# Presentation: 432599

## Cyber Security Awareness

- The Information Security Officer (ISO) for the Charleston VAMC is
- Jim Morrison at ext 7036.

## Know Your Information Security Officer (ISO)

- Your ISO is there to help you understand the rules and requirements to keep VA’s information secure. Your ISO can help with issues such as:
- Knowing what to do if your computer is infect with a virus
- Knowing what to do if you see someone using computers inappropriately or for theft or fraud
- Understanding your role in protecting the confidentiality and integrity of VA’s information
- Understanding how backups are conducted and why they are important
- Knowing your role in your facility’s contingency plan
- Always know your ISO in your facility.

## Confidentiality

- 	**At the VA, this means information is available only to those people who need it to do their jobs. At VA, confidentiality is a must**.
- To maintain confidentiality:
- Understand what information you have access to and why.
- Read and follow remote access security policies.
- Only access information systems through approved hardware, software, solutions, and connections.
- Take appropriate steps to protect information, network access, passwords, and equipment.
- Control access to patient files or information saved on a disk.
- Don’t use automatic password-saving features found on web sites.
- Promptly report to your ISO any misuse of the remote access process or report if Personally Identifiable Information (PII) has been compromised.

## Confidentiality continued...

- To maintain confidentiality:
- Lock your computer when you walk away from it. If you print PII, make sure you take it from the printer right away and keep it stored in a secure place.
- Protect ALL information and only access information when you need to do your job.
- Never talk about a veteran’s case in a public place or to anyone who does not have the need to know.
- 	VA computers are set up to protect confidentiality, but you also need to do your part.

## Rules of Behavior

- What are the VA National Rules of Behavior:
- Everyone who accesses VA’s information and information systems must understand their security roles and responsibilities.
- Information security do’s and don’ts are established in a document known as “VA National Rules and Behavior”.
- Prior to being granted access to VA’s information and information systems, users must agree to the VA National Rules and Behavior, stating they have read, understand, and will abide by these security rules. The VA National Rules and Behavior must be read and signed each year.
- The VA National Rules of Behavior also contains the consequences of inappropriate behavior. Consequences may range from a written reprimand to losing your job, depending upon the violation.

## Authorized Use of Equipment

**Authorized Use**
- Our veterans, expect us to protect their information. They also expect us to accomplish our mission. As a VA employee, you may have the privilege of some “limited personal use” of certain Government resources, such as computers, email, Internet access, and telephone/fax service.
**Limited Personal Use**
- This benefit is available only when it:
- Does not interfere with official VA business
- Is performed on the employee’s “non-work” time
- Involves no more than a minimal expense to the Government
- Is legal and ethical
- These benefits may be limited or eliminated at any time, especially if you abuse these privileges. Restrictions for personal use of resources can vary between VA facilities. To protect yourself, you should discuss you limits and responsibilities with your supervisor and ISO. More can be read about limited personal use of government equipment in VA Directive 6500.

## Authorized Use of Equipment continued...

**Inappropriate Use**
- Examples of misuse or inappropriate use are:
- Any personal use that could slow down, delay, or disrupt Government systems or equipment. These include continuous data streams, video, sound, or other large films which slow down the VA network.
- Using VA systems to get unauthorized access to other systems.
- Activities that are illegal, inappropriate, or offensive to fellow employees or the public. These include hate speech or material that ridicules others because of their race, creed, religion, color, sex, disability, national origin, or sexual orientation.

## Authorized Use of Equipment continued...

**Inappropriate Use**
- More examples of misuse or inappropriate use:
- Creating, downloading, viewing, storing, or transmitting sexually explicit or sexually oriented materials.
- Creating, downloading, viewing, storing, or transmitting materials related to gambling, illegal weapons, terrorist activities, or any other illegal or prohibited activities
- Using Government systems or equipment to make money, to get a non-government job, or do any business activity (for example, consulting for pay, sale or administration of business transactions, sale of goods or services).

## Authorized Use of Equipment continued...

**Inappropriate Use continued...**
- More examples of misuse or inappropriate use:
- Posting VA information to external newsgroups, bulletin boards, or other public forums without permission. This includes any use which may make someone else think the information came from a VA official (unless approval has been obtained), or uses that are at odds with the Agency’s mission or position
- Any use that could cost the Government money
- Accessing, using, copying, or sending VA computer software or data, private information, or copyrighted or trademarked information without permission
- 	Be sure to discuss you limits and responsibilities with your Supervisor and ISO

## Email

**Email Privacy and Security**
- Electronic mail (email) helps us do our jobs faster, but using email also has risks.
- Email is not private, never use email to send VA sensitive information about veterans or employees unless encrypted. If a work related issue requires you to send Personally Identifiable Information (PII) about a veteran or VA employee in an email message, you are required to encrypt the message (encrypt with PKI or RMS). Using PKI to encrypt a message validates that the message is authentic, keeps it confidential, and protects the message content from being altered.

## Email

**Chain letters and Hoaxes**
- Chain letters and hoax messages slow down the VA network. **NEVER** forward or reply to these messages. **DELETE** them, preferably without opening them. If you accidentally open the email, close it and delete it. **NEVER** open any attachments that come from an unknown source. Also, never reply by saying, “Please stop”. It slows down the VA email system.
**Email Hints**
- Here are a few tips on using email safely:
- Use virus protection software, and keep it up to date.
- Make sure your virus protection program scars all emails and attachments you send or receive..
- Learn to recognize the signs of a virus infection.
- Always be cautious when opening email from people you don’t know.
- Additionally, since most computer viruses are spread by email, do not open email attachments that are from people you do not know.
- NEVER open emails with inappropriate subject lines.

## Email continued...

- More Email Hints
- Use “_reply to all_” sparingly. Does everyone in you large email group really to see your response? Often, it’s more appropriate to limit your response to just the sender.
- Replying to unsolicited spam e-mail is actually more likely to increase the number of messages sent to your address. When spammers receive a reply that reply tells them your e-mail address is valid.
- Don’t forward or create hoaxes or ask people to modify their computer systems.
- Don’t spread rumors using e-mail. Be suspicious of any message that tells you to forward to others.
- More Email Hints
- Don’t participate in “mail-storms”. You don’t need to send a message saying “me too” or “thanks” or even “please stop”.
- Don’t open attachments from senders you don’t know.
- Don’t expect privacy when using e-mail to transmit, store, and communicate information.
- If you have any questions about how to deal with spam or how to encrypt a message, talk to your ISO.

## Remote Access

- You are only allowed at access, use, or send VA data while off-site if you have the permission of you supervisor. Also, you can only do so when the following security steps have been taken:
- You can only access, use, or send VA information from a VA-owned laptop, handheld computer, or storage device. You cannot use you home computer, personal laptop, or storage device to access, use, or send VA data.
- You must have you supervisor’s permission to obtain remote access.
- You must apply for this permission though your ISO.
- You must have you supervisor’s permission to transport, transmit, access, and use VA sensitive information outside of VA facilities.
- You cannot share VA information with anyone else.
- You must not share your username or password—or instructions on how to access the VA network—with anyone else.
- You cannot store VA data on your personally owned computer or laptop.

## Removable Storage Media

- In order to store VA sensitive information on removable storage media, you must have permission from you supervisor and your ISO. Only VA approved and procured thumb drives are allowed.
- Thumb Drives
- VA Hand book 6500 requires written permission from both your supervisor and your ISO to obtain a thumb drive.

## Malware

- High-tech vandals have created dangerous programs that infect computer systems. These programs vary in how they infect and damage systems and are collectively called “Malware”. When our systems become infected with malware they may not operate properly.

## Malware

**Antivirus Software**
- VA uses a Department-wide antivirus program. Antivirus software is automatically installed and updated. However, new viruses are developed every day. They can be spread from inside or outside VA. There is no protection from newly discovered viruses, which is why it is important for you to protect yourself and the VA.
- If your IT staff updates you antivirus software at night, you should make sure to log off of your computer when you leave at the end of the day, ***but do not turn you computer off***. This will allow the updates to occur overnight.
**Symptoms**
- There may be a problem if your computer has any of these symptoms:
- Reacts slower than usual
- Stops running for no apparent reason
- Fails to start (“boot”)
- Seems to be missing important files
- Prevents you from saving your work

## Malware 

**Malware Tips**
- Here are a few tips:
- Delete e-mail messages from unknown senders or messages with unusual subject lines, such as “open this immediately”.
- Never stop or disable your antiviral program.
- Make sure your files are backed up on a regular schedule. Check with your IT staff to ensure your information is being backed up.
- Set your virus protection software to scan your e-mails and attachments.
- Be very careful if someone sends you an attachment containing executable code. You can recognize these by the file extensions, such as: .exe, .vbs, .js, .jse, .wsf,. Vbe, and .wsh.
**Do not delete any system files when asked to do so in an e-mail**.

## Social Engineering 

**What is Social Engineering?**
- Have you heard of “social engineering”?
- Social engineering happens when a person tries to gain your trust in order to get information and resources which he or she can use for harm. This is an important information security issue!
- Social Engineering Methods
- If people ask you for VA personally identifiable information, make sure you know who they are and if they really need access to the information. Also, make sure they have permission to get such information or access it as part of their job.
- A Social Engineer may try to trick you into giving them your password to illegally gain access to your system or information about VA’s patients, beneficiaries and dependents, and employees. We know you want to be helpful, but social engineers may try to take advantage of your kindness.

## Social Engineering

- Social Engineering Example
- One example of social engineering that hurt a VA facility was a phone call from someone claiming to be from “The phone company”. The thief said he was testing lines and long distance circuits. The thief then asked an employee to dial a special code, which gave him access to a long distance service. This scam resulted in thousands of dollars worth of unauthorized calls being made at VA’s expense.

## Social Engineering

**You are the First Line of Defense**
- As we learn more about the tactics hackers use to get access to VA’s information and systems, hackers continue to look for new ways to get around our protections. Social engineers will rarely ask for sensitive information directly, but will work on gaining your trust and manipulate you into assisting them in getting the information and resources.
- You have to be diligent in protecting the VA from the tactics of social engineers because you are our first line of defense.

## Peer-To-Peer File Sharing

- Peer-To-Peer Programs
- Public peer-to-peer file sharing (commonly known as P2P”) refers to programs that let anonymous files be shared between computers. There are times when using P2P is helpful. But most of the time, these programs break the law by sharing copyrighted music, videos, and games. Some common public P2P programs are Kazaa, Freewire, Grokster, and Morpheus.
- Public P2P is not allowed at VA.

## Peer-To-Peer File Sharing

- Peer-To-Peer Dangers
- P2P programs also can be used to spread viruses and “spyware”. Spyware Programs track what you do on your computer and send information to thieves and hackers-without you knowing it. For example, someone could use spyware to get information about you, you coworkers, veterans, and veterans’ families. This information could be used to steal your identity, buy items on a veteran’s credit card, or collect personal financial information about a VA employee. In addition, P2P file-sharing makes the VA network run slower.
- Don’t be a victim, Use your computer wisely. If you think your computer may have P2P software or spyware, tell your ISO

## Passwords

**Importance of passwords**
- Passwords are important tools for protecting VA information and information systems and getting your job done.
- They ensure that you and only you have access to the information you need. Keep your password secret.
- IF you have several passwords, store them in a safe and secure place that no one else knows about.
**Strong Passwords**
- VA requires strong passwords on all information systems. Passwords must:
- Be changed at least every 90 days.
- Have at least eight characters (i.e., Gabc123&)
- Use at least three of the following four kinds of characters:
- Upper-case letters (ABC...)
- Lower –case letters (...xyz)
- Numbers (0123456789)
- Special characters, such as #, &, *, or @
- 	Using these rules will provide you with a “Strong” password.

## Passwords

- Passwords Rules of Thumb
- Don’t use words found in a dictionary
- Follow the rules for strong passwords
- Don’t use personal references (names, birthdays, addresses, etc.)
- Change your password at least every 90 days. If you suspect someone may know your password, change it immediately and inform your ISO.
- Never let anyone stand near you while you type your password. Ask people to turn away while you type it, and don’t let them see your keyboard while you type.
- If you have several passwords to remember you may write them down, BUT keep them in a locked place so no one else can get them.

## Passwords

- Your username and password protect you and the information stored on VA computers.
- When you log into a VA system, the combination of your user name and password identifies **YOU** as the person accessing the system and information. All actions taken after you log into the system are identifiable back to you, so it is important that you **NEVER** share your log in information.
- If someone else uses your account information, you are responsible. Guard your password and never disclose is to anyone!

## Backups

- Importance of Backups
- Any work you do on VA’s computer is important. It is important to you because of the time and effort expended to create it. It is important to VA and to veterans because it supports our mission. There are some resources we can’t afford to lose, so database backups are systematically and routinely created on systems such as VistA, BDN and others. Backups are cheap insurance.
- Backup routines
- VA information technology staff work hard to make sure the VA data is safe and routinely backed up. Most facilities have routines that automatically backup data on users’ computers to a networked server in a computer room.
- The question is not **IF** you will ever need to use your backup-the question is **WHEN**; so making backups is a smart practice for your home computer, too.

## Incidents

**Dangers of Incidents**
- Incidents can compromise our computers and our work. Security incidents include the following:
- A virus attack
- A lost or stolen computer
- Files are missing or were compromised
- Personally identifiable information was shared with people who do not have a need to know
- 	All of these are examples of computer-related incidents. It is important to tell your supervisor and ISO when you see such incidents.

## Incidents

**Incidents Do’s and Don’ts**
- If you think a security incident has occurred, you should:
- Write down the date, time, and location the incident took place as well as the computers which may have been affected.
- Tell your ISO what happened.
- Write down any error messages that showed up on your computer screen.
- Write down any Web addresses, server names, or IP addresses involved in the incident.

## Incidents

**Incidents Do’s and Don’ts**
- You’ve probably heard about the theft of electronic information from a VA employee’s home. The data included names, addresses, and social security numbers of millions of veterans. Fortunately, the information was recovered and was never accessed. However, this data breach violated our promise to veterans and put them at risk for identity theft.
- So, when you suspect an incident may have occurred, it’s very important you tell your ISO and supervisor immediately (i.e. one hour or less). DON’T WAIT.
- It’s best to contact your ISO in person or by telephone rather than by email. You may NOT contact the media (radio, TV, newspapers) or anyone outside your VA facility. If a crime is involved, (such as an item was stolen) you also need to report it to VA law enforcement.

## Final Summary

- VA’s information systems are a major part of how we help veterans. They also affect our readiness to work with other Federal agencies, such as the Departments of Defense, Health and Human Services, and Homeland Security, during national emergencies.
- The FBI has warned all Federal agencies that their systems, and the information in those systems, are potential targets for attacks. Now more than ever, the VA’s systems and the information they contain must be available to serve our Nation and its veterans. Please be careful. Don’t do anything that might damage our information and information systems.

## FINAL Summary

- The work we do at VA is an important part of our Nation’s security and this puts VA’s information and information systems at risk. VA employees must do their part to prevent attacks that would breach the security of the system and the information that could interrupt care of our veterans. You have just learned some important information that will assist you with guarding information and what steps to take if a breach occurs.
- Remember, if an incident occurs report it to your ISO immediately. If your ISO, **Jim Morrison**, is not available, contact your Network ISO, Gregg Walker.