This document discusses the importance of continuous IT security awareness programs for organizations. It recommends conducting regular security awareness activities on a weekly, quarterly, and annual basis using different communication channels to effectively reach all employees. Example content includes topics like passwords, malware, social engineering, and data privacy. The goal should be to measure improvements in security knowledge and behaviors over time through ongoing training, communications, and mock cybersecurity incidents. Effective awareness programs treat security as a long-term effort and priority for the entire organization.

1. eGovernment Forum 2016
IT Security Awareness
How to …
อ.นรินทร์ฤทธิ์ เปรมอภิวัฒโนกุล
ผู้เชี่ยวชาญและที่ปรึกษาอิสระด้านความมั่นคงปลอดภัยไซเบอร์
เลขานุการสมาคมความมั่นคงปลอดภัยระบบสานสนเทศ (TISA)
อนุกรรมการด้านความมั่นคงปลอดภัย
ภายใต้คณะกรรมการธุรกรรมทางอิเล็กทรอนิกส์

3. 6 Key Components of IT
Hardware
Software
Network
Peopleware
Data
Security

4. Security is Foundation
Hardware
Software
Network
Peopleware
Data
Security

5. Need Security in Every Pillar
Hardware
Software
Network
Peopleware
Data
S S S S S
People is most important and always be the “WEAKEST LINK”.
Each pillar need to consider security for its whole “LIFECYCLE”.

6. Most people familiars with how to patch a software.
But how to patch “PEOPLEWARE”?

7. awareness training ≠ awareness program

8. IT Security Day
Good, but effective ?

9. Conduct Security Awareness
once a year
WHAT???
Compliance ≠ Effective

10. WHEN?
❖ Risk reduction
❖ Compliance
❖ Electronic Transaction Act
❖ ISO27001 or others
❖ Good governance
❖ Best practise
❖ ROSI (Return on Security Investment)

11. WHEN?
❖ Stakeholders
❖ Role & Responsibility
❖ Top management
❖ Direct, sponsor & monitor
❖ Leading by example
❖ Program owner/manager
❖ IT
❖ User
❖ Office
❖ Factory

12. ❖ Goal - what organization expect to achieve?
❖ Measurement - what is the current situation?
what kind of improvement
expected?
❖ Content - what need to be communicated?
❖ Knowledge
❖ News
❖ Tip & Trick
❖ Policy
❖ Context - what is the best way to deliver the
content to specific group of audience?

13. Example Content
Cybersecurity Malaysia/CyberSafe - http://www.cybersafe.my/en/
❖ Dealing with Malware
❖ Backing up data
❖ Email & spam
❖ Protecting passwords
❖ Identity theft & privacy
❖ Securing mobile devices
❖ Wireless access
❖ Secure remote access
❖ Desktop security
❖ Social network
❖ Safe online shoping
❖ Safe Internet banking
❖ Cyber stalking
❖ Safe chat
❖ Email & spam
❖ Phishing & scam

14. Example Content
SANS Securing the human
❖ Social engineering
❖ Protecting your personal computer
❖ What is phishing?
❖ Data privacy
❖ You are the target
❖ Email security
❖ Browsing security
❖ Social network security
❖ Mobile device security
❖ Password security
❖ Encryption security
❖ Data security
❖ Data destruction security
❖ WiFi security
❖ Working remote securely
❖ Insider threats
❖ Physical security

15. Example Content
ENISA - https://www.enisa.europa.eu/media/multimedia/material/awareness-raising-video-clips
❖ Lock your computer
❖ Protect your data
❖ Shoulder surfing
❖ Use strong password
❖ Keep your password safe
❖ Secure printing
❖ USB drive
❖ ATM machine

16. WHEN?
❖ Regular basis
❖ IT Security Event - annually
❖ Incident mockup & Measurement - quarterly
❖ eNewsletter - once a week (52 weeks a year)
❖ Special occasion - by festival, by incident

17. WHEN?
❖ Location/Venue
❖ Physical
❖ Logical (virtual)
❖ Centralize/Decentralize
❖ HQ
❖ Regional branches
❖ Provincial branches

18. WHEN?
❖ Communication channel
❖ Style, context, look & feel
❖ Strategy
❖ Edutainment
❖ Personal & privacy first then corporate policy
❖ eLearning
❖ Seminar
❖ Classroom
❖ Video clips
❖ Cartoon
❖ How to measure???
❖ Incident mockup

19. Example of Measurement from “Phishing” Incident Mockup

20. Summary
❖ Continuous program - PDCA
❖ Annual plan
❖ Goal & measurement
❖ Known your audiences
❖ Be fun and energetic
❖ It’s a long-term journey

21. Thank You