MindMap Gallery OSG9 Chapter 2 Concepts of Personnel Safety and Risk Management
Chapter 2 The concept of personnel security and risk management. CISSP (Certification for Information System Security Professional) is the information system security professional certification. This certificate represents the authoritative certification of international information system security practitioners.
Edited at 2023-07-14 11:25:48This is a mind map about bacteria, and its main contents include: overview, morphology, types, structure, reproduction, distribution, application, and expansion. The summary is comprehensive and meticulous, suitable as review materials.
This is a mind map about plant asexual reproduction, and its main contents include: concept, spore reproduction, vegetative reproduction, tissue culture, and buds. The summary is comprehensive and meticulous, suitable as review materials.
This is a mind map about the reproductive development of animals, and its main contents include: insects, frogs, birds, sexual reproduction, and asexual reproduction. The summary is comprehensive and meticulous, suitable as review materials.
This is a mind map about bacteria, and its main contents include: overview, morphology, types, structure, reproduction, distribution, application, and expansion. The summary is comprehensive and meticulous, suitable as review materials.
This is a mind map about plant asexual reproduction, and its main contents include: concept, spore reproduction, vegetative reproduction, tissue culture, and buds. The summary is comprehensive and meticulous, suitable as review materials.
This is a mind map about the reproductive development of animals, and its main contents include: insects, frogs, birds, sexual reproduction, and asexual reproduction. The summary is comprehensive and meticulous, suitable as review materials.
Chapter 2 Concepts of Personnel Safety and Risk Management
2.1 Personnel Security Policies and Procedures
2.1.1 Job description and responsibilities
Job responsibilities (Gob responsibilities) refer to the specific work tasks that employees regularly perform.
Job descriptions are not specific to the recruitment process and they should be maintained throughout the life of the organization
2.1.2 Candidate screening and recruitment
Screening of candidates for specific positions is based on sensitivity and classification levels as defined by the job description
Background checks include
Obtain the candidate’s employment and educational background
Check references
Verify academic qualifications
Interview colleagues
Check police and government records regarding arrests or illegal activities
Verify identity with fingerprint, driver's license or birth certificate
By reviewing online information on an individual's social network, one can quickly glean an overall picture of an individual's attitude, intelligence, loyalty, common sense, diligence, honesty, respect, consistency, and compliance with social norms and/or corporate culture.
Conduct interviews with qualified job applicants
How to recruit satisfactory employees, you need to describe job responsibilities in detail
2.1.3 Onboarding: Employment Agreement and Strategy
Onboarding is the process of adding new employees to an organization
Sign employment agreement
Non-disclosure agreement (NDA)
Non-competition Agreement (NCD)
2.1.4 Employee supervision
Managers should periodically review or audit each employee’s job description, job tasks, privileges, and responsibilities throughout the employee’s employment
User behavior analytics (UBA)
User and entity behavior analytics (UEBA)
Information collected by UBA/UEBA monitoring can be used to improve personnel safety policies, procedures, training, and related safety oversight programs.
2.1.5 Resignation, transfer and dismissal procedures
Offboarding is the opposite process of onboarding, which is when an employee leaves the company and their identity is removed from the IAM system
A complete resignation process: This may include disabling and/or deleting user accounts, revoking certificates, revoking access codes, and terminating other specifically granted privileges. It is common to disable a former employee's account so that their identity is retained for several months for audit purposes
During the termination process, it is important to have a strong relationship between the security department and the human resources (HR) department to maintain control and minimize risk.
Resignation security matters
Building strong relationships between resource (HR) departments is important to maintain control and minimize risk.
Ensure employees have returned any company equipment or supplies from their vehicles to their homes.
Arrange for a security guard to accompany the fired employee as he or she collects personal belongings in the work area.
Notify all security personnel, patrol personnel, or persons monitoring entrances and exits to ensure that former employees cannot re-enter the building without an escort.
subtopic
Fired: Timing is everything
The IT department asked for the laptop to be returned.
Disable network account
Deactivate personal identification numbers or smart cards at workplace entrances
Revoke parking permit
Distribute corporate restructuring chart
Place new employees in their cubicles or work areas.
Allowing information about dismissal to be leaked to the media
2.1.6 Agreements and controls with suppliers, consultants and contractors
A Service Level Agreement (SLA) is a method of ensuring that an organization providing a service maintains appropriate service levels based on an agreement between the service provider, supplier or contractor, and the customer organization
SLAs and controls for suppliers, consultants and contractors are an important part of risk reduction and avoidance
Vendor Management System (VMS): VMS is a software solution that assists in the management and procurement of staffing services, hardware, software and other required products and services.
Outsourcing is a term that generally refers to the use of an outside third party, such as a supplier, consultant, or contractor, rather than performing tasks or operations in-house. Outsourcing can be a risk response option known as transfer or assignment risk
2.1.7 Compliance policy requirements
Compliance is the act of conforming to or adhering to rules, policies, regulations, standards or requirements
Compliance is an administrative or managerial form of security control
Compliance enforcement refers to the sanctions or consequences imposed for failure to comply with policies, training, best practices and/or regulations
Compliance is also a regulatory issue
2.1.8 Privacy Policy Requirements
Some definitions of privacy
Proactively protect against unauthorized access to personally identifiable information (i.e., data directly associated with an individual or organization), known as Personally Identifiable Information (PII)
Prevent unauthorized access to personal or confidential information
To prevent being observed, monitored or inspected without consent or knowledge.
Personally identifiable information (PII)
telephone number
mailing address
social security number
Name
IP and mac (Germany and EU member states are also recognized as PII in some cases)
The European Union’s General Data Protection Regulation (GDPR) (Regulation [EU] 2016/679)
U.S. Privacy Laws and Regulations
Health Insurance Portability and Accountability Act (HIPAA),
Sarbanes-Oxley Act (SOX)
Family Educational Rights and Privacy Act (FERPA)
Financial Services Modernization Act
2.2 Understand and apply risk management concepts
concept
Risk management is a detailed process
Identify factors that may cause damage or leakage of assets
Evaluate these factors against asset value and cost of controls
Implement cost-effective solutions to mitigate risk
The main goal of risk management is to reduce risk to an acceptable level
Risks to IT infrastructure aren’t just about computers
ACCIDENT
natural disaster
financial threats
civil unrest
Epidemics, physical threats
technology utilization
social engineering etc.
Two basic elements of risk management
Risk assessment or risk analysis: refers to examining the risks in the environment, assessing the likelihood of each threat event occurring and the losses caused if it actually occurs, and evaluating the costs of each and risk control measures.
Risk response: includes using cost/benefit analysis to evaluate risk control measures, safeguards and security controls, adjusting the assessment results based on other conditions, concerns, priorities and resources, and making recommendations in a report to senior management response plan.
Risk awareness is the work carried out to increase the awareness of risks within an organization. Risk awareness helps the organization understand the importance of complying with security policies and the consequences of security failures.
risk tolerance
2.2.1 Risk terms and concepts
Asset: An asset can be anything used in a business process or task. The core is to protect assets and be cost-effective.
Asset Valuation: Asset valuation is the monetary value assigned to an asset based on a number of factors, including importance to the organization, usage in key processes, actual cost and non-monetary expenditures such as time, attention, productivity and R&D, etc.).
Threat: Any potential event that may occur and cause adverse or unexpected consequences to an organization or a specific asset is a threat
Threat Agent/Agent: A threat agent or threat actor purposefully exploits a vulnerability.
Threat Incidents: Threat incidents are accidental and intentional exploitation of vulnerabilities
Threat vector: Threat vector or attack vector refers to the path or means used by an attack or attacker to access a target in order to cause harm. External ones cannot be eliminated, such as hackers themselves cannot control it.
Vulnerability: Vulnerability is a weakness in an asset, a weakness in safeguards or controls, or a lack of safeguards or controls/controls, internal, and often creates a liability (technical or managerial)
Exposure: Exposure is the likelihood that a threat will cause damage to an asset
Risk: Risk is the likelihood or probability that a threat will exploit a vulnerability to cause damage to an asset and the severity of the damage that may be caused.
Risk = Threat * Vulnerability
Risk = likelihood of harm * severity of harm
Risk = probability * impact
Safeguard: A safeguard, security control, protective mechanism or control is anything that eliminates or reduces a vulnerability, or protects against one or more specific threats.
Attack: An attack refers to a threat actor deliberately trying to exploit a vulnerability to cause asset damage, loss or leakage.
Breach: Breach, intrusion or penetration occurs when a security mechanism is bypassed or blocked by a threat actor
2.2.2 Asset Valuation
Risk analysis begins with an inventory of all organizational assets. Once the inventory is completed, each asset needs to be valued.
Annual cost of protective measures < Annual loss expectation of production
Methods of assessing value
purchase cost
Development costs
Administrative or management costs
maintenance or upkeep costs
Asset acquisition cost
The cost of protecting or maintaining an asset
Owner and User Value
value to competitors
Intellectual Property or Stock Value
Market valuation (sustainable price)
replacement cost
Increase or decrease in productivity
Inventory and loss operating costs
Asset damage liability
Practicality
research and development relationships
2.2.3 Identify threats and vulnerabilities
A fundamental part of risk management is identifying and examining threats
This involves creating as exhaustive a list of threats as possible to the organization's identified assets. The list should include threat actors as well as threat events
When compiling a threat list, be sure to consider threats from a variety of sources.
A detailed and formal list of threat examples, concepts, and classifications
NIST SP 800-30 Rev.I Appendix D "Threat Sources" and Appendix E "Threat Events" in
In most cases, it will be a team that performs the risk assessment and analysis
2.2.4 Risk assessment/analysis
Risk assessment/analysis is primarily the responsibility of senior management
Senior management is responsible for initiating and supporting risk analysis and assessment by defining the scope and objectives of the work
Risk is individual, or at least organization-specific, based on its assets, threats, threat agents/threat subjects, and their risk tolerance.
risk assessment methods
Quantitative risk: The analysis is based on mathematical calculations that use actual monetary values to calculate asset losses
Qualitative risk: Analyzes the subjective and intangible value of asset losses and considers opinions, feelings, intuition, preferences, thoughts and gut reactions, high, medium, low
The goal of risk assessment is to identify risks (based on asset-threat combinations) and prioritize them by importance
Mixing quantitative and qualitative analysis into an organization's final risk assessment process is called hybrid assessment or hybrid analysis
Qualitative risk analysis methods
Brainstorming
Storyboard
focus group
investigation
Questionnaire
Checklist
one-to-one meeting
interview
Scenes
A scenario is a written description of a single major threat
Focus on describing how threats arise and what impact they may have on the organization, IT infrastructure, and specific assets
Delphi technology
The Delphi technique is simply an anonymous feedback and response process used to achieve consensus anonymously in a group.
The aim is to get honest and uninfluenced feedback from all participants.
Expert, anonymous, multiple rounds
Quantitative risk analysis methods
Quantitative risk analysis can calculate a specific probability index or numerically indicate the likelihood of an associated risk.
Main steps of quantitative risk analysis
Prepare an inventory of assets and assign an asset value (AV) to each asset
Research each asset and list all possible threats to each asset. Form asset-threat combinations
For each asset-threat combination, calculate the exposure factor (EF)
For each asset-threat combination, single loss expectancy (SLE) is calculated.
Perform a threat analysis and calculate the actual likelihood of each threat occurring within a year, the annualized rate occurrence (ARO)
Obtain the total loss that each threat may bring by calculating the annualized loss expectancy (ALE)
Research the controls for each threat and then calculate changes in ARO, EF and ALE based on the controls in place
Conduct a cost/benefit analysis of every protective measure for every threat on every asset. Choose the most appropriate protective measures for each threat
subtopic
Exposure factor (EF): Indicates the percentage of loss an organization would suffer if a risk occurred that caused damage to a specific asset of the organization.
Single Loss Expectation (SLE): is the potential loss from a single real threat to a specific asset.
SLE = Asset Value (AV) * Exposure Factor (EF)
SLE=AV*EF
Annual Rate of Occurrence (ARO): is the expected frequency of occurrence (i.e. actual occurrence) of a specific threat or risk within a year.
Annual Loss Expectation (ALE): It is the possible loss cost caused by all instances of a single specific threat to a specific asset actually occurring during the year.
ALE = Single Loss Expectation (SLE) * Annual Occurrence Rate (ARO)
ALE= SLE * ARO
ALE = Asset Value (AV) * Exposure Factor (EF) * Annual Occurrence Rate (ARO)
ALE =AV* EF* ARO
Comparison of Quantitative Risk Analysis and Qualitative Risk Analysis
2.2.5 Risk response
Risk mitigation, mitigation, reduction (risk mitigation): reducing risk or mitigating risk refers to implementing protective measures, security controls
Implement encryption measures
firewall
Risk assignment: Risk assignment or risk transfer refers to transferring the losses caused by risks to another entity or organization.
Buy cybersecurity insurance
outsourcing
Risk deterrence: Risk deterrence is the process of deterring potential violators of security and policy.
Conduct an audit
security camera
warning banner
Use security personnel
Risk avoidance: Risk avoidance is the process of selecting alternative options or activities that are less risky than the default, generic, expedient, or cheaper option. For example, choosing to fly to your destination (rather than drive there) is a way to avoid risk
Risk acceptance: Risk acceptance or risk tolerance is the result of a cost/benefit analysis showing that the cost of the control measures will exceed the potential losses caused by the risk.
Risk rejection: A response to an unacceptable but possible risk is to reject or ignore the risk.
Inherent risk (initial/starting risk): is the natural, native, or default level of risk that exists in an environment, system, or product before any risk management efforts are performed.
Example: Firefighters find that fire risks are greater than ordinary personnel, and career decisions
Residual risk: A risk that management chooses to accept rather than mitigate.
Total risk: refers to the total risk faced by the organization without implementing protective measures.
Threat * Vulnerability * Asset Value = Total Risk
Control gap: refers to the risk reduced by implementing protective measures
Total risk - control gap = residual risk
2.2.6 Costs and benefits of security control
For each asset-threat combination (i.e., identified risk), a list of possible and available protective measures must be compiled.
Factors influencing the annual cost of protective measures (ACS)
Purchase, development and licensing costs
Cost of implementation and customization
Annual operation, maintenance, management and other expenses
Cost of annual repairs and upgrades
Increase or decrease in productivity
changes in environment
Cost of testing and evaluation
Cost/benefit calculation formula for specific protective measures against specific risks for specific assets
(ALE before protective measures are implemented – ALE after protective measures are implemented)-ACS
(ALEl -ALE2)-ACS
Various formulas related to quantitative risk analysis
subtopic
2.2.7 Select and implement security countermeasures
Security controls, security countermeasures and protective measures can be administrative, logical/technical, or physical. These three security mechanisms should be implemented in a layered concept and a defense-in-depth approach to provide maximum benefits (see Figure 2.4). Three-pronged approach
Administrative controls: Policies and procedures specified in accordance with an organization's security policy and other regulations or requirements
Strategy
program
Recruitment practices
background check
Data classification and labeling
Security awareness and training efforts
reporting and review
work supervision
Personnel controls and testing
Logical/technical controls: Measures include hardware or software mechanisms that manage access and provide security for IT resources and systems.
Authentication methods (such as passwords, smart cards, and biometric identification technology
encryption
Limit interface
access control list
protocol
firewall
router
Intrusion Detection System (IDS)
threshold level
Physical controls: Security mechanisms designed to protect facilities and real-world objects
security guard
fence
motion detector
locked door
sealed window
lamp
Cable protection
laptop lock
badge
Swipe card
watchdog
camera
Access control foyer
Alarm
2.2.8 Applicable control types
"Security control" refers to performing various control tasks
Preventive Controls: Deploying preventive controls to thwart or prevent unintended or unauthorized activities from occurring, beforehand
Fences, locks, authentication, access control vestibules, alarm systems, segregation of duties, job rotation, data loss prevention (DLP)
Penetration testing, access control methods, encryption, auditing, security policies, security awareness training, anti-virus software, firewalls and intrusion prevention systems (IPS).
Deterrent controls: Deploy deterrent controls to prevent violations of security policies, beforehand
Policies, security awareness training, locks, fences, security signs
Security, access controlled foyer and security cameras.
Detection controls: Deploy detection controls to detect or detect unexpected or unauthorized activity,
Security, motion detectors, recording and review of events captured by security cameras or CCTV
Job rotation, forced leave, audit trails, honeypots or honeynets
Intrusion detection systems (IDS), breach reporting, user monitoring and review, and incident investigation.
Compensating controls: Help enhance and support security policies by providing various options for other existing controls.
For example, if preventive controls fail to prevent deletion of files behavior, then the compensation control as a fallback option can restore the file.
Corrective Controls: Small events that modify the environment to restore the system to a normal state from the occurrence of unanticipated or unauthorized activity. afterwards
For example, terminating malicious activity or restarting the system
Data backup, BCP, DRP
Antivirus detects virus quarantine
Restorative Control: An extension of corrective control, but with more advanced and complex capabilities, after the fact
Examples of recovery controls include backup and restore, fault-tolerant drive systems, system images, server clusters, anti-virus software, database or virtual machine images
Hot sites, warm sites, cold sites, backup processing facilities, service bureaus, reciprocity agreements, cloud service providers, mobile mobile operations centers and multi-site solutions
Instruction control: used to guide, limit or control the behavior of the subject to force or encourage the subject to comply with security policies
Security policy requirements or standards, issued notices, security instructions, escape route exit signs, monitoring, supervision and procedures
2.2.9 Security Control Assessment
Security control assessment (SCA): A formal assessment of various mechanisms of a security infrastructure based on baselines or reliability expectations.
The goals of SCA are to ensure the effectiveness of security mechanisms, assess the quality and thoroughness of an organization's risk management processes, and generate reports on the strengths and weaknesses of the deployed security infrastructure.
Federal agencies implement SCA based on NIST SP 800-53 Rev.5 “Security and Privacy Controls for Information Systems and Organizations”
SCA is defined as a government process
2.2.10 Monitoring and measurement
The benefits provided by security controls should be monitorable and measurable
2.2.11 Risk reporting and documentation
Risk reporting: includes preparing a risk report and presenting the report to stakeholders
Risk Register or Risk Log: is a risk inventory document that lists all identified risks within an organization or system or within a single project
Identified risks
Assess the severity of these risks and prioritize them
Develop responses to reduce or eliminate risks
Track risk mitigation progress
Risk matrix or risk heat map: is a form of risk assessment performed on a basic graph or chart. It is sometimes called qualitative risk assessment
Test points: Who are the relevant parties and audiences to consider?
Test points: Consider the content of the report, improvement measures, or improvement suggestions
2.2.12 Continuous improvement
Security is constantly changing. Therefore, any implemented security solution will need to be updated over time.
Evaluate enterprise risk management (ERM) programs using the risk maturity model (RMM)
RMM level
Initial level (ad hoc): The chaotic state when all organizations begin risk management.
Preliminary: An initial attempt to comply with the risk management process, but the risk assessment performed by each department may vary
Defined: Adopt a common or standardized risk framework across the organization
Integrated level: Risk management operations are integrated into business processes, effectiveness indicator data is collected, and risk is considered an element in business strategic decisions.
Optimized: Risk management focuses on achieving goals rather than just responding to external threats; increases strategic planning for business success rather than just avoiding accidents; and integrates lessons learned back into the risk management process
Legacy equipment risks
End-of-life (EOL): refers to the point in time when the manufacturer no longer produces the product
End-of-service life (EOSL): refers to systems that can no longer receive updates and support from the supplier
2.2.13 Risk framework
A risk framework is a guide or methodology on how to assess, address and monitor risks
risk management framework (RMF)
Federal agencies set mandatory requirements
It is defined in NIST SP 800-37 Rev.2, the primary risk framework referenced by the exam.
There are six cycle stages in RMF
Prepare to perform RMF from an organizational and system-level perspective by establishing the context and priorities for managing security and privacy risks
Classification Classifies systems and the information they process, store and transmit based on an analysis of the impact of the loss
Select an initial set of controls for the system and customize controls as needed to reduce risk to an acceptable level based on risk assessment
Implement Implement the control and describe how it will be used within the system and its operating environment.
Assessment Evaluate controls to determine whether controls are implemented correctly, operate as expected, and produce expected results that meet security and privacy requirements
Authorization Authorizes systems or common controls based on a determination that risks to organizational operations and assets, individuals, other organizations, and countries are acceptable
Monitoring Continuously monitor systems and related controls, including assessing control effectiveness, documenting changes to the system and operating environment, conducting risk assessments and impact analyses, and reporting on the security and privacy status of the system.
Threat modeling in the design phase, security by design
Cybersecurity framework (CSF)
Critical infrastructure and business organizations
Five functional components
identify
Protect
Detection
response
recover
ISO/IEC 31000 "Risk Management - Guidance" document
any organization
Guidance document - ISO/IEC31004 "Risk Management - ISO 31000 Implementation" 61 Implementation Guide” and ISO/IEC27005 “Information Technology – Security Technology – Information Security Risk Management”
Other frameworks
Treadway Commission’s COSO Enterprise Risk Management – Integrated Framework
ISACA’s IT Risk Framework
Operationally Critical Threat, Asset, and Vulnerability Assessment (Operationally Critical Threat, Asset, and Vulnerability Assessment) Vulnerability Evaluation, OCTAVE)
Factor Analysis oflnformation Risk (FAIR)
Threat Agent Risk Assessment (TARA)
2.3 Social Engineering
Social engineering is a form of attack that exploits human nature and human behavior
Social engineering attacks come in two main forms
persuade someone to perform an unauthorized action
Convince someone to reveal confidential information.
Ways to defend against social engineering attacks
Educate personnel on social engineering attacks and how to recognize common attack signatures.
Authentication is required when performing activities for people over the phone.
Defines restricted information that must never be communicated via text-only communications such as telephone calls or standard email.
Always verify the maintenance personnel's credentials and verify that an authorized person made the actual service call.
Never follow instructions from an email without verifying the information with at least two independent and trusted sources
Use caution when dealing with anyone you do not know or who does not know you, whether in person, over the phone or over the internet/online
The most important measure to defend against social engineering attacks is user education and awareness training
2.3.1 Principles of social engineering
Authority: is an effective technique because most people are likely to respond submissively to authority. The key is to convince the target that the attacker is someone with valid internal or external permissions
Intimidation: can sometimes be seen as a derivative of the authority principle. Intimidation uses authority, trust, or even the threat of harm to push someone to carry out an order or instruction
Consensus: or social proof is the act of tapping into a person's natural tendencies. People tend to imitate what others are doing or have done in the past
Scarcity: is a technique used to make someone estimate that an object is of higher value because of its scarcity. This may be related to products that are only produced in small quantities or with limited opportunities, or it may be related to the few products that remain after most of the inventory has been sold.
Familiarity: or liking is a social engineering principle that attempts to exploit a person's inherent trust in familiar things.
Trust: In this social engineering principle, the attacker strives to build a relationship with the victim.
Urgency: Often associated with scarcity, as scarcity represents a greater risk of missing out, so the need to act quickly increases.
2.3.2 Obtain information
Obtaining information is the activity of collecting or aggregating information from systems or people.
2.3.3 Prepositions
A preposition is a term, expression, or phrase added to the beginning or title of other communications. Prepositions are often used to further refine or establish a pretext for engineered attacks, such as spam, hoaxes, and phishing
2.3.4 Phishing
Phishing is a form of engineering attack that focuses on stealing credentials or identity from any potential target.
Drive-by downloads: When users visit a website, malware is installed without their knowledge. Drive-by downloads exploit vulnerabilities in browsers or plug-ins
Defensive measures against phishing
Be wary of unexpected emails or emails from unknown senders
Don't open unexpected email attachments.
Never share sensitive information via email
Avoid clicking on any links you receive in emails, instant messages, or social networking messages.
2.3.5 Spear Phishing
Spear phishing is a more targeted form of phishing, where messages are crafted specifically to target a specific group of users
Protect against spear phishing
Label information, data and assets with value, importance or sensitivity.
Train staff to correctly handle related assets based on tags.
Ask for clarification or confirmation of any behavior that seems unusual, deviates from process, or poses undue risk to the organization.
2.3.6 Phishing
Whaling is a variation of spear phishing that targets specific high-value individuals (by title, industry, media reports, etc.) such as CEOs and other C-level executives Manager, administrator or high net worth client
2.3.7 SMS phishing
Short Message Service (SMS) phishing or smishing is a social engineering attack that occurs on or through standard text messaging services
2.3.8 Voice Phishing
Vishing (i.e., voice-based phishing) or SplT (Internet Telephone Spam) is phishing carried out through any telephone or voice communication system.
Way
traditional phone line
Voice over IP (VOIP) services
mobile phone.
2.3.9 Spam
Spam is any type of unwanted and/or unsolicited email
2.3.10 Shoulder Viewing
Shoulder surfing is a type of social engineering attack that typically occurs in the real world or face-to-face.
Shoulder surfing occurs when someone is able to see a user's keyboard or monitor.
2.3.11 Invoice fraud
An invoice scam is a social engineering attack that typically involves providing a false invoice and then strongly enticing payment in an attempt to steal funds from an organization or individual.
2.3.12 Prank
A hoax is a form of social engineering designed to cause a target to perform actions that will cause problems or degrade their IT security.
2.3.13 Counterfeiting and disguise
Impersonation is the act of assuming someone else's identity
You can log in via personal, phone, email, or person's account or through any other means of communication. Impersonation can also be called disguise, deception, or even identity fraud
2.3.14 Trailing and piggybacking
Tailing occurs when an unauthorized entity uses the authorization of a legitimate employee to enter a facility without the employee's knowledge.
A problem similar to tailing is piggybacking. Piggybacking occurs when an unauthorized entity obtains a victim's consent through deception and enters a facility with the authorization of legitimate staff
Decoys are when attackers place USB drives, discs, or even wallets in locations where employees may encounter them.
Available double doors to prevent
2.3.15 Trash search
Dumpster diving is the act of digging through trash, abandoned equipment, or abandoned sites to obtain information about a target organization or individual
Typical collections include old calendars, call sheets, handwritten meeting minutes, discard forms, product boxes, user manuals, post-it notes, printed reports, or printer test sheets.
2.3.16 Identity fraud
Identity theft and identity fraud refer to all types of crimes that involve unlawfully obtaining and using another person's personal data in a fraudulent or deceptive manner, usually for financial gain
Fraud: Calling something false true. Identity fraud is when you falsely claim to be someone else by using information stolen from the victim
Using someone else's Social Security number for employment
Using someone else's name to open telephone service or public facilities
Using someone else’s health insurance to get medical services
Deception: refers to any act of concealing a valid identity, This is usually accomplished by using another identity.
Hackers often spoof email addresses, IP addresses, Media Access Control (MAC) addresses, addresses Analyze protocol (A Yangxun) communications, Wi-Fi networks, websites, mobile applications, etc.
2.3.17 Misplaced domain name
Typo squatting is the practice of capturing and redirecting traffic when a user incorrectly enters the domain name or 1P address of a target resource.
Wrong spelling of domain name
URL hijacking
2.3.18 Influence Movements
An influence campaign is a social engineering attack that attempts to guide, shape, or change public opinion. Hackers may launch such attacks against individuals or organizations, but most influence campaigns appear to be conducted by nation-states against their real or perceived external enemies.
hybrid warfare
Integrate traditional military strategy with modern capabilities, including social engineering, digital influence campaigns, psychological warfare, political tactics and cyber warfare capabilities. This is called hybrid warfare
social media
Social media has become a weapon in the hands of nation-states as they wage hybrid warfare against their targets
The most effective way to prevent social work, safety awareness training
2.4 Establish and maintain security awareness, education and training programs
Successfully implementing security solutions requires changing user behavior. These changes primarily include changes in routine work activities to comply with the standards, guidelines and procedures set out in the security policy.
2.4.1 Security awareness
A prerequisite for implementing safety training is establishing safety awareness. The goal of building security awareness is to get users to put security first and recognize this
All personnel should be fully aware of their own safety responsibilities and obligations. They are trained to know what to do and what not to do.
2.4.2 Training
Training refers to teaching employees to perform their job tasks and follow security policies. Training is usually organized by the organization and is targeted at groups of employees with similar job functions.
2.4.3 Education
Education is a more detailed work where students/users learn much more than they actually need to know to complete their job tasks
2.4.4 Improvements
Change the focus of training objectives. Sometimes the focus is on the individual, sometimes on the customer, sometimes on the organization.
Change the order or focus of training topics. You can focus one training on social engineering, the next on mobile security, and the next on home and travel security.
Use a variety of presentation methods, such as live presentations, pre-recorded videos, computer software/simulation software, virtual reality (VR) experiences, off-site training, interactive websites, or assigned readings from prepared courseware or ready-made books
Through role-playing, participants play attackers and defenders, and different people are allowed to provide ideas related to defense or response to an attack.
2.4.5 Effectiveness evaluation
It is important that all training materials undergo regular content reviews. Reviews help ensure training materials and presentations are aligned with business goals, organizational mission, and security goals
The most effective way to detect and evaluate social work
Training requires everyone’s participation