Lesson 16 - Group 3: Personnel Policies and Training

What areas may operational personnel policies cover?

Credential management, data handling, incident response, employee conduct, and respect for privacy.

What conduct policies are listed in Lesson 16?

Acceptable use, code of conduct, social-media use and analysis, personally owned devices, and clean-desk policies.

Why are untrained users considered a serious vulnerability?

They may be susceptible to social engineering and malware or mishandle sensitive information.

Who should receive security-awareness training?

End users, technical staff, executives, and employees at all organizational levels.

Role-based training

Security training tailored to the audience and the responsibilities of a particular job role.

What security-training techniques are listed?

Computer-based training, gamification, and phishing campaigns.

What security-awareness topics are listed?

Situational awareness, reporting and escalation, policies and handbooks, insider threats, password management, removable media and cables, and hybrid or remote work.

Why should security training be tailored to the audience?

Different users and roles encounter different responsibilities and security risk