Pass your certification exam. Faster. Guaranteed.

Security Awareness Transcription

Welcome to our information security education, training, and awareness module. When we try to secure information, people are often the weakest link. It is important that everyone knows their need to act appropriately to protect our assets and to protect our confidential information. We need provide them with training so that they can successfully operate our systems and keep those systems secure.

It is very important to provide security measures and practices for employees to follow in order to make your security program successful. We should develop employees' skill sets relating to performing information security activities within their specific job functions. And we should try to motivate people to take information security training.

Most importantly we should test the individuals to make sure that they understood what they learned. This also provides due diligence and shows that we are attempting to make sure that our employees learn and retain appropriate computer security skills. You may see a question on the CISSP exam relating to testing after training and it is important to make sure that you are always testing your employees to make sure that they understood what you taught them.

Your employees should be supplied with adequate training which provides them with the rules for information security and how they will be held accountable if they do not follow the rules. Employees should have training on your policy requirements. They should know what is expected of them and there should ramifications if they do not meet these requirements.

If you do not properly notify your employees of your procedures and policies, then they will not be able to follow the policies. You should make sure that your employees have realistic expectations of what you need them to do to keep your organization safe. You can offer an employee recognition and award program to reward those employees who go above and beyond, or who are very good with their computer security.

And it's part of your due care and due diligence which may be required by the laws and regulations that effect your organization. Training is considered an administrative control and is very useful in order to prevent security incidents. It is important that we provide initial security training for all new employees based on their roles and responsibilities and explaining to them the tools that they will have access to, and the processes that they will need to follow.

You should provide them with an acceptable use policy or AUP which tells them very specifically what they are and are not allowed to do on your systems and you should provide them with specific methods and procedures that they should use to perform their job. You should test employees to make they understand their role in providing for the security of your company's assets. And make sure that you have them sign an acceptable use policy indicating that they have read the policies and that they understand they will be monitored. You should also provide security awareness training at least once a year, if not more. In the yearly update training, you should provide employees with information about updated threats and any lessons learned from incidents throughout the year.

You should also discuss new and emerging social engineering attacks and phishing schemes. And go over any new security rules or regulations for compliance, as well as any new processes and procedures based on their specific job function. There are many benefits to offering training to your employees. The goal of training is to provide relevant and necessary security skills and competencies for your employees.

Training typically has a low cost but a very high reward. If done correctly training will help to modify your employees behavior and improve their attitude towards information security. And it will increase your ability to hold employees accountable for their actions. It helps you to raise your collective security awareness level for your entire organization and training is a very important part of good governance.

It shows that management has taken due care by providing a training plan and due diligence by implementing that training plan and testing employees to make sure that they understood what they learned. You should offer basic security awareness training for all employees. Even those who do not actually access your systems.

You may need to provide advanced training for managers because they may be responsible for providing access to different systems for their employees. You should also have specialized training for system administrators and information system auditors because they will have access to additional functions and roles. And they should know how to protect systems from any adversaries.

Whenever you implement a new control you should train all of your employees on that control. And you can obtain specialized training through external programs such as those from InfoSecond Institute. Training should be offered as a part of career development, and you can also allow your employees to obtain independent training by funding college education programs or continuing education programs.

This concludes our information security education training and awareness module. Thank you for watching.