'Spotting incidents’ is the brand new security awareness and training module for April. It concerns vigilance, early detection and (where appropriate) prompt reporting of a  deliberately diverse and open-ended set of information-related incidents, concerns and risks ...   Whether you consider them to be incidents or not, suspicious activities and near-misses are also worth reporting if ‘early warning’ is something you and your management would appreciate. Nasty surprises are, well, nasty.  The sooner you know about trouble on the horizon, the more options you have, not least the possibility of deftly avoiding the minef ields ahead. Scope The awareness module concerns two critical early steps that kick-start the incident management cycle: We have cover ed the remainder of the incident management process before and will do so again - in fact every single awareness module concerns incidents since they are the very reason that information risks are of concern, and information...

Kaspersky has released information on Operation ShadowHammer , a malware/APT infection targeting ASUS systems with particular MAC addresses on their network adapters. According to a Motherboard report : "The issue highlights the growing threat from so-called supply-chain attacks, where malicious software or components get installed on systems as they’re manufactured or assembled, or afterward via trusted vendor channels. Last year the US launched a supply chain task force to examine the issue after a number of supply-chain attacks were uncovered in recent years. Although most attention on supply-chain attacks focuses on the potential for malicious implants to be added to hardware or software during manufacturing, vendor software updates are an ideal way for attackers to deliver malware to systems after they’re sold, because customers trust vendor updates, especially if they’re signed with a vendor’s legitimate digital certificate." And that, in a nutshell, is a concern with, ...

ITU X.1056 " Security incident management guidelines for telecommunications organizations " includes the following little nugget: Well said ITU-T! The idea of incorporating information about the organization's own incidents into the awareness program is something we suggest almost every month in the train-the-trainer guides for each security awareness module. Actual incidents naturally resonate with the audience, all the more so if they affected the organization directly. 

As far as incidents go, a core meltdown at a nuclear power plant is about as big as they come. This afternoon, I've been reading an official US report into the Fukushima incident following the Sendai tsunami eight years ago this month. " Lessons Learned from the Fukushima Nuclear Accident for Improving Safety of U.S. Nuclear Plants " is an excellent treatise on the incident, published just over three years afterwards. As you would expect from a formal report, the style is matter-of-fact, describing the sequence of events that unfolded as the tsunami struck, the plant was terminally damaged, the electrical supplies and hence the monitoring, control and communications systems all failed, and the operators went to heroic lengths to shutdown all the units. The scenario was so extreme that the well-practiced emergency operating procedures and fail-safe controls proved inadequate, leaving the operators firstly struggling to determine what was going on inside the reactor buil...

Yesterday I wrote about a five-part strategy to increase the number and quality of incident reports. The fifth part involves making both staff and management vigilant or alert for trouble. There is an obvious link here to the ongoing security awareness and training activities, pointing out and explaining the wide variety of threats that people should know about. Thanks to this month's awareness content on malware, for instance, workers should be in a better position to spot suspicious emails and other situations in which they are at high risk of picking up malware infections. Furthermore, they ought to know what to do when they spot threats - avoiding risky activities ( e.g. not opening dodgy email attachments or links) and reporting them. In April we have the opportunity to take that a step further. What could or should the organization do to empower (facilitate and encourage) alert workers to report the malware threats and other concerns that they spot? What's the best way t...

Working on the management seminar slide-deck over the past couple of days, we've developed and documented a coherent five-part strategy for improving both the speed and the accuracy of incident reporting. The strategy mostly involves changing the motivations and behaviors of both staff and management, possibly with some IT systems and metrics changes where appropriate to support the objectives. Elaborating on the background and those objectives explains what the strategy is intended to achieve: the slides and notes justify the approach in business terms, in effect outlining a business case . It's generic, of course, but providing it in the form of a management seminar plus supporting notes and briefings encouragescustomers to engage their managers in a discussion around the proposal, hopefully leading to consensus and agreement to proceed, one way or another. The nice thing about this is that it can't really fail: the very act of management considering and discussing the pr...

Incident reporting is a key objective of next month's security awareness module. More specifically, we'd like workers to report information security matters promptly.  So how might we achieve that through the awareness and training materials?  Possible approaches include: Tell them to report incidents. Instruct them. Give them a direct order. Warn them about not doing it. Perhaps threaten some form of penalty if they don't. Convince them that it is in the organization's interests for workers to report stuff. Persuade them of the value. Convince workers that it is in their own best interest to report stuff. Persuade them. Explain the reporting requirement ( e.g. what kinds of things should they report, and how?) and encourage them to do so. Make reporting incidents 'the easy option', and not reporting harder. Reward people for reporting incidents. Something else? Trick them? Goad them? Follow up on those who did not report stuff promptly, asking about their reas...