Information Security Awareness Training Report for ATI

This report details an information security awareness training program designed for Advanced Topologies Inc. (ATI). It begins with an introduction to information security, defining its objectives of integrity, confidentiality, and availability. The report adopts the NIST Special Publication 800-50 model, providing guidance for effective IT security programs. It identifies potential causes of information insecurity, stemming from both employee actions and inactions, and addresses associated risks like leaving sensitive data unattended, clicking on suspicious emails, and using weak passwords. The core of the report covers key policies, including clean desk, bring your own device (BYOD), data management, removable media, and social networking policies. Roles and responsibilities are outlined for agency heads, chief information officers (CIOs), and managers. The report concludes with recommendations such as continuous monitoring of employee activities, discouraging BYOD on company networks, and minimizing the use of sticky notes and printouts, emphasizing that security is the responsibility of every employee. References to key literature are also included.

Information security
awareness training
Be on the look out!

AGEND
A Introduction
NIST model
Causes of information insecurity
Policies
Roles and Responsibilities
The main agenda
for the training
include;

INTRODUCTION
• What is information security?
• The practice of preventing unauthorized use,
disruption, unauthorized access, modification,
inspection, destruction or even unauthorized
recording of information("What is Information
Security?," 2018).

INTRODUCTION CONT.’
• Information can be physical or electronic.
• Objectives of Information security program are;
• Integrity
• Confidentiality
• availability

NIST MODEL
• NIST special publication 800-50 is chosen model in ADVANCED
TOPOLOGIES INC.(ATI).
• Why this model for ATI?
• It offers guidance in development of effective information
technology security programs
• Supports federal information security management act of 2002
requirements(Pradigdya & Ginardi, 2019,)

System set up may not be the
weakness. What are the involved
parties likely causes of insecurities?

Employees inaction
Leaving sensitive information on desks.
Failing to log out from emails in open office computers
Failing to recorded and notify company’s IT any suspicious activities in
the system.

Employees action
Clicking on strange emails that may come with malware
Retrieving delicate information to irrelevant users
Setting obvious passwords which can easily be intruded
Sharing excess information when social networking
Leaving browsers remembering passwords on public computers

policies
Policy is how ATI manage and use network and information.
Clean desk policy
Bring your own device policy
Data management policy
Removable media
Social networking

Clean desk policy
Clearing off the desk print outs, sticky notes that contain delicate
information.
This prevents unauthorized party from viewing them(Bada, Sasse
& Nurse, 2019).
Only papers kept are associated with present project being worked
on by users.
According to grants(2017), sensitive information must be gotten rid
off at end of each day.

BRING YOUR OWN DEVICE POLICY
This covers all personal computing devices of the employees that can
be utilized in work setting.
ATI has created a list of acceptable devices and the rest banned.
All devices under BYOD must be verified by the security staff.
Applications run in these devices are also limited.

Data management policy
• According to Eyadat (2018), employees do not realize importance of
classified data.
• Hence need to provide knowledge regarding all kinds of data.
• This allows everyone to comprehend the business critically.
• Everyone should strive to know basic information regarding data
management