* Security-awareness materials available at NoticeBored
A New Zealand consultancy called IsecT (standing for “security in IT”) runs a valuable Web site called NoticeBored that is anything but boring.
IsecT CEO Gary Hinson commented wryly to me when he fact-checked this article, “The NoticeBored name, by the way, relates to the idea that employees are bored to tears with first-generation security awareness messages (‘Think security!’ or ‘Be aware!’) on dog-eared posters that are never changed.” [Quick note to readers: I check my articles about other people’s work by sending them a draft before publication.]
The site includes samples of security-awareness posters that can be licensed; information about an ISO17799-compliant security-policy manual ($400); a collection of about 1,000 security links and a blog; and a variety of free materials.
Their “NB this month” section describes a wealth of purchasable security-awareness materials that can brighten up any organization’s program.
The theme for April is network security awareness. The introduction includes the thoughtful comment:
“It could be said that, conceptually, networks and information security are poles apart. Whereas in one view security majors on control and constraint of information assets, networking involves sharing and releasing them. Networks are inherently complex and dynamic, whereas security benefits from simplicity and stability. Reconciling such opposing forces is no easy task. It should be no surprise, then, that networking represents one of the most challenging areas of information security.”
The menu includes 27 files and you can see the whole list yourselves. Highlights (quoting excerpts directly from the Web page with most of the details left out):
AWARENESS MATERIALS FOR ALL EMPLOYEES
1. Security awareness seminar: network security (PPT [PowerPoint]) – Nine presentation slides and speaker notes support a general network security awareness seminar covering network security issues at the office, at home and at wireless network hotspots.
2. Security awareness posters: network security (HTML and graphics) – Six striking new high-resolution posters plus ten medium-resolution posters previously released. Our awareness posters are designed to promote and brand the security awareness program as a whole, intriguing and encouraging staff to seek out further information on network security.
3. Screensavers: network security (SCR)
4. Internet Acceptable Use Policy (DOC) [MS-Word; all other documents are DOCs unless otherwise indicated] – A generic Internet AUP, designed to stimulate a review of yours (assuming that you have one already!): does yours take account of current Internet/Web security threats?
5. Staff briefing: Web security
6. Staff guideline: securing home wireless networks
7. Case studies: network security – Two hypothetical but realistic network security scenarios are described. Questions are posed and model answers are provided to get the discussion going.
8. Take home messages: network security
9. Crossword puzzle: network security
10. Security awareness survey: network security – To what extent do your employees comprehend this month’s topic? Do they ‘get it’? Survey awareness using this data collection form to obtain useful statistics for the awareness program and solicit feedback comments and improvement suggestions.
11. Glossary: network security terms
12. Links: network security resources (free!)
AWARENESS MATERIALS FOR EXECUTIVE MANAGERS
13. Mind-maps: network security – A suite of Visio drawings, visually representing network security issues in the form of mind maps. The mind maps helped us think about and structure the content whilst researching and preparing the NoticeBored module, and are used to illustrate the awareness presentations and other materials.
14. Board agenda: network security
15. Model security policy: network security
16. Management presentation: network security (PPT)
17. Executive briefing: network security
18. Executive briefing: wireless network security
19. Management briefing: network security
20. Security metrics: measuring network security
AWARENESS MATERIALS FOR IT PROFESSIONALS
21. Newsletter: network security
22. Awareness program activities: network security
23. Technical seminar: network security (PPT) – Presentation slides plus speaker notes to facilitate a seminar discussion on the technical aspects of network security with IT professionals, perhaps a lunchtime session?
24. Technical briefing: network security controls
25. Technical briefing: secure wireless networking
26. White paper: 7-layer network security model
27. Internal controls review checklist: network security
I hope readers – especially those responsible for awareness, training and education – will take full advantage of this excellent material. The monthly modules are sold on a subscription basis for about the cost of a cup of coffee per employee per year (a reference to a comment by Richard Clarke, former special advisor to the president on cybersecurity, about organizations who spend less on security than on coffee deserving to be hacked).
Congratulations and thanks to IsecT for making these monthly banks of materials available to the community at reasonable costs.
