Free Security Awareness Training - Part 3 of 5

Image via Wikipedia

This week I'm passing on to you links to 25 free security awareness training sites. Why is security awareness training important? Fundamentally, security is about people. Having worked within the information security world for the past 15 years, it's become very clear that the best defense to internal and external threats is not technology by itself. Rather, people need to have the mindset that helps them to automatically take actions that support security, not circumvent or undermine it. Security awareness training helps raise awareness so as to begin making this a natural mindset that influences behavior.

"No one wants security; they want the benefits of security. A homeowner does not want the finest deadbolt on the front door because of the excellence of its engineering; they want a comfortable, happy place in which to live." - Steve Hunt

Below are the next five training links. This now brings us to a total of 15 trainings out of the 25 I promised to give you by the end of this week.

1. OPPSEC (United States Marine Corps)
2. Intelligence Analysis Web-based Training (Anacapa Sciences)
3. SAEDA (553G-NG0001-A) (Espionage Awareness) (United States Army)
4. Are You Ready? An In-depth Guide to Citizen Preparedness FEMA/EMI Course IS-22 (FEMA)
5. Personal Preparedness (Center for Public Health Preparedness)

Related articles

• Free Security Awareness Training - Part 1 of 5 (Zenone.org)
• Free Security Awareness Training - Part 2 of 5 (Zenone.org)

Cyber Intelligence Sharing and Protection Act of 2011 (HR 3523)

Image via Wikipedia

The House Intelligence Committee held a closed-door markup of a bill (HR 3523) with the intention to improve cybersecurity through enabling the federal government to share classified cyber threat information with businesses. To quote two of the primary proponents:

"There is an economic cyber war going on today against US companies." ... "There are two types of companies in this country, those who know they've been hacked, and those who don't know they've been hacked. Economic predators, including nation-states, are blatantly stealing business secrets and innovation from private companies. This cybersecurity bill goes a long way in helping American businesses better protect their networks and their intellectual property." -- Chairman of The Permanent Select Committee on Intelligence, Congressman Mike Rogers (R-MI)

"We simply can't stand by if we have the ability to help American companies protect themselves. Sharing information about cyber threats is a critical step to preventing them. This bill is a good start toward helping the private sector safeguard its intellectual property and critical cyber networks, including those that power our electrical, water and banking systems. The bill maintains vital protections for privacy and civil liberties without any new federal spending, regulations or unfunded mandates." -- The committee's ranking member, Congressman Dutch Ruppersberger (D-MD)

Related articles

• Article (Homeland Security Today)
• Text of the Bill (Library of Congress)
• Track status of the Bill (GovTrack.us)
• Press Release, Repr. Mike Rogers (House of Representatives)
• Press Release, Repr. Dutch Ruppersberger (House of Representatives)

Free Security Awareness Training - Part 2 of 5

Image via Wikipedia

This week my goal is to pass along to you links to 25 free security awareness trainings. The trainings are being divided up into groups of five and published in a series of five separate postings. The first set of training links was published yesterday.

As promised, below is the second set of five trainings.

1. Anti-Terrorism Awareness Level-1 (Defense Technical Information Center - US DoD)
2. The Seven Signs of Terrorism (Michigan State Police via YouTube)
3. AWR-187 Terrorism and WMD Awareness in the Workplace (Rural Domestic Preparedness Consortium)
4. Kentucky Terrorism Response & Preparedness (University of Kentucky)
5. Prevention and Deterrence of Terrorist Acts (National Center for Biomedical Research and Training)

Related articles

• Free Security Awareness Training - Part 1 of 5 (zenone.org)

Free Security Awareness Training - Part 1 of 5

Image via Wikipedia

As a security profesional I believe it's essential that we maintain security awareness and an understanding of the threats we face. Education often isn't cheap and the reality is that for many employers funding for training and education is very limited.

Fortunately, we're entering into the holiday season, which is a time of giving, and what I'm giving you are 25 security awareness courses and videos that are publicly available. Okay - maybe not the most exciting gift, but it fits the budget.

I will publish a series of five posts and each post will have links to five training resources. The security awareness courses may be completed online (or on CD-ROM) and are provided without cost to you. This study program is designed to provide you with a broad security awareness. There will be overlap in training that will help you to build depth of knowledge and to emphasize important areas. I emphasize "broad". The material covers many of the domains within security, some of it IT Security, and some of the material may seem a bit Rambo'esque or even doom-and-gloom.

There are several separate agencies and organizations that are offering the courses. Certificates of training can be printed following completion of the courses. You can enroll in any individual course, or if you're more highly motivated, aim for completing all of them. Personally, I believe that anyone who completes all of the courses will become a much more valuable security asset to their employer as well as their community.

Bring out the leftover turkey, stuffing and cranberry sauce ... it's time to cram in some free security awareness classes!

1. Phishing Awareness (Defense Information Systems Agency - US DoD)
2. Personally Identifiable Information (PII) (Defense Information Systems Agency - US DoD)
3. Security & Privacy Awareness Training (National Institute of Health Information)
4. Information Assurance Awareness (Defense Information Systems Agency - US DoD)
5. Information Assurance Awareness shorts (Defense Information Systems Agency - US DoD)

FCC Small Biz Cyber Planner

Image via Wikipedia

The FCC has launched a Small Biz Cyber Planner, an online resource to help small businesses create customized cybersecurity plans in conjunction with DHS, NCSA, NIST, The U.S. Chamber of Commerce, The Chertoff Group, Symantec, Sophos, Visa, Microsoft, HP, McAfee, The Identity Theft Council, ADP and others. The complete set of guidance can be downloaded as a PDF at fcc.gov/cyber/cyberplanner.pdf while the interactive online tool is available at FCC.gov/cyberplanner.

"The Small Biz Cyber Planner will be of particular value for businesses that lack the resources to hire a dedicated staff member to protect themselves from cyber-threats. Even a business with one computer or one credit card terminal can benefit from this important guidance.  The tool will walk users through a series of questions to determine what cybersecurity strategies should be included in the planning guide. Then a customized PDF is created that will serve as a cybersecurity strategy template for a small business. 

This effort is part of an ongoing program to raise awareness about the cybersecurity risks to small businesses and to help these businesses become cyber-secure. Earlier this year, the FCC and a coalition of public and private-sector partners developed a cybersecurity tip sheet, which includes tips to educate business owners about basic steps they can take immediately to protect their companies. The tip sheet is available at FCC.gov/cyberforsmallbiz."

Sections in the complete set of guidance are:

• Privacy and Data Security
• Scams and Fraud
• Network Security
• Website Security
• Email
• Mobile Devices
• Employees
• Facility Security
• Operational Security
• Payment Cards
• Incident Response and Reporting
• Policy Development, Management
• Cyber Security Glossary
• Cyber Security Links

Related articles

• FCC Launches the Small Biz Cyber Planner (bespacific.com)

Protecting Kids Online

Image via Wikipedia

One of the issues I’ve been struggling with over the past ten or so years is how to protect kids online. The Internet offers a world of opportunities. People of all ages share photos and videos, build online profiles, text each other and create alter egos in the form of online avatars. These ways of socializing and communicating can be fulfilling, and yet, they come with risks:

• Inappropriate Conduct: The online world can convey a false sense of anonymity and kids sometimes forget that their online actions have real-world consequences. 
• Inappropriate Contact: There are people out there that have bad intentions; predators, bullies and scammers.
• Inappropriate Content: Kids can easily come across pornography, violence or hate speech online.

Some questions to ask yourself as an adult:

1. Do you think your child knows more about the Internet and technology than you do?
2. Do you think you know more about communicating respectfully off-line than your child does (parents don’t have to be tech-savvy to know a lot that’s relevant to this topic)?
3. How much time do you think your kid spends online each day? Each week? That includes time on their phones!
4. What are your kids’ favorite websites or online games?
5. Do your kids have their own computers? Do they have cell phones?
6. Do you supervise what your kids do while online and offer guidance, or are they allowed free rein?
7. What are your main concerns about online safety?
8. Do you text? Do you text with your children?

It’s also a good idea to talk with your kids about online safety. To kick things off, here are some questions you can ask your kids:

1. How much time do you spend online?
2. What do you like to do online?
3. Do you sleep with your cell phone in reach?
4. Do you post pictures online? 
5. Have you every posted or sent anything you later regretted?
6. Have you or one of your friends ever received a text message that was hurtful or mean-spirited?
7. Have you ever talked to your parents about something that bothered you online?
8. Have you ever talked to another adult bout something that bothered you online?

Make your conversation interactive. Ask your kids how they might have handled an incident that involved sharing too much information, cyberbullying, posting embarrassing photos or sexting.

For more information, the US Government has created OnGuardOnline.gov, a site that provides practical tips from the federal government and the technology community to help you guard against internet fraud, secure your computers and protect your privacy. The project is managed by the Federal Trade Commission, the nation’s consumer protection agency, and includes more than a dozen federal agencies.

Additional Resources

• OnGuardOnline.gov - Practical tips from the federal government and the technology community to help people be on guard against Internet fraud, secure their computers and protect their privacy.
• FTC.gov/idtheft - The Federal Trade Commission's website has information to help people deter, detect and defend against identity theft.
• StaySafeOnline.org - The National Cyber Security Alliance seeks to create a culture of cyber security and safety awareness by providing knowledge and tools to prevent cyber crime and attacks.
• CommonSenseMedia.org - Common Sense Media is dedicated to improving the lives of kids and families by providing trustworthy information, education and voice they need to thrive in a world of media and technology.
• GetNetWise.org -  A project of the Internet Education Foundation, the GetNetWise coalition provides Internet users the resources to make informed decisions about their and their family's use of the Internet.
• CyberBully411.org - CyberBully411 is an effort to provide resources for youth who have questions about or have been targeted by online harassment.
• ConnectSafely.org - ConnectSafely is for parents, teens, educators and advocates for learning about safe, civil use of Web 2.0 together.
• iKeepSafe.org - iKeepSafe educational resources teach children of all ages, in a fun, age-appropriate way, the basic rules of Internet safety, ethics and the healthy use of connected technologies.
• NetFamilyNews.org - A nonprofit news service for parents, educators, and policymakers who want to keep up on the latest technology news and commentary about online youth, in the form of a daily blog or weekly email newsletter.
• NetSmartz.org - The NetSmartz Workshop is an interactive, educational safety resource from the National Center for Missing & Exploited Children.
• WiredSafety.org - WiredSafety provides help, information and education to Internet and mobile device users of all ages.

Schedule Emails to be Sent Later in Gmail

Image via Boomerang for Gmail

I have happily been a Gmail and Google Apps account holder for several years. A feature that I felt had been lacking was the ability to schedule emails to be sent at a later date. I've searched for various solutions ... all of them disappointing ... until recently when I came across Boomerang for Gmail which does just that; it lets you write an email now and schedule it to be sent automatically at a scheduled time. There are both Google Chrome and Firefox plugins for Boomerang. The plugin adds a “Send Later” button in Gmail. It doesn’t get much easier than that to schedule emails for sending at a later date.

If you're interested in using Boomerang for free, here's the link: Boomerang for Gmail