Defensive Security Handbook, 2nd Edition

Appendix. User Education Templates

Live Phishing Education Slides

This template (or one like it created by you and your team!) can be used when auto-directing users after a live phishing campaign, as well as for normal instruction.

You’ve Been Hacked!

But it’s OK...and it was only a quiz (the real test is from an attacker). (Click the arrows for more info!)

What Just Happened, and Why?

• Did you know: real attackers are making these same attempts all the time against our network?

• We’d rather help ourselves become stronger before the attackers can help themselves to our patients’ data.

• No matter how many advanced technical hurdles internet security puts in place, the best defense is always an alert member of the team (you!).

• Classroom is theory—treating that first patient wasn’t. It’s better to practice when it’s safe.

Social Engineering 101(0101)

Computers are black and white, on or off; humans aren’t, so unfortunately we present a better target to attackers:

• RSA (security company) hacked in 2011 via email
• HBGary (security company) hacked in 2011 via reused passwords and email
• Google/Adobe—hacked, operation Aurora 2010

So It’s OK That You Were Exploited (This Time)

• If people who work for computer technology companies—some of which specialize in security—fall for attacks, it’s to be expected that you would fall for similar attacks as well.

• We get better with practice; this is an opportunity for that practice.

No Blame, No Shames, Just...

• You work for ...