- [Instructor] Security education programs
should include a wide variety of topics
related to user habits.
By replacing risky habits with strong security habits,
organizations reduce the likelihood
that user accounts will become compromised.
Let's take look at some of the habits
that security education programs should address.
Security training should include coverage
of password security practices.
Most organizations already have a password security policy
that enforces requirements such as password complexity
and password expiration.
Security training programs should remind users
of these requirements
and also educate them about the importance of requirements
that can't be enforced with technology.
For example,
users should know that reusing their work password
on websites and other accounts
jeopardizes security because those websites
or other accounts may be compromised.
Organizations should also include
data handling procedures
in their security training programs.
Users must know the proper ways to store,
transmit, and destroy sensitive information.
For example, security training may include coverage
of an organizations clean desk policy
designed to protect sensitive information
from being left out in the open unattended.
Security awareness efforts should also include
physical security controls.
If the organization uses badges or other technology
to control access at doors,
users should understand the importance of
preventing tailgating and requiring each user
to individually swipe his or her badge
to unlock the door.
Users should learn about an organizations
bring your own device
or BYOD policies during the security education program.
If the organization does allow the use of personal devices,
the training program should include coverage of
acceptable use and security requirements.
If the organization doesn't allow the use of
personal devices with organizational data,
the training program should make that clear.
Finally, security education programs
should also include coverage
of the acceptable use of social media
and peer-to-peer networks.
Users should understand their responsibilities
for projecting the proper image on public facing networks
and the security risks involved with exchanging
links and files with unknown individuals.
That's a lot of material to cover in a
security education program,
but helping users adopt good security habits now
may prevent serious security incidents down the road.