value from security awareness initiatives Preview 04:28

Many things have changed in recent years in regards to IT, IT-Security and the rest of the Business. As Gartner, Forester and others pointed out back in 2001, enterprises now expect technologists to highlight, explain and be aware of the business value of projects they suggest. Many teams that do not understand these concepts ultimately fail. This lecture discusses how you can justify security projects (like awareness) by talking about business value to the company. One tip, IT and Security are CORE business functions.

What is Social Engineering? (Definition and certain types of attacks) Preview 02:46

Social engineering is one of the most difficult areas to protect against because it uses human nature. When teaching awareness, this is one of the core areas to concentrate on so that people learn how to recognize and detect when social engineering is happening. Don't be deceived, this requires the support of many departments including the executives to nurture and create an "aware" culture.

Common attacks that are mitigated by awareness Preview 03:17

So what are the actual attacks that awareness campaigns can actually help with, many are obvious, some not so. This lecture will discuss the areas and how to use that to your advantage.