Initial Cyber Security Briefing
|
|
|
- Richard French
- 10 years ago
- Views:
Transcription
1 Initial Cyber Security Briefing For New Hires, Visitors, and Contractors NT Chief Information Officer Division Cyber Security Department
2 GOAL Introduce cyber security requirements at Pantex as outlined in the Cyber Security Resource Manual (MNL-00070) 2
3 The Role of Cyber Security To assure that effective Cyber Security policies, procedures, and countermeasures are implemented in accordance with federal requirements and risk-based decisions, and guarantee the integrity, availability, and confidentiality of our information and systems In other words, to protect our nation s nuclear information 3
4 Who Must Comply with Cyber Security Requirements Everyone on Plant site Who will use or have access to Pantex computing resources Must have some form of training before using such resources If you will be onsite over 10 working days: Required to take CB within three weeks of this briefing or your computer access will be suspended. You must work with your Division Training Officer to complete this training 4
5 Primary Governing Document Cyber Security Resource Manual, MNL Informs Users of: Policies Procedures Practices Work Instructions amplify processes 5
6 Primary Governing Document (cont.) The Cyber Security Resource Manual, MNL can be found on the: Cyber Security internal web page Universal Content Manager (UCM) 6
7 Cyber Security Concerns #1 Threat - The Insider The deliberate insider or The accidental insider I m Late! I m Late! 7
8 Cyber Security Concerns (cont.) You can become an accidental insider if you: Are too busy, have a deadline to meet Don t lock your computer system Leave unprotected information on your desk Don t think the rules apply to you Don t become part of the problem Protection of computer resources and our nation s information depends on YOU! 8
9 Cyber Security Concerns (cont.) Phishing, Spear-phishing, and SPAM NEVER OPEN from an unknown source NEVER respond to requests for personal data NEVER click on embedded links Don t put your Pantex out for harvesting Send SPAM to [email protected] (see our web page for instructions) 9
10 Cyber Security Concerns (cont.) Controlled Unclassified Information (CUI) Official Use Only (OUO) Unclassified Controlled Nuclear Information (UCNI) All require special protection Never send it via unless it is encrypted with an approved application (Entrust or PointSec, or WinZip Pro) UNCLASSIFIED CONTROLLED NUCLEAR INFORMATION (UCNI) NOT FOR PUBLIC DISSEMINATION 10
11 Cyber Security Concerns (cont.) Personally Identifiable Information (PII) Anything that identifies you Never send it via unless it is encrypted with an approved application (Entrust or PointSec or WinZip Pro) BE CAREFUL about responding to s with PII o Don t hit Reply without removing the PII 11
12 Misuse of Computer Resources and the Consequences Official business use only Exceptions: o Approved educational activities (after or before work hours) o Participation in Company-supported activities United Way Christmas Project Employee Events Council Consequences: Up to and including termination 12
13 Misuse of Computer Resources and the Consequences (cont.) You need to know Cyber Security monitors: Internal and external systems Pages Unauthorized use/internet usage Passwords that don t meet criteria transmissions Classified information Unencrypted CUI Embedded or attached pictures There is NO expectation of privacy 13
14 Misuse of Computer Resources and the Consequences (cont.) Some issues that generate a Cyber Incident / Security Infraction 1. Compromise of passwords Never write down a password Never share a password Classified and unclassified passwords must never be the same 2. Abuse or misuse of Internet access 3. Sending CUI Information off-site without encryption 4. Contamination of unclassified system with classified data 5. Viewing/saving sexually explicit/suggestive material 14
15 Misuse of Computer Resources and the Consequences (cont.) If you know of or witness an incident, you MUST report it immediately to the Cyber Security Inquiry Official at extension
16 Items of Cyber Interest Unapproved Items The following personally owned articles are prohibited in the Security Areas (Property Protected, Limited, Protected, and Material Access Areas): Wireless keyboards Laptops Software of any type, including screensavers 16
17 Items of Cyber Interest (cont.) Approved Items on unclassified computer systems only IronKey thumb drives are the only thumb drives approved for read/write use Personal thumb drives are approved for read access only Music CDs/DVDs 17
18 How to get Help with Cyber Security Issues Getting help with Cyber Security issues is easy! Call the Cyber Hotline, extension 7060 Go to our Cyber Web Page (Our Functions / Information Technology / Cyber Security) 18
19 Purpose of the Code of Conduct Statement Code of Conduct Statement for Computer Users Federal requirements state that all personnel must be trained in the general requirements for protection of our computing resources 19
20 Purpose of the Code of Conduct Statement (cont.) When you sign the Code of Conduct you are confirming that you: Agree to comply with all rules and procedures for use of Pantex information resources Will use the computer system for official business use only Accept your responsibility for protecting government computing resources and information it processes 20
21 Things to Remember 21
22 Conclusion You are responsible, but we are here to help. Please ask before you act! Questions and Answers! 22
Introduction to Computer Security
Introduction to Computer Security Rev. Sept 2015 What is Computer Security? 2 Computer Security is the protection of computing systems and the data that they store or access 3 Why is Computer Security
How To Protect Decd Information From Harm
Policy ICT Security Please note this policy is mandatory and staff are required to adhere to the content Summary DECD is committed to ensuring its information is appropriately managed according to the
How To Protect Your Information From Being Hacked By A Hacker
DOL New Hire Training: Computer Security and Privacy Table of Contents Introduction Lesson One: Computer Security Basics Lesson Two: Protecting Personally Identifiable Information (PII) Lesson Three: Appropriate
WIRELESS LOCAL AREA NETWORK (WLAN) IMPLEMENTATION
United States Department of Agriculture Marketing and Regulatory Programs Grain Inspection, Packers and Stockyards Administration Directive GIPSA 3140.5 11/30/06 WIRELESS LOCAL AREA NETWORK (WLAN) IMPLEMENTATION
HFS DATA SECURITY TRAINING
HFS DATA SECURITY TRAINING WITH TECHNOLOGY COMES RESPONSIBILITY Illinois Department of Healthcare and Family Services Training Outline: Training Goals What is the HIPAA Security Rule? What is the HFS Identity
Peace Corps Office of the OCIO Information and Information Technology Governance and Compliance Rules of Behavior for General Users
Table of Contents... 1 A. Accountability... 1 B. System Use Notification (Login Banner)... 1 C. Non-... 1 D. System Access... 2 E. User IDs... 2 F. Passwords... 2 G. Electronic Information... 3 H. Agency
How To Protect The Time System From Being Hacked
WISCONSIN TIME SYSTEM Training Materials TIME SYSTEM SECURITY AWARENESS HANDOUT Revised 11/21/13 2014 Security Awareness Handout All System Security The TIME/NCIC Systems are criminal justice computer
Belmont Savings Bank. Are there Hackers at the gate? 2013 Wolf & Company, P.C.
Belmont Savings Bank Are there Hackers at the gate? 2013 Wolf & Company, P.C. MEMBER OF PKF NORTH AMERICA, AN ASSOCIATION OF LEGALLY INDEPENDENT FIRMS 2013 Wolf & Company, P.C. About Wolf & Company, P.C.
Computer Security Incident Reporting and Response Policy
SECTION: 3.8 SUBJECT: Computer Security Incident Reporting and Response Policy AUTHORITY: Executive Director; Chapter 282.318, Florida Statutes - Security of Data and Information Technology Resources;
DRAFT National Rural Water Association Identity Theft Program Model September 22, 2008
DRAFT National Rural Water Association Identity Theft Program Model September 22, 2008 This model has been designed to help water and wastewater utilities comply with the Federal Trade Commission s (FTC)
Appendix H: End User Rules of Behavior
Appendix H: End User Rules of Behavior 1. Introduction The Office of Management and Budget (OMB) has established the requirement for formally documented Rules of Behavior as set forth in OMB Circular A-130.
SUPREME COURT OF COLORADO OFFICE OF THE CHIEF JUSTICE
SUPREME COURT OF COLORADO OFFICE OF THE CHIEF JUSTICE Directive Concerning the Colorado Judicial Department Electronic Communications Usage Policy: Technical, Security, And System Management Concerns This
13. Acceptable Use Policy
To view the complete Information and Security Policies and Procedures, log into the Intranet through the IRSC.edu website. Click on the Institutional Technology (IT) Department link, then the Information
Department of Defense INSTRUCTION. Security of Unclassified DoD Information on Non-DoD Information Systems
Department of Defense INSTRUCTION NUMBER 8582.01 June 6, 2012 DoD CIO SUBJECT: Security of Unclassified DoD Information on Non-DoD Information Systems References: See Enclosure 1 1. PURPOSE. This Instruction:
Identity Theft Prevention Program Compliance Model
September 29, 2008 State Rural Water Association Identity Theft Prevention Program Compliance Model Contact your State Rural Water Association www.nrwa.org Ed Thomas, Senior Environmental Engineer All
HIPAA and Health Information Privacy and Security
HIPAA and Health Information Privacy and Security Revised 7/2014 What Is HIPAA? H Health I Insurance P Portability & A Accountability A - Act HIPAA Privacy and Security Rules were passed to protect patient
Guide to INFORMATION SECURITY FOR THE HEALTH CARE SECTOR
Guide to INFORMATION SECURITY FOR THE HEALTH CARE SECTOR Information and Resources for Small Medical Offices Introduction The Personal Health Information Protection Act, 2004 (PHIPA) is Ontario s health-specific
National Cyber Security Month 2015: Daily Security Awareness Tips
National Cyber Security Month 2015: Daily Security Awareness Tips October 1 New Threats Are Constantly Being Developed. Protect Your Home Computer and Personal Devices by Automatically Installing OS Updates.
How To Encrypt a File using Windows Explorer and WinZip. For Use With All PII Data
How To Encrypt a File using Windows Explorer and WinZip For Use With All PII Data As an employee or a contractor, you share in the responsibility for protecting the privacy of individuals whose information
General Rules of Behavior for Users of DHS Systems and IT Resources that Access, Store, Receive, or Transmit Sensitive Information
General Rules of Behavior for Users of DHS Systems and IT Resources that Access, Store, Receive, or Transmit Sensitive Information The following rules of behavior apply to all Department of Homeland Security
Information Security Awareness Training and Phishing
Information Security Awareness Training and Phishing Audit Report Report Number IT-AR-16-001 October 5, 2015 Highlights The Postal Service s information security awareness training related to phishing
Information Security: Roles, Responsibilities, and Data Classification. Technology Services 1/4/2013
Information Security: Roles, Responsibilities, and Data Classification Technology Services 1/4/2013 Roles, Responsibilities, and Data Classification The purpose of this session is to: Establish that all
PCI DSS Policies Outline. PCI DSS Policies. All Rights Reserved. ecfirst. 2010. Page 1 of 7 www.ecfirst.com
Policy/Procedure Description PCI DSS Policies Install and Maintain a Firewall Configuration to Protect Cardholder Data Establish Firewall and Router Configuration Standards Build a Firewall Configuration
MONTSERRAT COLLEGE OF ART WRITTEN INFORMATION SECURITY POLICY (WISP)
MONTSERRAT COLLEGE OF ART WRITTEN INFORMATION SECURITY POLICY (WISP) 201 CMR 17.00 Standards for the Protection of Personal Information Of Residents of the Commonwealth of Massachusetts Revised April 28,
HFS DATA SECURITY TRAINING WITH TECHNOLOGY COMES RESPONSIBILITY
HFS DATA SECURITY TRAINING WITH TECHNOLOGY COMES RESPONSIBILITY Illinois Department of Healthcare and Family Services Training Outline: Training Goals What is the HIPAA Security Rule? What is the HFS Identity
Acceptable Use Guidelines
Attachment to the Computer and Information Security and Information Management Policies Acceptable Use Guidelines NZQA Quality Management System Supporting Document Purpose These Acceptable Use Guidelines
Overview of the HIPAA Security Rule
Office of the Secretary Office for Civil Rights () Overview of the HIPAA Security Rule Office for Civil Rights Region IX Alicia Cornish, EOS Sheila Fischer, Supervisory EOS Topics Upon completion of this
REVISION: This directive supersedes TSA MD 3700.4, Handling Sensitive Personally Identifiable Information, dated March 13, 2008.
OFFICE OF THE SPECIAL COUNSELOR Privacy TSA MANAGEMENT DIRECTIVE No. 3700.4 To enhance mission performance, TSA is committed to promoting a culture founded on its values of Integrity, Innovation and Team
Cyber Security Best Practices
Cyber Security Best Practices 1. Set strong passwords; Do not share them with anyone: They should contain at least three of the five following character classes: o Lower case letters o Upper case letters
APPROVED BY: DATE: NUMBER: PAGE: 1 of 9
1 of 9 PURPOSE: To define standards for appropriate and secure use of MCG Health electronic systems, specifically e-mail systems, Internet access, phones (static or mobile; including voice mail) wireless
Working Practices for Protecting Electronic Information
Information Security Framework Working Practices for Protecting Electronic Information 1. Purpose The following pages provide more information about the minimum working practices which seek to ensure that
Acceptable Use Policy
Acceptable Use Policy TABLE OF CONTENTS PURPOSE... 4 SCOPE... 4 AUDIENCE... 4 COMPLIANCE & ENFORCEMENT... 4 POLICY STATEMENTS... 5 1. General... 5 2. Authorized Users... 5 3. Loss and Theft... 5 4. Illegal
IA/CYBERSECURITY IS CRITICAL TO OPERATE IN CYBERSPACE
IA/CYBERSECURITY IS CRITICAL TO OPERATE IN CYBERSPACE Commanders, leaders, and managers are responsible for ensuring that Information Assurance/Cybersecurity is part of all Army operations, missions and
Ginnie Mae Enterprise Portal (GMEP) User Registration for Custodian ONLY
Ginnie Mae Enterprise Portal (GMEP) User Registration for Custodian ONLY Instructions (1) Complete the information in the boxes below please print. (2) Select the requested roles(s). (3) Read the User
Central Texas College District Human Resource Management Operating Policies and Procedures Manual Policy No. 294: Computer Security Policy
Central Texas College District Human Resource Management Operating Policies and Procedures Manual Policy No. 294: Computer Security Policy I. PURPOSE To identify the requirements needed to comply with
Clear Creek ISD 084910 CQ (REGULATION) Business and Support Services: Electronic Communications
Clear Creek ISD 084910 CQ (REGULATION) SCOPE CONSENT REQUIREMENTS CHIEF TECHNOLOGY OFFICER RESPONSIBILITIES The Superintendent or designee will oversee the District s electronic communications system.
TASK -040. TDSP Web Portal Project Cyber Security Standards Best Practices
Page 1 of 10 TSK- 040 Determine what PCI, NERC CIP cyber security standards are, which are applicable, and what requirements are around them. Find out what TRE thinks about the NERC CIP cyber security
Countering and reducing ICT security risks 1. Physical and environmental risks
Countering and reducing ICT security risks 1. Physical and environmental risks 1. Physical and environmental risks Theft of equipment from staff areas and Theft of equipment from public areas Theft of
Acceptable Use of ICT Policy. Staff Policy
Acceptable Use of ICT Policy Staff Policy Contents INTRODUCTION 3 1. ACCESS 3 2. E-SAFETY 4 3. COMPUTER SECURITY 4 4. INAPPROPRIATE BEHAVIOUR 5 5. MONITORING 6 6. BEST PRACTICE 6 7. DATA PROTECTION 7 8.
INFORMATION TECHNOLOGY SECURITY POLICY COUNTY OF IMPERIAL
INFORMATION TECHNOLOGY SECURITY POLICY COUNTY OF IMPERIAL 1 INTRODUCTION The County of Imperial Information & Technical Services (ITS) Security Policy is the foundation of the County's electronic information
HIPAA Compliance Evaluation Report
Jun29,2016 HIPAA Compliance Evaluation Report Custom HIPAA Risk Evaluation provided for: OF Date of Report 10/13/2014 Findings Each section of the pie chart represents the HIPAA compliance risk determinations
PHI- Protected Health Information
HIPAA Policy 2014 The Health Insurance Portability and Accountability Act is a federal law that protects the privacy and security of patients health information and grants certain rights to patients. Clarkson
So the security measures you put in place should seek to ensure that:
Guidelines This guideline offers an overview of what the Data Protection Act requires in terms of information security and aims to help you decide how to manage the security of the personal data you hold.
Information Security and Electronic Communications Acceptable Use Policy (AUP)
Policy No.: AUP v2.0 Effective Date: August 16, 2004 Revision Date: January 17, 2013 Revision No.: 1 Approval jwv / mkb Information Security and Electronic Communications (AUP) 1. INTRODUCTION Southwestern
Information Security It s Everyone s Responsibility
Information Security It s Everyone s Responsibility Developed By The University of Texas at Dallas (ISO) Purpose of Training As an employee, you are often the first line of defense protecting valuable
MCOLES Information and Tracking Network. Security Policy. Version 2.0
MCOLES Information and Tracking Network Security Policy Version 2.0 Adopted: September 11, 2003 Effective: September 11, 2003 Amended: September 12, 2007 1.0 POLICY STATEMENT The Michigan Commission on
SECTION: SUBJECT: PCI-DSS General Guidelines and Procedures
1. Introduction 1.1. Purpose and Background 1.2. Central Coordinator Contact 1.3. Payment Card Industry Data Security Standards (PCI-DSS) High Level Overview 2. PCI-DSS Guidelines - Division of Responsibilities
LSE PCI-DSS Cardholder Data Environments Information Security Policy
LSE PCI-DSS Cardholder Data Environments Information Security Policy Written By: Jethro Perkins, Information Security Manager Reviewed By: Ali Lindsley, PCI-DSS Project Manager Endorsed By: PCI DSS project
Security Management. Keeping the IT Security Administrator Busy
Security Management Keeping the IT Security Administrator Busy Dr. Jane LeClair Chief Operating Officer National Cybersecurity Institute, Excelsior College James L. Antonakos SUNY Distinguished Teaching
DHHS Information Technology (IT) Access Control Standard
DHHS Information Technology (IT) Access Control Standard Issue Date: October 1, 2013 Effective Date: October 1,2013 Revised Date: Number: DHHS-2013-001-B 1.0 Purpose and Objectives With the diversity of
The Department of Health and Human Services Privacy Awareness Training. Fiscal Year 2015
The Department of Health and Human Services Privacy Awareness Training Fiscal Year 2015 Course Objectives At the end of the course, you will be able to: Define privacy and explain its importance. Identify
Know the Risks. Protect Yourself. Protect Your Business.
Protect while you connect. Know the Risks. Protect Yourself. Protect Your Business. GETCYBERSAFE TIPS FOR S MALL AND MEDIUM BUSINESSES If you re like most small or medium businesses in Canada, the Internet
PROPOSED PROCEDURES FOR AN IDENTITY THEFT PROTECTION PROGRAM Setoff Debt Collection and GEAR Collection Programs
PROPOSED PROCEDURES FOR AN IDENTITY THEFT PROTECTION PROGRAM Setoff Debt Collection and GEAR Collection Programs The Identity Theft and Fraud Protection Act (Act No. 190) allows for the collection, use
At Cambrian, Your Privacy is Our Priority. Regardless of how you deal with us on the phone, online, or in person we have strict security measures
Privacy Policy At Cambrian, Your Privacy is Our Priority At Cambrian Credit Union, we know our members are concerned about the confidentiality and security of their personal information. This Policy ensures
Security Solutions for HIPAA Compliance
Security Solutions for HIPAA Compliance www.currentware.com 613-368-4300 [email protected] In today s digital and mobile age, the healthcare sector is susceptible to increasing vulnerabilities of exposing
Appendix A: Rules of Behavior for VA Employees
Appendix A: Rules of Behavior for VA Employees Department of Veterans Affairs (VA) National Rules of Behavior 1 Background a) Section 5723(b)(12) of title 38, United States Code, requires the Assistant
Intel Enhanced Data Security Assessment Form
Intel Enhanced Data Security Assessment Form Supplier Name: Address: Respondent Name & Role: Signature of responsible party: Role: By placing my name in the box above I am acknowledging that I am authorized
DEPARTMENT OF DEFENSE 6000 DEFENSE PENTAGON WASHINGTON, D.C. 20301-6000
DEPARTMENT OF DEFENSE 6000 DEFENSE PENTAGON WASHINGTON, D.C. 20301-6000 CHIEF INFORMATION OFFICER October 1, 2015 MEMORANDUM FOR SECRETARIES OF THE MILITARY DEPARTMENTS CHAIRMAN OF THE JOINT CHIEFS OF
CREDIT CARD SECURITY POLICY PCI DSS 2.0
Responsible University Official: University Compliance Officer Responsible Office: Business Office Reviewed Date: 10/29/2012 CREDIT CARD SECURITY POLICY PCI DSS 2.0 Introduction and Scope Introduction
B. Privacy. Users have no expectation of privacy in their use of the CPS Network and Computer Resources.
Chicago Public Schools Policy Manual Title: ACCEPTABLE USE OF THE CPS NETWORK AND COMPUTER RESOURCES Section: 604.1 Board Report: 09-0722-PO3 Date Adopted: July 22, 2009 Policy: THE CHIEF EXECUTIVE OFFICER
BSHSI Security Awareness Training
BSHSI Security Awareness Training Originally developed by the Greater New York Hospital Association Edited by the BSHSI Education Team Modified by HSO Security 7/1/2008 1 What is Security? A requirement
Estate Agents Authority
INFORMATION SECURITY AND PRIVACY PROTECTION POLICY AND GUIDELINES FOR ESTATE AGENTS Estate Agents Authority The contents of this document remain the property of, and may not be reproduced in whole or in
Sample Employee Network and Internet Usage and Monitoring Policy
CovenantEyes Internet Accountability and Filtering Sample Employee Network and Internet Usage and Monitoring Policy Covenant Eyes is committed to helping your organization protect your employees and members
Hengtian Information Security White Paper
Hengtian Information Security White Paper March, 2012 Contents Overview... 1 1. Security Policy... 2 2. Organization of information security... 2 3. Asset management... 3 4. Human Resources Security...
FedEx Guide for. Information Security. Version 5.0
FedEx Guide for Information Security Version 5.0 FedEx Guide for Information Security Version 5.0 Revised June 2013 The FedEx Guide for Information Security provides the general user with an introduction
U.S. Department of Energy Office of Inspector General Office of Audits and Inspections. Evaluation Report
U.S. Department of Energy Office of Inspector General Office of Audits and Inspections Evaluation Report The Department's Unclassified Cyber Security Program 2011 DOE/IG-0856 October 2011 Department of
Managed Hosting & Datacentre PCI DSS v2.0 Obligations
Any physical access to devices or data held in an Melbourne datacentre that houses a customer s cardholder data must be controlled and restricted only to approved individuals. PCI DSS Requirements Version
IT Security DO s and DON Ts
For more advice contact: IT Service Centre T: (01332) 59 1234 E: [email protected] Online: http://itservicecentre.derby.ac.uk Version: February 2014 www.derby.ac.uk/its IT Security DO s and DON
Information Security It s Everyone s Responsibility
Information Security It s Everyone s Responsibility The University of Texas at Dallas Information Security Office (ISO) Purpose of Training Information generated, used, and/or owned by UTD has value. Because
INFORMATION SECURITY GUIDE. Employee Teleworking. Information Security Unit. Information Technology Services (ITS) July 2013
INFORMATION SECURITY GUIDE Employee Teleworking Information Security Unit Information Technology Services (ITS) July 2013 CONTENTS 1. Introduction... 2 2. Teleworking Risks... 3 3. Safeguards for College