Secaware 29 views ♡

This guideline supports ISMS auditors with pragmatic advice on two key aspects: 1. The kinds of evidence typically sought during an ISMS audit i.e. documents and information in other forms (e.g. expressed verbally in audit interviews). Only some of this is formally mandated by the standard, with the...

Aside from the direct, immediate impacts (losses and costs) and effects on business systems, networks and data, cyber incidents may have devastating business consequences if supply chains, perhaps even whole industries and nations are affected. Cyber risk is an increasingly significant concern to vi...

This module focuses on exploiting and protecting valuable information in a broad range of working situations - not just traditional offices but workers in other locations and situations such as: • Farms, mines, trawlers … (primary production); • Factories and workshops; • Warehouses and dist...

Working from home, on-the-hoof, or more generally working in temporary and transient locations, changes the information risks compared to working in purpose-built corporate offices. Mostly, the risks increase in line with the complexities of remote access, portability and physical dispersion … but...

Widespread in the public, corporate and personal domains, surveillance is both a valuable monitoring control and a privacy/human rights concern, depending on your perspective. This SecAware awareness and training module explores the information risk and security, privacy and human rights angles to s...

The sheer variety of social engineering scams, cons and frauds is one of the key messages in this awareness and training module. This SecAware module concerns: • Social engineering attacks including phishing, spear-phishing, Business Email Compromise and many more; • The use of pretexts, spoofs...

ISMS Orbit is a substantial bundle of documentation supporting the establishment of an ISO/IEC 27001 Information Security Management System. These are generic templates (Microsoft Office files) for various discretionary materials, supplementing and extending the SecAware Launchpad (https://www.secaw...

SecAware ISMS Take-off is a ‘toolkit’, a substantial bundle of documentation supporting the establishment of an ISO/IEC 27001:2022 Information Security Management System. The Take-off materials are primarily intended for managers. An ISO27k ISMS is, after all, a management system. These are gene...

This awareness and training module concerns conceptual or architectural frameworks, standards, methods and good practices in the area of information risk and security – ‘security frameworks’ or ‘frameworks’ for short. Both the organization and individual workers are obliged to comply with...

Although “insider threat" is a commonplace term, it is a misnomer. “Insider risk" would more accurate since there is more to this than the threat posed by insiders. “Insiders" in this context are primarily employees - both staff and management - of the organization, those on its payroll. “Ou...

‘Information protection’ is a vague title for an awareness module … which gives us (and you!) plenty of latitude in the scope. Information is a valuable yet vulnerable resource. We rely on information to communicate and find out about things, to learn and be entertained, to express ourselves a...

Despite our best efforts to avoid or prevent incidents and avert disasters, they remain a possibility. Being prepared puts us in a better position to survive and thrive, keeping essential business processes and systems running despite the event (continuity and resilience), recovering non-essential o...

Hackers range between fabulous allies and dastardly opponents, depending on their skills and, in particular, their ethics and motivation. They are the good, the bad and the ugly of information security. At the good end of the scale, white-hat hackers are actively exploring and expanding IT. Hacking...

This awareness module explains Business Continuity Management as an approach to save the business and save lives. When the chips are down, whether and how well the organization and its people survive serious incidents depends on their readiness, resources and resilience - three aspects that can be b...

Assurance is a valuable, generally-applicable form of information security control. Assurance measures increase confidence in things, generating trust by checking, reviewing, testing, auditing and generally poking into situations. Although this is an unusual topic, assurance is a widespread issue, s...

The security and privacy concerns associated with software make this an important awareness and training topic, relevant to staff. management and professionals alike. Applications are all the rage – well mobile “apps" anyway. Users of iThings and no end of shiny little eToys can’t resist downl...

ISMS Launchpad is a starter kit supporting the launch of a basic Information Security Management System. It is a set of templates for the essential (mandatory) documentation - the ISMS scope, RTP, SoA, information security policy and the rest. These are straightforward generic templates (Microsoft O...

The ‘spotting incidents’ awareness and training module concerns vigilance, early detection and (where appropriate) prompt reporting of a deliberately diverse set of information-related concerns and incidents such as: • Application failures e.g. business apps refusing to load and run, systems m...

Culture may be an unusual topic for security awareness and training but this is an extremely important issue. An organisation's information security status is bound to be stronger if workers generally are aware of, and fulfil their obligations towards, security, privacy, compliance, confirmity and s...

As we are seeing right now, resilience is a valuable concept in business and life as a whole. It involves ‘bending not breaking’, in other words making or arranging things such that issues or incidents (such as pandemics) aren’t disastrous or terminal, although damage may be sustained. Resilie...

In this awareness and training module, we focus primarily on ransomware, specifically - a 'clear and present danger' causing disruption and grief around the globe. However, we also mention other forms of malware, of course, since (unfortunately!) they haven't gone away. Coupled with network security...

This awareness and training module concerns the information risk and security aspects of portable/pocket computing devices and media - all the usual cybersecurity issues plus those relating to the devices themselves and how they are used. Treating the information risks relating to portable computing...

This awareness and training module concerns physical security protecting tangible information assets, particularly IT systems and data storage media, plus paperwork, authentication tokens, keys. and workers, often our most valuable and vulnerable information assets. The kinds of physical security ev...

Socially-engineering people into opening malicious messages, attachments and links is an effective way for social engineers to bypass many technical security controls. Phishing is a business enterprise, a highly profitable and successful one making this a growth industry. Just as Advanced Persistent...