Download

404 Chapter 12 • Social Engineeringdamage include the compromise of information that indicates strength of ground,air, and naval forces in the United States and overseas areas; disclosure of technicalinformation used for training, maintenance, and inspection of classified munitionsof war; revelation of performance characteristics, test data, design, and productiondata on munitions of war.”■■Secret “Any information or material the unauthorized disclosure of which reasonablycould be expected to cause serious damage to the national security.Examples of serious damage include disruption of foreign relations significantlyaffecting the national security; significant impairment of a program or policydirectly related to the national security; revelation of significant military plans orintelligence operations; compromise of significant military plans or intelligenceoperations; and compromise of significant scientific or technological developmentsrelating to national security.”Top Secret “Any information or material the unauthorized disclosure of whichreasonably could be expected to cause exceptionally grave damage to the nationalsecurity. Examples of exceptionally grave damage include armed hostilities againstthe United States or its allies; disruption of foreign relations vitally affecting thenational security; the compromise of vital national defense plans or complex cryptologicand communications intelligence systems; the revelation of sensitive intelligenceoperations; and the disclosure of scientific or technological developmentsvital to national security.”Education, Training, and Awareness ProgramsSecurity breaches can occur in any part of a system. For this reason, security is everyone’sjob. Every employee who has sensitive information or access to sensitive systems poses a vulnerabilityto an organization’s security (e.g., a company directory).Security is not intuitive; most people do not think in those terms (e.g., a help desk analystis trained to be helpful, not suspicious).Therefore, if everyone is a potential vulnerabilityand employees do not have the necessary outlook and knowledge, there is a clear need foreducation, training, and awareness programs.EducationAll employees should be educated in how to handle any threats that they may encounter.They should:■■■Know to challenge people trying to enter the building without a badgeUnderstand data classification labels and data handling proceduresKnow what to do with attachments to received e-mail messages