1. Poor password and security
1.1. 1)change password regularly
1.2. 2)use passphrases over password
1.3. 3)deploy multiple factors of authentication
1.4. 4)conduct regularly security training
1.5. 5)implement single sign-on
1.6. 6)The staff must not share the password to other people
1.7. 7)The staff must restrict access to their System to reduce the risk of having the password bypassed.
1.8. 8)Install Anti-spyware Software to prevent cyber attacks like keystroke loggers.
2. Apparent lack of personnel awareness of various threats to information
2.1. Ways to increase staff security awareness
2.1.1. Teach employees the critical info that is sensitive and confidential to the business.
2.1.2. Share the company security policies with your staff and ensure security procedures are understood.
2.1.3. Spread the news of latest cyber attacks to make the staff aware of what to expect and what to be suspicious of.
2.1.4. Stress that a security mindset is for everyone, every day.
2.1.5. Share security best practices.
2.1.6. Involve your staff in the fight against cyber crime by inviting them to report any suspicious activity.
3. Deficient Key Security Information
3.1. security elements that need to be preserved :
3.1.1. 1) availability
3.1.2. 2) utility
3.1.3. 3) integrity
3.1.4. 3) authenticity
3.1.5. 4) confidentiality
3.1.6. 5) nonrepudiation
3.2. Source of loss of these element
3.2.1. 1) abuse
3.2.2. 2) misuse
3.2.3. 3) accidental
3.2.4. 4) occurence
3.2.5. 5) natural forces
3.3. acts that cause loss
3.3.1. 1) use of false data
3.3.2. 2) disclosure
3.3.3. 3) inteference with use
3.3.4. 4) copying
3.3.5. 5) misuse or failure to use
3.4. safeguard functionality used to protect these acts :
3.4.1. 1) audit
3.4.2. 2) avoidance
3.4.3. 3) detection
3.4.4. 4) prevention
3.4.5. 5) recovery
3.4.6. 6) mitigation
3.4.7. 7) investigation
4. social engineering
4.1. examples of social engineering
4.1.1. 1)mobile phone
4.1.2. 2) in the office
4.1.3. 3) online
4.2. tips to defending against social engineering
4.2.1. 1)When asked for information, consider whether the person you're talking to deserves the information they're asking about.
4.2.2. 2) provide a detailed briefing "roadshow" on the latest online fraud techniques to key staff
4.2.3. 3) review existing processes, procedures and separation of duties for financial transfers and other important transactions
4.2.4. 4) Question any move that requires revealing your confidential information. This will reduce your vulnerability.
4.2.5. 5) review, refine and test your incident management and phishing reporting systems