1. Information
Security
Liaison
Awareness Training
Kelley Bogart, CISSP
Senior Information Security Specialist
University Information Security Office

2. What is Information Security?
 Program
 Process (not a Project)
 Never 100%
 Risk Management
 Improve Security Posture
 Changing Security Landscape
 Threats (motives)
 Countermeasures

3. Goal of Information Security
To ensure the
confidentiality,
integrity and Protected
Confidential
availability Information
Information
(CIA) of critical &
systems and Critical
Systems
confidential
information

4. CIA Triad
transmission
To ensure To ensure the
dis
e
rag
protection accuracy and
po
sto
s
against completeness of
al
unauthorized information to
access to or use protect university
of confidential business
information processes
To ensure that information and vital services are
assessible for use when required

5. Information Security Domains
1. Access Control
2. Application Security
3. Business Continuity and Disaster Recovery Planning
4. Cryptography
5. Information Security and Risk Management
6. Legal, Regulations, Compliance and Investigations
7. Operations Security
8. Physical (Environmental) Security
9. Security Architecture and Design
10. Telecommunications and Network Security

6. 90/10 Rule
90%
People Process
Technology
10%

7. What is Security Awareness?
Security awareness is the knowledge, skill and attitude an individual
possesses regarding the protection of information assets.
Being Security Aware means you understand that there is the potential
for some people to deliberately or accidentally steal, damage, or
misuse your account, computer or the data stored on your computer.
Awareness of the risks and available safeguards is the first line of
defense for the security of information, systems and networks.

8. Security Awareness
Includes:
 Information about how to
 Protect
 Detect
 React
 Knowledge, Skill and Attitude
 The What
 The How
 The Why
 Include WIIFM What’s in it for me?
 Culture Change

9. State of the Internet

10. Defense in Depth
Anti-Virus Network Anti-Spyware
Host
Encrypted Session Controls
Communication Application
Limit Use of
“Privileged” Strong Passwords
Accounts
OS and App Physical
Patches Security

11. Account Access Controls
 Passwords
 Strong
 Not Shared
 Storage
 Accounts
 Limit use of Privileged Accounts
 Session Controls
 Password protected screensaver
 Ctrl-Alt Delete (enter) or Windows L

12. Wireless – On Campus
 Use only UAWifi (not public)
 Security (WPA2 & PEAP)
 No Rate or Port limitation
http://uawifi.arizona.edu

13. Use of Other Wireless
 Home
 Change default admin username and
password
 Configure to use encryption (avoid
WEP, use WPA or WPA2)
 Do not Broadcast SSID
 Ask your computer savvy friend to help
you configure your home wireless to
use encryption
 Wireless Security Page (on Computer
security resource hand out)
 Other
 Airports, Hotels, Conferences
 “Free” WiFi Hotspots

14. Surf Safely
 You know there are bad parts of town that
you don’t go to
 The Internet is the same way – be wary!

15. Surf “safer” w/ SiteAdvisor
http://www.siteadvisor.com/

16. www.siteadvisor.com

17. Latest Phishing Attempts

18. Latest Phishing Attempts

19. Questions?