So what is 'workplace infosec' about?   Working with, exploiting and protecting valuable information Working in traditional fixed offices (cubicles) or other locations e.g. : Factories  Warehouses Shops & retail outlets Farms, mines ... Schools, colleges, uni's Home offices Boardrooms, meeting rooms Vehicles e.g. cars, trucks, trains, planes, cabs, buses, bikes Portables e.g.  laptops, tablets, smartphones Wearables - working on the go Temporary offices e.g. cafes, customer sites, departure lounges, waiting rooms, hotel rooms, rent-an-office Semi-public areas e.g. bank tellers, receptionists Home or abroad, maybe in space Up at the front line, perhaps even behind enemy lines Collaborative working (virtual teams) Audio/video conferencing  On the beach in NZ (that's us pictured above - in our dreams) Working online, connected over networks to the corporation's data and apps Working offline, using IT or not Working the usual 9-to-5 or 'out of hours', often ...

Our next awareness topic is "workplace information security", updating a module written way back in 2012. The "office security" awareness module mostly covered physical security for traditional offices. Although it made passing reference to home and mobile working, this time around we'll be paying more attention to the information security aspects of out-of-office and mobile working, such as using portable devices and VPNs. Our starting point, as always, is to rake though the previous materials for anything worth re-using this time, seeking inspiration for 6 new awareness posters. The 'men at work' warning sign above prompted the idea of workmen peering over the warning barriers into a big hole in the road, in which sits a businessman in a suit, working on a laptop.  Well maybe. 'Workplace security' suggests health and safety - which is an information security issue since people are literally our most valuable information assets. There's plen...

The Insecurity of Things, our latest security awareness module, is winging its way to customers this afternoon.  The zip file totals about 70Mb, containing all these goodies ... If you can only dream of running an effective security awareness program, get in touch. We'd be happy to do the labour-intensive prep-work, leaving you the fun of interacting with your colleagues, informing and persuading them. We can get your program up and running in no time. Will you set off with the basic  Information Security 101  module, the Insecurity of Things or something else from our bulging security awareness portfolio? Don't delay!  Insecure things are proliferating like cockroaches.  

June's  IoT awareness module will soon be ready for packaging and  delivery. While proofreading continues, s ix new posters are winging their way to us and the newsletter will be completed in the next few hours.  The primary purpose of the newsletter is to bring readers bang up to date with the current state of the art - tricky in such a fast-moving field as IoT.  Having been  systematically researching IoT security for quite some time though, we have amassed plenty of relevant news clips and quotable comments to weave into a coherent story. We always  try  to present a reasonably comprehensive, accurate and balanced perspective on the monthly topic.  Clued-up readers may spot errors or omissions and we're OK with that. If they talk things through with their less well informed colleagues (even if they poke holes in the content or disagree with us), they will be spreading awareness ... which is exactly what we want to achieve - awareness-by-proxy a...

The Insecurity of Things awareness module is nearly complete. I thought the management stream was done and dusted over the weekend, but today in the course of preparing the awareness seminar for professionals, I developed a simple 3-step process flow for the management of IoT risks, then expanded on each of the steps and realized that the approach is strategic ... which meant re-opening and revising the management seminar and briefing to expand on the strategy, realigning the management and professional streams. Such iterations are common for us. Developing awareness content is not a straightforward sequential or linear process - more like a spiral. Producing each item in the set forces us to consider things from the perspective of its intended audience, sometimes suggesting different angles to other awareness items. Round and round we go until the bell signals the end of month deadline and it's time to change mode: tidy things up, close off loose ends and stop forever elaborating ...

One of the IoT security issues we explore in June's awareness module is the use of compromised things as platforms for further attacks - for example not just spying on people but spreading malware or launching exploits against corporate systems and networks, including other things .   While the preceding brief paragraph hopefully makes perfect sense to those who already have a reasonable understanding or appreciation of IoT security, it won't resonate with everyone. Although 'compromise', 'platform', 'attack' and 'exploit' are ordinary everyday English words, we're using them here in a particular context with quite specific meanings. The distinction is important in awareness because we are addressing people with varying levels of knowledge and understanding, ranging from next-to-nothing up to expert. It's fine for them to take away different things from the awareness materials just so long as they all have a reasonable grasp of the same ...

We're turning the corner into the final straight for June's awareness module on IoT security: I'll take some time off at the weekend, recharging my built-in lithiums ready for a photo finish next week.  This module looks like it will go to the line on Wednesday May 31 st ... and we may even need to refer to UTC rather than NZ time to hit our deadline, one of the advantages of being just to the West of the international date line. Must go, things to do, awareness to raise.