Information Security and Privacy

Handling Security Threats

Data Security

Staying Safe on the Internet

Maintaining Computer Security

Mobile Web/Mobile apps (for work)CookiesSearch engines - everything you search is trackedGoogle mapping - location tracking malicious links and scams Bluetooth and wireless security and hot spots anti-virus software Security threats in collaborative activity - sharing features Social Media Blogging & personal web sites that are tied to work Using 3rd party applications Business Continuity Planning Responding to an emergency/mishap (virus attack/stolen laptop)Information classification (company-specific?) / Data Classification PolicyBusiness Identity Theft Advertisements (check for searching competency)Equipping yourself for Data Recovery (backups/best practices)FTP/Network protocol/network security Organizational Independence Hard Drive/USBs

To insert into network security: What makes network security vulnerable: Software bugs; Configuration mistakes; Network design flaw

Not necessarily to be included, but the following encryption software are bad choices because their passcodes can be easily broken, (and are noncompliant software for PHI): Microsoft Word password protectionMicrosoft Excel password protectionMicrosoft PowerPoint password protectionMicrosoft Outlook .pst file password protectionZip 2.0 encryption

To insert into network security: VPNs, Firewalls (first line of defense), VLANs, and Network Access Controls

Notes to self: Cloud Computing risks have also been broken down into: technical, legal, and organizational- but I decided this broad categorization was more helpful for an IT team developing CP protocols, not employees, and drew those risk types I felt were most relevant. Risk mitigation is not the responsibility of the Cloud SP- they do not care about the law or data protection-- it is the responsibility of a company to define guidelines for its employees use of Cloud Services. The only topic I did not include in framework that I think MAY be relevant: Loss of control to SP--> ex: Cannot know for certain that something deleted is not still on a server somewhere (but I still think this is for IT Dept. to worry about)

Information protection protocols on: handling, transmitting, storing, and disposing of information

Social media threat classifications: Phishing, XSS, CSRF (don't think this is important for employees to know).

Cookies