Cybersecurity Awareness Training

Summary

The Texas Department of Information Resources presents a cybersecurity awareness training program, aligning with Texas government code chapter 2054.519. This training introduces the CIA Triad of confidentiality, integrity, and availability, and covers information security controls to mitigate risks like breaches and data theft. It also addresses threats from natural disasters and human actors, including insider threats and ransomware attacks. The training emphasizes the importance of secure practices, such as using strong passwords, multi-factor authentication, and encrypted communication, especially when working remotely. It concludes with advice on incident reporting and the necessity of a robust backup plan, urging participants to stay vigilant and report suspicious activities.

Takeaways

• 📜 The training meets the requirements of Texas government code chapter 2054.519 and is for information security awareness.
• 📝 Trainees must report their completion of the training to their organization, not to the Texas Department of Information Resources (DIR).
• 🔒 Information security is defined by NIST as the protection against unauthorized access, use, disclosure, modification, or destruction of information and systems to ensure confidentiality, integrity, and availability.
• 🔑 The CIA Triad is a framework consisting of Confidentiality, Integrity, and Availability, which are the three core parts of information security.
• 🛡️ Information security controls are measures like hardware devices, software, policies, and procedures that reduce risk and improve an organization's security.
• 🏢 Physical information assets require secure storage and disposal according to organizational policies, including specific instructions for sensitive data.
• 🗣️ Oral information also needs protection, and confidential conversations should occur in secure areas to prevent eavesdropping.
• 🔐 Strong, unique passwords and multi-factor authentication are essential for safeguarding information, along with following organizational encryption policies for shared data.
• 🗑️ Information sanitization and destruction are processes for handling data that can no longer be retained or needs to be shared without revealing sensitive information.
• 🏠 Remote work requires additional security measures, including multi-factor authentication, locking screens, and being cautious with public Wi-Fi and home networks.
• ⚠️ Threats to information security come from natural disasters and human actors, including unintentional insider threats and intentional attacks from external groups or individuals.

Q & A

What is the purpose of the cyber security awareness training presented in the script?

The purpose of the cyber security awareness training is to meet the requirements of Texas government code chapter 2054.519 and to educate individuals on information security practices.

Who is responsible for submitting the security training verification to DIR after completing the program?

A representative from the individual's organization is responsible for submitting the Consolidated annual compliance report, also known as a security of training verification, to DIR.

What is the definition of information security according to NIST?

According to NIST, information security is the protection of information and information systems against unauthorized access, use, disclosure, modification, or destruction to provide confidentiality, integrity, and availability.

What are the three core parts of the information security, also known as the CIA Triad?

The three core parts of the information security, or the CIA Triad, are confidentiality, integrity, and availability.

How does the script define confidentiality in the context of information security?

Confidentiality is defined as preserving authorized restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information.

What is the importance of integrity in information security?

Integrity is crucial as it guards against improper information modification or destruction and ensures information non-repudiation, which is the assurance that someone cannot deny the validity, origin, and authenticity of data.

What measures can be taken to ensure the availability of information?

Availability can be ensured by maintaining all hardware, performing hardware repairs immediately when needed, and maintaining a properly functioning operating system environment that is free of software conflicts. Additionally, safeguarding data against unpredictable events by keeping backup copies in geographically isolated locations is important.

What are information security controls and why are they important?

Information security controls are measures that help reduce risk such as breaches, data theft, and unauthorized changes to digital information. They are important as they provide detection, deterrence, prevention, and/or correction, thereby improving an organization's security performance.

What are the three main types of information security controls mentioned in the script?

The three main types of information security controls mentioned are administrative, physical, and technical.

How can an organization ensure the confidentiality of oral information?

To ensure the confidentiality of oral information, confidential or sensitive conversations should take place in a secure area where unauthorized individuals cannot eavesdrop. Using a headset for phone conversations or computer-based meetings can also prevent eavesdropping.

What is the difference between information sanitization and information destruction as discussed in the script?

Information sanitization involves making information unreadable or inaccessible before sharing or disposal, such as blacking out text or overwriting electronic data. Information destruction, on the other hand, involves permanently destroying information so that it cannot be recovered, like shredding paper documents or drilling holes in hard drives.

Why is it important to apply security measures to all data as discussed in the script?

Applying security measures to all data is important because it helps mitigate risks and protects against various threats that could negatively impact an organization. These threats can come from natural disasters or human actions, and securing data ensures the organization's operations, image, or reputation are not adversely affected.

What are the four main ways in which risks can be addressed according to the script?

The four main ways in which risks can be addressed are risk elimination, risk mitigation, risk transfer, and risk acceptance.

What is the significance of having a plan in place for incidents involving ransomware or other types of attacks?

Having a plan in place for incidents involving ransomware or other types of attacks is significant because it helps organizations promptly respond to suspicious activities or incidents, reducing damage and protecting the organization from similar future attacks.

What is the recommendation of the FBI regarding the payment of ransoms in case of a ransomware attack?

The FBI does not recommend paying ransoms in case of a ransomware attack.

What should an individual do if they suspect they have been targeted by phishing or other social engineering attacks?

If an individual suspects they have been targeted by phishing or other social engineering attacks, they should slow down, verify the authenticity of the communication, and report any suspected phishing attempts to their organization's security or I.T. Department.