Index
Note: Page numbers followed by f indicate figures.
A
announcements 117
campaigns 40
consistent program 141
contests and prizes 116–117
cost savings 135
deployment 122
e-mail signature 147
enforcement 4–5
experience 137–138
forensics and security 141
HIPAA Security Rule 18
homemade video campaign 86–87
planned program 141
polygraph examiner 148
quarterly training 90
receptionists 34
RSA breach 1–2
security researcher 125–126
SET 2
social engineering and nontechnical attacks 126
B
Blue Cross Blue Shield of Tennessee (BCBST) 19
Bragging rights 12
Bronze Soldier of Tallinn 11
C
CBT See Computer-based training (CBT)
Chief Information Security Officer (CISO) 100–101
Commercial security awareness training resources 161
Computer-based training (CBT) 83
Bronze Soldier of Tallinn 11
definition 11
espionage 12
D
HIPAA 15–19
notification laws 20–23
PCI DSS 19–20
Ponemon Institute 15
savings 5
E
Chinese hackers and industrial espionage 36
corporate network 30
education 138
law firm’s computer system 36
midlevel managers, organization 37
network defenders 37
personal information 37
social media sites 36–37
VOHO attack 30
F
FBI alerted lawfirms 26–28
Health Breach notification rule 180
HIPAA business associate 187–188
law enforcement officials 188
nation’s consumer protection agency 181
notification requirement 182–183
personal health records 181–182
PHR-related entity 183
third-party service provider 182
CBT 83
in-person See (Instructor-led training)
video 85
WBT 83–85
G
Government resources 159–160
H
anonymous users 11
iPhone “jailbreak” 10
political causes 10
PSN 10
Hands-on learning 41
definition 15
and DHHS 16
“Health Care Law Blog” 18
implementation specifications 16
privacy and security rules 19
business associate 178–179
definition 175–176
FTC 180
media notice 177
secretary 177–178
unsecured protected health information and guidance 176
I
Industrial espionage 10
homemade video campaign 86–87
lunch and learn sessions 85–86
articles 190
recorded presentations 190
Instructor-led training 81–83
active and passive 39
password policy 42
security team 115
segments and quizzes 84–85
styles 41
tools 40
Internet Crime Complaint Center (IC3), FBI 27–28
K
Kali Linux 162
L
creation 104–105
and e-mail 98
graphic tool 98
KnowBe4 105f
biannual training 115
continual training 115–116
new hire training 114
phishing assessment 116
control 66
detection 67
deterrence 66
identification 67
biannual training 110–111
continual training 111
new hire training 110
phishing assessment 111
M
Mailroom/copy center 35
long-term users 98
management 126
measurements, phishing detection 120
names 120
reporting See (Reporting, metrics)
security team 121
biannual training 112–113
continual training 113
new hire training 112
phishing assessment 113–114
data breaches 5
marketing 148
online attackers 9
organization 35
scam 27
security awareness program 7
and time 42–43
N
National Cyber Security Awareness Month (NCSAM) 117
Network security company, security analyst 151–154
Night Dragon attacks 30
O
company website 71
maps 69–71
real estate companies 71
social media 72
tax records 71
cyber war 11–12
hacktivism 10–11
industrial espionage 10
money 9
organization defenses 2
personal and financial information 9
real estate meeting 73–74
RFID credential stealing 74–77
surveillance 72–73
Operation Aurora 29
P
Peer-instruction 39
Phishing attacks See also Simulated phishing assessment
awareness 83–84
company-specific attacks 102–103
domain purchases 62
e-mail 50–51
employees knowledge 56
general attacks 102
network and host operating system 58
organization’s accounting department 35
and phone assessments 55
RSA SecurID 1–2
simulated attack 95
spear phishing e-mail 103
stamp collecting e-mails 25
assessments See (Red Team)
attack execution phase 78
awareness program 67–68
inner perimeter 65
interior level 65
layers 66–67
outer perimeter 65
planning phase attack 78
policies 34
threats 67
Jerry, the attacker 49
spear phishing e-mail 50–51
PlayStation Network (PSN) 10
PSN See PlayStation Network (PSN)
R
Receptionist, defense 34
off-site See (Off-site reconnaissance)
on-site 72–77
authorization letter 79–80
objective 79
off-limits areas 79
schedule 79
program description 122
unauthorized entry prevention 74
S
Search engines 48
articles 190
network analyst 128
recorded presentations 190
red and blue team 133
security posture 129
“Smart Grid Pioneer” 154–155
social engineering 126
communications/social media team 165
component definition 166
deliverables 163
documentation/artifact team 164
history 165
mission 165–166
purpose/project charter 162
research/outreach team 164–165
standardized reporting metrics 167–168
subteams and committees 163–164
taxonomy/classification team 164
Security research, information security company 135–137
SET See Social-Engineer Toolkit (SET)
Shady RAT operation 28–29
commercial tool 98–100
high-level methodology 95–96
objective 101
open-sourced software/tools 96–98
recipients selection 102
sending, e-mail 105–106
tracking 106
as training tools 95
types 102–103
vendor performance 100
attack cycle phases 46
description 45
help desk 51–52
information gathering 47–49
internal phishing campaign 136
media See (Social media)
persuasion and deception 45
popular spot 49
psychological makeup 46
search engines 48
security awareness program 1
SEDF 52–62
timing 50
defense evaluation 54–55
education, employees 55–57
exposure determination 53–54
technology and policy 57–61
policies and procedures 2
PowerShell 130
technical tool 2
technical tools, security awareness programs 162
website cloning 2
assessment team 72
Facebook and Twitter 48
LinkedIn 48
NCSAM 117
password reset 48
safety 56
scams 36–37
SpearPhisher 162
State security breach notification laws 170–171
T
after-action phase 61
design phase 57–60
execution phase 60–61
Chinese hackers 36
defense and government contracting 26
description 25
e-mail 25
against law firms 26–28
password reset 33
RSA breach 26
Shady Rat 28–29
spear phishing 31
state breach notification laws 31
TJX breach 37
training 91–92
Targeted training, security 91–92
adjustment 93
biannual 90
continual training 90–91
embedded 91
minimal 92
moderate 92
quarterly security awareness 90
robust 92
security analyst 152
U
URL See Uniform resource locator (URL)
V
Video training 85
W
Watering hole attacks 30–31
Web-based training (WBT) 83–85
Web resources and links 161
Website, security awareness 109–110
computerized personal information 173–174
notification procedures 23
security breach notice requirements 174
..................Content has been hidden....................
You can't read the all page of ebook, please click here login for view all page.