2KKUU7ita

78
Part II: Putting Ethical Hacking in Motion
✓ Removing user IDs for employees, contractors, and consultants who no
longer work for the organization
✓ Setting and resetting passwords
✓ Responding to security incidents, such as suspicious behavior
✓ Properly handling proprietary and confidential information
✓ Escorting guests
These policies must be enforceable and enforced for everyone within the
organization. Keep them up-to-date and tell your end users about them.
User awareness and training
The best line of defense against social engineering is training employees to
identify and respond to social engineering attacks. User awareness begins
with initial training for everyone and follows with security awareness initiatives
to keep social engineering defenses fresh in everyone’s mind. Align
training and awareness with specific security policies — you may also want
to have a dedicated security training and awareness policy.
Consider outsourcing security training to a seasoned security trainer.
Employees often take training more seriously if it comes from an outsider.
Outsourcing security training is worth the investment.
While you approach ongoing user training and awareness in your organization,
the following tips can help you combat social engineering in the long term:
✓ Treat security awareness and training as a business investment.
✓ Train users on an ongoing basis to keep security fresh in their minds.
✓ Include information privacy and security tasks and responsibilities in
everyone’s job descriptions.
✓ Tailor your content to your audience whenever possible.
✓ Create a social engineering awareness program for your business functions
and user roles.
✓ Keep your messages as nontechnical as possible.
✓ Develop incentive programs for preventing and reporting incidents.
✓ Lead by example.
Share these tips with your users to help prevent social engineering attacks:
✓ Never divulge any information unless you can validate that the people
requesting the information need it and are who they say they are. If a