Request for pointers on Security presentation to work mates
Mon, 06/01/2009 - 11:43
I need to do a presentation at work to about best practice for desktop users in the work place. I want it to cover the security side of things, like the prevention of being exploited, malware viruses and such. I want to scare them from apathy.
Any one have some links or suggestions that would help out. I want to set it into a power point format.
Mon, 06/01/2009 - 14:46
#2
Just don't scare them too
Just don't scare them too much.
Raising awareness is good and all, however, in the past I have successfully "scared" workmates to the point that they still don't care about security afterwards because all of a sudden the "OMG ALL IS LOST" syndrome kicks in.
As to what resources are out there, after a look around the best I can suggest is to check out various CERT organisation website for stuff they have presented in the past :\
Wed, 06/03/2009 - 13:58
#3
Thanks
Thank’s for the feedback.
I was going to ask the question “how do you know if you’ve been exploited”
Answer = you don’t.
But have decided to take a more upbeat approach now.
Thanks to all the comm. Bank spam at the moment I have an up to date topic with examples to show. I’ve also decided to discuss conficker and how just being patched makes a difference.
Sun, 06/07/2009 - 22:36
#4
Don't under estimate the
Don't under estimate the ignorance of some users. Examples are a good tool. Lots of talks are given which say things along the lines of "don't open suspicious emails" but if you know the email is suspicious you probably wouldn't be opening it in the first place.
Some people may need to be told that the nigerian prince doesn't have any money to give you. The commonwealth bank has been targeted lately by a lot of phishing emails and some of them are pretty good actually, sadly.
You'd think there would be some nice boilerplate PPTs out there to help people in your position. In fact, this is the sort of thing I'd expect Microsoft to do -- come up with a nice best practice guide and publish all the media.
But do you think scaring people is the best way to go? I've always thought just demonstrating how easy it is to get pwned works well. You can turn it into a game of sorts -- the bad guys versus the employees.
If they can feel like they're outsmarting the bad guys (not to mention most other computer users) I reckon you've got it won. If you just scare people they only remember the negatives, not the actual mechanics of the attacks. Just my $0.02...