The best defense against the increasing threat of social engineering attacks is Security Awareness Training to warn your organization's staff of the risk and educate them on how to protect your organization's data. Social engineering is not a new tactic, but Building an Security Awareness Program is the first book that shows you how to build a successful security awareness training program from the ground up.
Building an Security Awareness Program provides you with a sound technical basis for developing a new training program. The book also tells you the best ways to garner management support for implementing the program. Author Bill Gardner is one of the founding members of the Security Awareness Training Framework. Here, he walks you through the process of developing an engaging and successful training program for your organization that will help you and your staff defend your systems, networks, mobile devices, and data.
Forewords written by Dave Kennedy and Kevin Mitnick!
- The most practical guide to setting up a Security Awareness training program in your organization
- Real world examples show you how cyber criminals commit their crimes, and what you can do to keep you and your data safe
- Learn how to propose a new program to management, and what the benefits are to staff and your company
- Find out about various types of training, the best training cycle to use, metrics for success, and methods for building an engaging and successful program
Recenzijas
"...a blueprint for creating a highly practical and effectiveness awareness programme that could do so much more to protect your organisation than tens of thousand of dollars spent on shiny new security hardware." --Network Security
"...a comprehensive introduction to the human factors that have an impact on the delivery of effective security, as well as practical proposals for the defense against social engineering and technical threats." --Computing Reviews
"I have been reading about this subject for a while now and, in my modest opinion, this is one of the best books out there covering it... every chapter holds some additional, practical information about each topic." --Help Net Security
Papildus informācija
A practical guide to implementing Information Security Awareness Training in your organization
| Forewords |
|
xi | |
| Preface |
|
xv | |
| About The Authors |
|
xvii | |
| Acknowledgments |
|
xix | |
| Chapter 1 What Is a Security Awareness Program? |
|
1 | (8) |
|
|
|
1 | (3) |
|
|
|
4 | (1) |
|
|
|
4 | (1) |
|
|
|
5 | (1) |
|
|
|
5 | (1) |
|
|
|
6 | (1) |
|
|
|
7 | (2) |
| Chapter 2 Threat |
|
9 | (6) |
|
The Motivations of Online Attackers |
|
|
9 | (1) |
|
|
|
9 | (1) |
|
Industrial Espionage/Trade Secrets |
|
|
10 | (1) |
|
|
|
10 | (1) |
|
|
|
11 | (1) |
|
|
|
12 | (1) |
|
|
|
12 | (3) |
| Chapter 3 Cost of a Data Breach |
|
15 | (10) |
|
|
|
15 | (1) |
|
|
|
15 | (4) |
|
The Payment Card Industry Data Security Standard (PCI DSS) |
|
|
19 | (1) |
|
State Breach Notification Laws |
|
|
20 | (3) |
|
|
|
23 | (2) |
| Chapter 4 Most Attacks Are Targeted |
|
25 | (8) |
|
|
|
25 | (1) |
|
|
|
26 | (1) |
|
Targeted Attacks Against Law Firms |
|
|
26 | (2) |
|
|
|
28 | (1) |
|
|
|
29 | (1) |
|
|
|
30 | (1) |
|
|
|
30 | (1) |
|
Common Attack Vectors: Common Results |
|
|
31 | (1) |
|
|
|
32 | (1) |
| Chapter 5 Who Is Responsible for Security? |
|
33 | (6) |
|
Information Technology (IT) Staff |
|
|
33 | (1) |
|
|
|
34 | (1) |
|
|
|
34 | (1) |
|
|
|
34 | (1) |
|
|
|
35 | (1) |
|
|
|
35 | (1) |
|
|
|
35 | (1) |
|
Everyone Is Responsible For Security |
|
|
35 | (2) |
|
|
|
37 | (2) |
| Chapter 6 Why Current Programs Don't Work |
|
39 | (6) |
|
The Lecture Is Dead as a Teaching Tool |
|
|
39 | (4) |
|
|
|
43 | (2) |
| Chapter 7 Social Engineering |
|
45 | (20) |
|
What is Social Engineering? |
|
|
45 | (1) |
|
Who are Social Engineers? |
|
|
46 | (1) |
|
|
|
46 | (1) |
|
|
|
46 | (1) |
|
|
|
47 | (2) |
|
Attack Planning and Execution |
|
|
49 | (3) |
|
The Social Engineering Defensive Framework (SEDF) |
|
|
52 | (11) |
|
Where Can I Learn More About Social Engineering? |
|
|
63 | (1) |
|
|
|
63 | (2) |
| Chapter 8 Physical Security |
|
65 | (16) |
|
What is Physical Security? |
|
|
65 | (1) |
|
|
|
66 | (1) |
|
Threats to Physical Security |
|
|
67 | (1) |
|
Why Physical Security is Important to an Awareness Program |
|
|
67 | (1) |
|
How Physical Attacks Work |
|
|
68 | (11) |
|
Minimizing the Risk of Physical Attacks |
|
|
79 | (1) |
|
|
|
80 | (1) |
| Chapter 9 Types of Training |
|
81 | (8) |
|
|
|
81 | (1) |
|
|
|
81 | (4) |
|
|
|
85 | (2) |
|
|
|
87 | (2) |
| Chapter 10 The Training Cycle |
|
89 | (6) |
|
|
|
89 | (1) |
|
|
|
89 | (1) |
|
|
|
90 | (1) |
|
|
|
90 | (1) |
|
|
|
90 | (1) |
|
|
|
91 | (1) |
|
|
|
91 | (1) |
|
|
|
92 | (1) |
|
Adjusting Your Training Cycle |
|
|
93 | (1) |
|
|
|
93 | (2) |
| Chapter 11 Creating Simulated Phishing Attacks |
|
95 | (14) |
|
Simulated Phishing Attacks |
|
|
95 | (1) |
|
Understanding the Human Element |
|
|
95 | (1) |
|
|
|
95 | (1) |
|
Open-Source Tool, Commercial Tool, or Vendor Performed? |
|
|
96 | (4) |
|
|
|
100 | (1) |
|
Determine Attack Objective |
|
|
101 | (1) |
|
|
|
102 | (1) |
|
Select a Type of Phishing Attack |
|
|
102 | (1) |
|
|
|
103 | (1) |
|
Creating the Landing Page |
|
|
104 | (1) |
|
|
|
105 | (1) |
|
|
|
106 | (1) |
|
Post Assessment Follow-up |
|
|
107 | (1) |
|
|
|
107 | (2) |
| Chapter 12 Bringing It All Together |
|
109 | (10) |
|
Create a Security Awareness Website |
|
|
109 | (1) |
|
|
|
110 | (6) |
|
Promoting Your Awareness Program |
|
|
116 | (1) |
|
|
|
117 | (2) |
| Chapter 13 Measuring Effectiveness |
|
119 | (6) |
|
|
|
119 | (1) |
|
|
|
119 | (1) |
|
|
|
119 | (2) |
|
|
|
121 | (1) |
|
|
|
122 | (2) |
|
|
|
124 | (1) |
| Chapter 14 Stories from the Front Lines |
|
125 | (34) |
|
|
|
125 | (3) |
|
|
|
128 | (5) |
|
|
|
133 | (2) |
|
Security Research at Large Information Security Company |
|
|
135 | (2) |
|
|
|
137 | (3) |
|
|
|
140 | (11) |
|
Security Analyst at a Network Security Company |
|
|
151 | (3) |
|
|
|
154 | (5) |
| Appendices |
|
159 | (32) |
| Index |
|
191 | |
Bill Gardner is an Assistant Professor at Marshall University, where he teaches information security and foundational technology courses in the Department of Integrated Science and Technology. He is also President and Principal Security Consultant at BlackRock Consulting. In addition, Bill is Vice President and Information Security Chair at the Appalachian Institute of Digital Evidence. AIDE is a non-profit organization that provides research and training for digital evidence professionals including attorneys, judges, law enforcement officers and information security practitioners in the private sector. Prior to joining the faculty at Marshall, Bill co-founded the Hack3rCon convention, and co-founded 304blogs, and he continues to serve as Vice President of 304Geeks. In addition, Bill is a founding member of the Security Awareness Training Framework, which will be a prime target audience for this book. Valerie Thomas is a Senior Information Security Consultant for Securicon LLC that specializes in social engineering and physical penetration testing. After obtaining her bachelor's degree in Electronic Engineering, Valerie led information security assessments for the Defense Information Systems Agency (DISA) before joining private industry. Her skill set also includes intrusion detection, endpoint protection, data loss prevention, and mobile security. Throughout her career, Valerie has conducted penetration tests, vulnerability assessments, compliance audits, and technical security training for executives, developers, and other security professionals.
Biežāk uzdotie jautājumi par e-grāmatām