# Presentation: 040423

## IT Security Training (Mandatory) FY 2006

**USDA Security Literacy and Basics**
- [Off line version]

## Explain the importance of information security 
Identify threats and vulnerabilities to information security 
incorporate safeguards into your daily routine
Recognize malicious code and respond appropriately 
Understand your roles and responsibilities 

- Explain the importance of information security
- Identify threats and vulnerabilities to information security
- incorporate safeguards into your daily routine
- Recognize malicious code and respond appropriately
- Understand your roles and responsibilities

## The Importance of Information Security 
Threats and Vulnerabilities 
Viruses and Malicious Code 
Roles and Responsibilities 

- The Importance of Information Security
- Threats and Vulnerabilities
- Viruses and Malicious Code
- Roles and Responsibilities

## Definition of Information Security
Applying good security principles and measures
Confidentiality, Integrity, and Availability
Configuration Management
Certification and Accreditation
Contingency Planning 
Sensitive Data Retention 

- Definition of Information Security
- Applying good security principles and measures
- Confidentiality, Integrity, and Availability
- Configuration Management
- Certification and Accreditation
- Contingency Planning
- Sensitive Data Retention

## Key Policies and Laws 
USDA Policies 
Physical Security 
Personnel Security 

- Key Policies and Laws
- USDA Policies
- Physical Security
- Personnel Security

## FISMA (The Federal Information Security Management Act of 2002) 
The Privacy Act of 1974 
OMB Circular No. A-130, Security of Federal Automated Information Resources (Appendix III)  

- FISMA (The Federal Information Security Management Act of 2002)
- The Privacy Act of 1974
- OMB Circular No. A-130, Security of Federal Automated Information Resources (Appendix III)

## DM 3440-002, Control and Protection of "Sensitive Security Information" 
DM 3500, USDA Cyber Security Manual 
DR 3300-1, Telecommunications & Internet Services & Use 

- DM 3440-002, Control and Protection of "Sensitive Security Information"
- DM 3500, USDA Cyber Security Manual
- DR 3300-1, Telecommunications & Internet Services & Use

## You have been named to a committee to review information security policies in place at your agency. You decide to look at Department, not Federal, documents first. Which of the following two are USDA documents? 
  a.  DM 3500, USDA Cyber Security Manual  
  b.  DR 3300-1, Telecommunications & Internet Services & Use  
  c.  The Privacy Act of 1974  
  d.  OMB Circular No. A-130 

- You have been named to a committee to review information security policies in place at your agency. You decide to look at Department, not Federal, documents first. Which of the following two are USDA documents?
-   a.  DM 3500, USDA Cyber Security Manual
-   b.  DR 3300-1, Telecommunications & Internet Services & Use**  **
-   c.  The Privacy Act of 1974
-   d.  OMB Circular No. A-130

**Notes:**
DM 3500 and DR 3300-1 are USDA documents. The Privacy Act of 1974 and OMB Circular No. A-130 are Federal documents.

## Building and/or floor access cards 
Surveillance cameras 
Alarm systems for unauthorized entry 
Fire protection 
Emergency lighting 
Security Guard Service 
Public Addressing System 

- Building and/or floor access cards
- Surveillance cameras
- Alarm systems for unauthorized entry
- Fire protection
- Emergency lighting
- Security Guard Service
- Public Addressing System

## Background screening of job applicants and employees 
Need-to-know access based on job function 
Continual monitoring of employee system usage 
Separation of job duties 

- Background screening of job applicants and employees
- Need-to-know access based on job function
- Continual monitoring of employee system usage
- Separation of job duties

##    --A national program to protect physical and information-based systems essential to the minimum operations of the economy and government. They include, but are not limited to, agriculture, telecommunications, energy, banking and finance, transportation, water systems, and emergency services, both government and private. 

-    --A national program to protect physical and information-based systems essential to the minimum operations of the economy and government. They include, but are not limited to, agriculture, telecommunications, energy, banking and finance, transportation, water systems, and emergency services, both government and private.

## True or False: Physical security involves securing building areas and campuses in order to protect people, workspaces, dwellings, and resources. Measures include surveillance cameras and alarm systems.
  a.  True  
  b.  False 

- True or False: Physical security involves securing building areas and campuses in order to protect people, workspaces, dwellings, and resources. Measures include surveillance cameras and alarm systems.
-  ** **a.  True**  **
-   b.  False

**Notes:**
Physical security involves securing building areas and campuses in order to protect people, workspaces, dwellings, and resources. Measures include surveillance cameras and alarm systems.

## What is a Threat? 
Types of Threats - Natural 
Types of Threats - Human 
What Is a Vulnerability?
Natural 
Human 
System 
Telecommunications 

- What is a Threat?
- Types of Threats - Natural
- Types of Threats - Human
- What Is a Vulnerability?
- Natural
- Human
- System
- Telecommunications

**Notes:**
A computer security threat is any circumstance or event with the potential to cause: either unauthorized loss, modification, or disclosure of information; or damage to your computer or any part of the information technology system. A computer security vulnerability is a weakness in an information system and/or its components that could accidentally or intentionally allow the system to be compromised. This weakness allows a natural or human threat to cause serious damage.  

## A natural threat is just what it sounds like: natural. Its source is either from nature or a system's environment.
Natural threats can include:
Lightning 
Fires 
Hurricanes 

- A natural threat is just what it sounds like: natural. Its source is either from nature or a system's environment.
- Natural threats can include:
- Lightning
- Fires
- Hurricanes

## 
An unintentional human threat 
Operator error 
Placing a cup of coffee by your keyboard 
Carelessness 
An intentional human threat
A spy 
A hacker 
A disgruntled employee 

- An unintentional human threat
- Operator error
- Placing a cup of coffee by your keyboard
- Carelessness
- An intentional human threat
- A spy
- A hacker
- A disgruntled employee

**Notes:**
Human threats are caused through unintentional or intentional actions.

## Natural: i.e. located in an area prone to flooding  
Human:  employees untrained in IT security
System:  Backup files are created only once a month  
Telecommunications:  employee uses a cell phone to discuss sensitive information

- Natural: i.e. located in an area prone to flooding
- Human:  employees untrained in IT security
- System:  Backup files are created only once a month
- Telecommunications:  employee uses a cell phone to discuss sensitive information

**Notes:**
Consequences: A flash flood could damage the computers and its files; an employee could delete data accidentally or alter files incorrectly; the restoration of lost or damaged files could be time-consuming if not impossible; and the use of an unsecured telephone could allow for unauthorized disclosure and/or identity theft. 

## A circumstance or an event with the potential to cause damage to your computer or any part of the information technology system is the definition for which two of the following choices? 
  a.  Human Threat  
  b.  System Vulnerability  
  c.  Natural Threat  
  d.  Natural Vulnerability 

- A circumstance or an event with the potential to cause damage to your computer or any part of the information technology system is the definition for which two of the following choices?
-   a.  Human Threat**  **
-   b.  System Vulnerability
-   c.  Natural Threat**  **
-   d.  Natural Vulnerability

**Notes:**
& c. 
A computer security threat, either natural or human, is any circumstance or event with the potential to cause damage to your computer or any part of the information technology system. A vulnerability is a weakness that could allow a natural or human threat to cause damage.

## Internal Intruder:  Surveys show that most damage is done by insiders--those with authorized access to a computer network. To safeguard against an attack, passwords need to be kept secret and not shared. Any suspicious activity should be reported to your security officer or supervisor. 
External Intruder:  U. S. Government computer systems are subject to attack from intelligence officers of some foreign countries. Other outsider intruders could include freelance information brokers, terrorist organizations, hobbyist crackers, and common thieves who specialize in stealing laptops. Again, report any suspicious activity to your security officer or supervisor. 

**Internal Intruder:**  Surveys show that most damage is done by insiders--those with authorized access to a computer network. To safeguard against an attack, passwords need to be kept secret and not shared. Any suspicious activity should be reported to your security officer or supervisor.
**External Intruder:**  U. S. Government computer systems are subject to attack from intelligence officers of some foreign countries. Other outsider intruders could include freelance information brokers, terrorist organizations, hobbyist crackers, and common thieves who specialize in stealing laptops. Again, report any suspicious activity to your security officer or supervisor.

## Social engineering relies on weaknesses in human nature rather than software to trick people into revealing information.

Safeguard your passwords
Do not participate in telephone surveys
Do not give out information
Do not type anything unless you know the expected results
Ensure you give necessary information to a legitimate source   

- Social engineering relies on **weaknesses in human nature** rather than software to trick people into revealing information.
- Safeguard your passwords
- Do not participate in telephone surveys
- Do not give out information
- Do not type anything unless you know the expected results
- Ensure you give necessary information to a legitimate source

## Write down the telephone number if caller ID is available. 
Take detailed notes of the conversation. 
Immediately contact your supervisor once the caller has hung up or if you have placed him or her on hold. 

- Write down the telephone number if caller ID is available.
- Take detailed notes of the conversation.
- Immediately contact your supervisor once the caller has hung up or if you have placed him or her on hold.

## To help prevent intruder or social engineering attacks from succeeding, you should incorporate all but which one of the following tips? 
  a.  Do not participate in telephone surveys.  
  b.  Do not give out information about yourself or other employees.  
  c.  Do not share your password with anyone other than your supervisor.  
  d.  Do not type anything into the computer unless you know the expected results. 

- To help prevent intruder or social engineering attacks from succeeding, you should incorporate all but which one of the following tips?
-   a.  Do not participate in telephone surveys.
-   b.  Do not give out information about yourself or other employees.
**  **c.  Do not share your password with anyone other than your supervisor.
-   d.  Do not type anything into the computer unless you know the expected results.

**Notes:**
To help prevent intruder or social engineering attacks from succeeding, you should not share your password with your supervisor or anyone else. 

## The majority of security breaches are caused by insiders—employees, contractors, and others who have legitimate access to the computer system. Safeguards are:

When you are leaving your work area, use a password-protected screen saver, lock your computer (Ctrl-Alt-Del on most systems), or simply log off. 
Protect your access information and do not share your passwords. 
Be aware of your surroundings and report any suspicious or out-of-the-ordinary behavior, including persons seeking unauthorized access to information. 

- The majority of security breaches are caused by insiders—employees, contractors, and others who have legitimate access to the computer system. Safeguards are:
- When you are leaving your work area, use a password-protected screen saver, lock your computer (Ctrl-Alt-Del on most systems), or simply log off.
- Protect your access information and do not share your passwords.
- Be aware of your surroundings and report any suspicious or out-of-the-ordinary behavior, including persons seeking unauthorized access to information.

## Cookies:  A cookie is a file that a Web site stores on your hard drive and retrieves whenever you visit that site. 
A denial of service attack involves bombarding the server with huge amounts of data from many different machines and locations
Malicious code is defined as a hostile program or file that can disclose unauthorized information, or damage and interfere with a computer's normal operation. 

**Cookies**:  A cookie is a file that a Web site stores on your hard drive and retrieves whenever you visit that site.
**A denial of service attack** involves bombarding the server with huge amounts of data from many different machines and locations
**Malicious code** is defined as a hostile program or file that can disclose unauthorized information, or damage and interfere with a computer's normal operation.

## True or False: The majority of security breaches are caused by insiders—employees, contractors, and others who have legitimate access to the computer system. 
  a.  True  
  b.  False 

- True or False: The majority of security breaches are caused by insiders—employees, contractors, and others who have legitimate access to the computer system.
-   a.  True**  **
-   b.  False

**Notes:**
The majority of security breaches are caused by insiders who have legitimate access to the computer system. 

## What is Malicious Code?
Examples of Malicious Code – Viruses
Examples of Malicious Code – Worms
Examples of Malicious Code - Trojan Horses and Spyware 

- What is Malicious Code?
- Examples of Malicious Code – Viruses
- Examples of Malicious Code – Worms
- Examples of Malicious Code - Trojan Horses and Spyware

## 
   Malicious code, also known as malware (malicious software), is designed to deny, destroy, modify, or impede a system's configuration, programs, data files, or routines. 

-    Malicious code, also known as malware (malicious software), is designed to deny, destroy, modify, or impede a system's configuration, programs, data files, or routines.

##     A virus is a small piece of code that attaches itself to another program. It does not run on its own, but executes when the host program is run. Symptoms of virus infection may include:
Slow computer response time 
Corrupt files 
Modified files 
Lost files 
Computer failure 
Unauthorized emails being sent or received 

-     A virus is a small piece of code that attaches itself to another program. It does not run on its own, but executes when the host program is run. Symptoms of virus infection may include:
- Slow computer response time
- Corrupt files
- Modified files
- Lost files
- Computer failure
- Unauthorized emails being sent or received

## A worm can cause the same damage as a virus; however, a worm is an independent program rather than a code fragment. It usually "worms" its way from system to system throughout a network.
A worm has the potential for major system outages. Worms can infiltrate computers, servers, and the e-mail system, resulting in outages that can last several weeks. 

- A worm can cause the same damage as a virus; however, a worm is an independent program rather than a code fragment. It usually "worms" its way from system to system throughout a network.
- A worm has the potential for major system outages. Worms can infiltrate computers, servers, and the e-mail system, resulting in outages that can last several weeks.

## On the surface, a Trojan horse appears to be a legitimate software program; but its code may allow the unauthorized collection, exploitation, falsification, or destruction of data. Some Trojan horses allow remote and unauthorized access to your computer.

## Spyware is generally installed on a computer when you install shareware or some similar and usually free software. Spyware is similar to a non-destructive Trojan horse in that it collects information and sends it to its author. Unfortunately, this data collection, usually of your activities on the Internet, most often is done without your knowledge. 

- Spyware is generally installed on a computer when you install shareware or some similar and usually free software. Spyware is similar to a non-destructive Trojan horse in that it collects information and sends it to its author. Unfortunately, this data collection, usually of your activities on the Internet, most often is done without your knowledge.

## What is a small piece of code that attaches itself to another program, does not run on its own, and executes when the host program is run? 
  a.  Virus  
  b.  Trojan horse  
  c.  Worm  
  d.  Spyware 

- What is a small piece of code that attaches itself to another program, does not run on its own, and executes when the host program is run?
-   a.  Virus**  **
-   b.  Trojan horse
-   c.  Worm
-   d.  Spyware

**Notes:**
A virus is a small piece of code that attaches itself to another program, does not run on its own, and executes when the host program is run. 

## Usually through inadequate security procedures:
Using an unknown Diskette or CD
Opening E-mail or an e-mail attachment
Downloading a file from the internet
Loading software from peers or the internet

- Usually through inadequate security procedures:
- Using an unknown Diskette or CD
- Opening E-mail or an e-mail attachment
- Downloading a file from the internet
- Loading software from peers or the internet

## 
Hoaxes:  Hoaxes are email messages with one purpose: to be sent to as many people as possible. The emails may appear legitimate and may actually come from people you know. They usually warn about something or promote a "great deal." They may even be in the form of chain letters. However, the real purpose is to slow down the Internet and email service by clogging the networks with all the extra traffic.

**Hoaxes**:  Hoaxes are email messages with one purpose: to be sent to as many people as possible. The emails may appear legitimate and may actually come from people you know. They usually warn about something or promote a "great deal." They may even be in the form of chain letters. However, the **real purpose is to slow down the Internet** and email service by clogging the networks with all the extra traffic.

## 
Spam:  Although not a hoax, spam is becoming a burden on email servers. Spam is the email version of "junk mail." Even with spam filters in place, some spam gets through. The best way to avoid spam is to be careful about giving out your email address arbitrarily. And if you do receive spam, just delete it. Don't respond to the sender! You may also want to notify your system administrator or Help Desk if you receive large amounts of spam. 

**Spam**:  Although not a hoax, spam is becoming a burden on email servers. **Spam is the email version of "junk mail."** Even with spam filters in place, some spam gets through. The best way to avoid spam is to be careful about giving out your email address arbitrarily. And if you do receive spam, just delete it. Don't respond to the sender! You may also want to notify your system administrator or Help Desk if you receive large amounts of spam.

## 
Adware:  Another fast-growing problem is adware. Adware is advertising on the Internet, usually in the form of pop-up advertisements that can appear even if you are not using your web browser. It usually gets on your system from a freeware or shareware installation. Sometimes, you may unknowingly agree to it when you accept the end user license agreement. You may want to notify your system administrator or Help Desk if you see this type of behavior occurring. 

**Adware**:  Another fast-growing problem is adware. Adware is advertising on the Internet, usually in the form of **pop-up advertisements** that can appear even if you are not using your web browser. It usually gets on your system from a freeware or shareware installation. Sometimes, you may unknowingly agree to it when you accept the end user license agreement. You may want to notify your system administrator or Help Desk if you see this type of behavior occurring.

## What is the purpose of an email hoax? 
  a.  To slow down network traffic  
  b.  To scare you  
  c.  To promise "good fortune" if you forward the email to five co-workers  
  d.  To make you laugh 

- What is the purpose of an email hoax?
-  ** **a.  To slow down network traffic**  **
-   b.  To scare you
-   c.  To promise "good fortune" if you forward the email to five co-workers
-   d.  To make you laugh

**Notes:**
The purpose of an email hoax is to get the user to send emails to multiple recipients, thus slowing down the Internet and email service by clogging the networks with extra email traffic. 

## Lots of software can be downloaded for free from the Internet or given to you by a peer or friend. APHIS has policies that prohibit the download and installation of these non-approved software products.
There is a risk that non-approved software might contain malicious code, such as spyware or worse. It may also negatively affect your computer system and how it functions.
If you have a legitimate need to install software, whether the source be a peer, the Internet, or something you bring from home, contact your IT customer service person or system administrator. 

- Lots of software can be downloaded for free from the Internet or given to you by a peer or friend. APHIS has policies that prohibit the download and installation of these non-approved software products.
- There is a risk that non-approved software might contain malicious code, such as spyware or worse. It may also negatively affect your computer system and how it functions.
- If you have a legitimate need to install software, whether the source be a peer, the Internet, or something you bring from home, contact your IT customer service person or system administrator.

## Without getting approval from your system administrator or supervisor, you installed on your work computer a free software program that adds pictures to your outgoing email. Is this program an accepted practice? 
  a.  Yes  
  b.  No 

- Without getting approval from your system administrator or supervisor, you installed on your work computer a free software program that adds pictures to your outgoing email. Is this program an accepted practice?
-   a.  Yes
**  **b.  No

**Notes:**
There is the risk that software downloaded from the Internet might download something unexpected, such as spyware or worse. Therefore, it should not be downloaded and installed without the approval of your IT customer service representative, your system administrator or supervisor. 

## Remain calm. 
Call the Help Desk or your system administrator.  Contact your IT Customer Service Representative.
Power off the computer and inform your supervisor if you get no response from the Help Desk or your system administrator. 
Attempt to document what you saw on the computer screen for later investigation. 

- Remain calm.
- Call the Help Desk or your system administrator.  Contact your IT Customer Service Representative.
- Power off the computer and inform your supervisor if you get no response from the Help Desk or your system administrator.
- Attempt to document what you saw on the computer screen for later investigation.

## Rules of Computing - the Do's 
Rules of Computing - the Don'ts 
Rules of Computing - Right to Privacy
Prohibitions

- Rules of Computing - the Do's
- Rules of Computing - the Don'ts
- Rules of Computing - Right to Privacy
- Prohibitions

## Do follow security procedures. 
Do report security problems, incidents, and suspicious or unusual behavior. 
Do ask for identification from unknown individuals, including maintenance people. 
Do recognize the accountability assigned to your User ID and password. 
Do use anti-virus software and ensure that its signature files are up to date. 
Do follow Department and Agency rules about installing software. 
Do read end user license agreements. 
Do shred sensitive documents before disposal. 

- Do follow security procedures.
- Do report security problems, incidents, and suspicious or unusual behavior.
- Do ask for identification from unknown individuals, including maintenance people.
- Do recognize the accountability assigned to your User ID and password.
- Do use anti-virus software and ensure that its signature files are up to date.
- Do follow Department and Agency rules about installing software.
- Do read end user license agreements.
- Do shred sensitive documents before disposal.

## Do log out or lock your workstation before leaving it unattended. 
Do back up your local hard drive. 
Do keep food and drink away from your computer and keyboard. 
Do create passwords that are difficult to guess. 
Do limit personal use of your system, especially email and the Internet. 
Do consider "need to know" before sharing information. 
Do keep your laptop and other personal electronic devices safe while traveling. 

- Do log out or lock your workstation before leaving it unattended.
- Do back up your local hard drive.
- Do keep food and drink away from your computer and keyboard.
- Do create passwords that are difficult to guess.
- Do limit personal use of your system, especially email and the Internet.
- Do consider "need to know" before sharing information.
- Do keep your laptop and other personal electronic devices safe while traveling.

## Don't use a computer to harm other people. 
Don't interfere with other people's computer work. 
Don't snoop in other people's files. 
Don't use a computer to steal. 
Don't use or copy software that you have not purchased, or has not been approved by the agency. 
Don't steal other people's intellectual property or violate copyright laws. 

- Don't use a computer to harm other people.
- Don't interfere with other people's computer work.
- Don't snoop in other people's files.
- Don't use a computer to steal.
- Don't use or copy software that you have not purchased, or has not been approved by the agency.
- Don't steal other people's intellectual property or violate copyright laws.

## Don't use a computer to pose as another person. 
Don't use other people's computer resources without approval. 
Don't share your user ID and password. 
Don’t install freeware and shareware that has not been tested and authorized for use by your agency. 
Don't allow yourself to be a victim of social engineering or a scam by giving out information to unauthorized individuals. 

- Don't use a computer to pose as another person.
- Don't use other people's computer resources without approval.
- Don't share your user ID and password.
- Don’t install freeware and shareware that has not been tested and authorized for use by your agency.
- Don't allow yourself to be a victim of social engineering or a scam by giving out information to unauthorized individuals.

## Activity on Government computers is monitored for security reasons. When you log on to a Government system, you give your consent to this monitoring; therefore, the right to privacy does not apply to your computer use.
Nevertheless, you must respect the privacy of USDA clients, employees and member of the public.

- Activity on Government computers is monitored for security reasons. When you log on to a Government system, you give your consent to this monitoring; therefore, the right to privacy does not apply to your computer use.
- Nevertheless, you must respect the privacy of USDA clients, employees and member of the public.

## Pornography 
Gambling 
Private business activities 
Personal software 
Unauthorized configuration changes 
Online auctioning
Peer-to-peer software use

- Pornography
- Gambling
- Private business activities
- Personal software
- Unauthorized configuration changes
- Online auctioning
- Peer-to-peer software use

## Visits to which two of the following types of Web sites are banned on Government computers? 
  a.  Travel  
  b.  Pornography  
  c.  News  
  d.  Gambling 

- Visits to which two of the following types of Web sites are banned on Government computers?
-   a.  Travel
-   b.  Pornography**  **
-   c.  News
-   d.  Gambling

**Notes:**
Visits to pornography and gambling Web sites are banned on Government computers. 

## Memorize your passwords. 
Do not write down passwords. 
Do not share passwords with anyone. 
Choose passwords that are easy to remember and hard to guess and use a mixture of letters, numbers, and special characters. 

- Memorize your passwords.
- Do not write down passwords.
- Do not share passwords with anyone.
- Choose passwords that are easy to remember and hard to guess and use a mixture of letters, numbers, and special characters.

## Do not use personal information for a password, such as birthdays or names of family members, pets, sports teams, and so forth. 
Avoid using words or phrases that are found in the dictionary. 
Change your passwords on a regular basis. 
Do not use the same office passwords for any personal logins, such as your personal bank account or personal email. 
A password should be like a toothbrush. Use it every day; change it regularly; and DON'T share it with friends. 

- Do not use personal information for a password, such as birthdays or names of family members, pets, sports teams, and so forth.
- Avoid using words or phrases that are found in the dictionary.
- Change your passwords on a regular basis.
- Do not use the same office passwords for any personal logins, such as your personal bank account or personal email.
- A password should be like a toothbrush. Use it every day; change it regularly; and DON'T share it with friends.

## When should you change your password? Select two answers. 
  a.  Never  
  b.  Every day  
  c.  On a regular basis  
  d.  If you think someone else might know it 

- When should you change your password? Select two answers.
-   a.  Never
-   b.  Every day
-   c.  On a regular basis
-   d.  If you think someone else might know it

**Notes:**
You should change your password immediately if you think someone else might know it. Otherwise, change it on a regular basis. 

## Make regular back-ups a part of your routine
Keep a set of your backup files off-site. 
Label the backups to reflect their sensitivity level, and store them in a secure location. 
Store backups in approved containers, such as metal cabinets and away from magnetic sources like radios and telephones. 
Check with your system administrator or Help Desk to ensure that their enterprise backup procedures also include files stored on your local drive, or if your agency requires that information be stored on central servers. 

- Make regular back-ups a part of your routine
- Keep a set of your backup files off-site.
- Label the backups to reflect their sensitivity level, and store them in a secure location.
- Store backups in approved containers, such as metal cabinets and away from magnetic sources like radios and telephones.
- Check with your system administrator or Help Desk to ensure that their enterprise backup procedures also include files stored on your local drive, or if your agency requires that information be stored on central servers.

## FAX
Cell phones
PDAs
Laptops

- FAX
- Cell phones
- PDAs
- Laptops

## Because a fax machine transmits a printed document, perform the steps that are listed below to ensure that the transmission is as secure as possible. These steps are especially important when transmitting sensitive data.
Notify the recipient that a fax is being sent. 
Before pressing the fax machine's send button, check that you have entered the correct telephone number for the recipient's fax machine. 
Verify by phone or email that the fax was received. 

- Because a fax machine transmits a printed document, perform the steps that are listed below to ensure that the transmission is as secure as possible. These steps are especially important when transmitting sensitive data.
- Notify the recipient that a fax is being sent.
- Before pressing the fax machine's send button, check that you have entered the correct telephone number for the recipient's fax machine.
- Verify by phone or email that the fax was received.

## Cell phones are essential today because of employees' mobility in their work environment. However, users need to remember that cell phone conversations can easily be overheard or intercepted. Therefore, keep the following points in mind:
Cell phones are not secure communication devices. 
Do not discuss sensitive information over the cell phone. 
Use your office telephone if you plan to discuss sensitive information. 

- Cell phones are essential today because of employees' mobility in their work environment. However, users need to remember that cell phone conversations can easily be overheard or intercepted. Therefore, keep the following points in mind:
- Cell phones are not secure communication devices.
- Do not discuss sensitive information over the cell phone.
- Use your office telephone if you plan to discuss sensitive information.

## Personal digital assistants, known as PDAs, have tremendous connectivity and storage capabilities. Their small size and low cost make them easy to obtain and challenging to secure. Because of their size, they could be easily stolen or lost. Also, it could be easy for a person to set up a PDA and download information from your computer. To protect your PDA and to protect your computer from someone else's PDA, practice the following safeguards:

Always know where your PDA is located. 
Only connect PDAs to approved systems. 
Wireless capabilities should only be used on approved known sources. 
If possible, password protect your PDA. 

- Personal digital assistants, known as PDAs, have tremendous connectivity and storage capabilities. Their small size and low cost make them easy to obtain and challenging to secure. Because of their size, they could be easily stolen or lost. Also, it could be easy for a person to set up a PDA and download information from your computer. To protect your PDA and to protect your computer from someone else's PDA, practice the following safeguards:
- Always know where your PDA is located.
- Only connect PDAs to approved systems.
- Wireless capabilities should only be used on approved known sources.
- If possible, password protect your PDA.

## Laptop computers and pocket personal computers are also quite portable and can have tremendous storage capabilities. They are also vulnerable to theft and security breaches. To protect the data on your laptop, practice the following safeguards:

Do not use Windows® 95, Windows® 98, or Windows® Millennium as your operating system. 
Password protect the logon to your laptop at the operating system level. 
Password protect access to sensitive information. 
If using wireless, use only agency-approved wireless connections. 
Be careful what you display on your screen, especially in close quarters such as on airplanes. 
Do not let your laptop out of sight unless it is in a secure location. 

- Laptop computers and pocket personal computers are also quite portable and can have tremendous storage capabilities. They are also vulnerable to theft and security breaches. To protect the data on your laptop, practice the following safeguards:
- Do not use Windows® 95, Windows® 98, or Windows® Millennium as your operating system.
- Password protect the logon to your laptop at the operating system level.
- Password protect access to sensitive information.
- If using wireless, use only agency-approved wireless connections.
- Be careful what you display on your screen, especially in close quarters such as on airplanes.
- Do not let your laptop out of sight unless it is in a secure location.

## Which of the following items should NOT be used for sensitive information? 
  a.  Fax machines  
  b.  Office telephones  
  c.  Laptop computers  
  d.  Cell phones 

- Which of the following items should NOT be used for sensitive information?
-   a.  Fax machines
-   b.  Office telephones
-   c.  Laptop computers
-  ** **d.  Cell phones

**Notes:**
Cell phones are not secure communication devices because their conversations can be eavesdropped. A land line should always be used when discussing sensitive information on the telephone. 

## Special security guidelines for alternative work arrangements such as telework include:
All telework, telecommuting, and flexiplace arrangements must be approved by your agency. 
You must be able to do your work in a secure environment, such as a home office or a Telework Center. 
If you are going to use a personally owned computer, you must gain approval from your agency, as special security and software licensing requirements must be met. 
For more information on Cyber Security Telecommuting requirements, see DM3525-003, "Telework and Remote Access Security." 

- Special security guidelines for alternative work arrangements such as telework include:
- All telework, telecommuting, and flexiplace arrangements must be approved by your agency.
- You must be able to do your work in a secure environment, such as a home office or a Telework Center.
- If you are going to use a personally owned computer, you must gain approval from your agency, as special security and software licensing requirements must be met.
- For more information on Cyber Security Telecommuting requirements, see DM3525-003, "Telework and Remote Access Security."

## When using wireless networks, be aware of these security concerns:

Most public wireless connections do not have built-in security, and the wireless information can be easily captured and read. 
If you plan to connect your government-owned computer to a wireless network, you must get approval from your agency and use encryption. Your government computer must be properly configured or “hardened” for use on a wireless network. 
If you need to view sensitive information, be careful in what you display on your screen, especially in public areas, such as Internet cafés and hotel lobbies. 
If you will be using your personally owned equipment on a wireless network for government work, you must gain approval from your agency for its use. 

- When using wireless networks, be aware of these security concerns:
- Most public wireless connections do not have built-in security, and the wireless information can be easily captured and read.
- If you plan to connect your government-owned computer to a wireless network, you must get approval from your agency and use encryption. Your government computer must be properly configured or “hardened” for use on a wireless network.
- If you need to view sensitive information, be careful in what you display on your screen, especially in public areas, such as Internet cafés and hotel lobbies.
- If you will be using your personally owned equipment on a wireless network for government work, you must gain approval from your agency for its use.

## You have completed the Security Literacy and Basics course. This course introduced you to the basic concepts for computer security awareness at the USDA. Please take the assessment (below) that contains 20 questions, consisting of the following types: (1) Multiple Choice; and (2) True or False

A minimum passing score of 70 percent will be required to receive credit for successful course completion. You will be able to retake the test as many times as necessary to pass.  Please send your assessment to your AgLearn Administrator to receive credit. Good luck! 

- You have completed the Security Literacy and Basics course. This course introduced you to the basic concepts for computer security awareness at the USDA. Please take the assessment (below) that contains 20 questions, consisting of the following types: (1) Multiple Choice; and (2) True or False
- A minimum passing score of 70 percent will be required to receive credit for successful course completion. You will be able to retake the test as many times as necessary to pass.  Please send your assessment to your AgLearn Administrator to receive credit. Good luck!

## 1.  When should you change your password? 
  Every day  
  On a regular basis  
  Every other day  
  Never  
2.  Physical security involves securing building areas and campuses in order to protect people, workspaces, dwellings, and resources. Measures include surveillance cameras and alarm systems. 
  False  
  True  
3.  The use of building and/or floor access cards helps maintain which of the following? 
  Physical security  
  Personnel security  
  Computer security  
  Data security 

- 1.  When should you change your password?
-   Every day
-   On a regular basis
-   Every other day
-   Never
- 2.  Physical security involves securing building areas and campuses in order to protect people, workspaces, dwellings, and resources. Measures include surveillance cameras and alarm systems.
-   False
-   True
- 3.  The use of building and/or floor access cards helps maintain which of the following?
-   Physical security
-   Personnel security
-   Computer security
-   Data security

## 4.  A natural or human threat is defined as a circumstance or an event with the potential to cause damage to your computer or any part of the I.T. system. 
  False  
  True  
5.  Most public wireless connections have built-in security, and the wireless information cannot be easily captured and read. 
  True  
  False 
6.  Which type of software is prohibited at USDA? 
  Word Processing software  
  Personal digital assistant software  
  Peer-to-Peer software  
  Anti-virus software 

- 4.  A natural or human threat is defined as a circumstance or an event with the potential to cause damage to your computer or any part of the I.T. system.
-   False
-   True
- 5.  Most public wireless connections have built-in security, and the wireless information cannot be easily captured and read.
-   True
-   False
- 6.  Which type of software is prohibited at USDA?
-   Word Processing software
-   Personal digital assistant software
-   Peer-to-Peer software
-   Anti-virus software

## 7.  You have been named to a committee to review information security policies at your agency. You decide to look at Department, not Federal, documents first. Which of the following documents is a USDA document? 
  DM 3500, USDA Cyber Security Manual  
  OMB Circular No. A-130  
  The Federal Information Security Management Act of 2002  
  The Privacy Act of 1974
8.  What is a control policy and activity applied to the information system that ensures that the system components are well defined and cannot be changed without proper authorization and justification? 
  Configuration management  
  Contingency planning  
  Certification and accreditation  
  Sensitive data detention

- 7.  You have been named to a committee to review information security policies at your agency. You decide to look at Department, not Federal, documents first. Which of the following documents is a USDA document?
-   DM 3500, USDA Cyber Security Manual
-   OMB Circular No. A-130
-   The Federal Information Security Management Act of 2002
-   The Privacy Act of 1974
- 8.  What is a control policy and activity applied to the information system that ensures that the system components are well defined and cannot be changed without proper authorization and justification?
-   Configuration management
-   Contingency planning
-   Certification and accreditation
-   Sensitive data detention

## 9.  If you suspect that you have malicious code on your computer, whether it be a virus, worm, Trojan horse, spyware, or anything else, you should do all of the following except: 
  Remain calm.  
  Email your supervisor.  
  Power off the computer and inform your supervisor if you get no response from the Help Desk.  
  Call the Help Desk.
10. Unauthorized disclosure of information would indicate a security breach for which of the following information objectives? 
  Integrity  
  Confidentiality  
  Sensitivity  
  Availability
11.  To help prevent intruder or social engineering attacks from succeeding, you should incorporate all but which one of the following tips? 
  Do not type anything into the computer unless you know the expected results.  
  Do not give out information about yourself or other employees.  
  Do not share your password with anyone other than your supervisor.  
  Do not participate in telephone surveys.

- 9.  If you suspect that you have malicious code on your computer, whether it be a virus, worm, Trojan horse, spyware, or anything else, you should do all of the following except:
-   Remain calm.
-   Email your supervisor.
-   Power off the computer and inform your supervisor if you get no response from the Help Desk.
-   Call the Help Desk.
- 10. Unauthorized disclosure of information would indicate a security breach for which of the following information objectives?
-   Integrity
-   Confidentiality
-   Sensitivity
-   Availability
- 11.  To help prevent intruder or social engineering attacks from succeeding, you should incorporate all but which one of the following tips?
-   Do not type anything into the computer unless you know the expected results.
-   Do not give out information about yourself or other employees.
-   Do not share your password with anyone other than your supervisor.
-   Do not participate in telephone surveys.

## 12.  If backup files are created only once a month, the restoration of lost or damaged files could be time-consuming if not impossible. This is an example of which type of vulnerability? 
  System  
  Natural  
  Human  
  Telecommunications  
13.  The majority of security breaches are caused by insiders—employees, contractors, and others who have legitimate access to the computer system. 
  False  
  True
14.  Without the knowledge of your system administrator or supervisor, you installed on your work computer a free software program that adds pictures to your outgoing email. Is this program an accepted practice? 
  Yes  
  No 

- 12.  If backup files are created only once a month, the restoration of lost or damaged files could be time-consuming if not impossible. This is an example of which type of vulnerability?
-   System
-   Natural
-   Human
-   Telecommunications
- 13.  The majority of security breaches are caused by insiders—employees, contractors, and others who have legitimate access to the computer system.
-   False
-   True
- 14.  Without the knowledge of your system administrator or supervisor, you installed on your work computer a free software program that adds pictures to your outgoing email. Is this program an accepted practice?
-   Yes
-   No

## 15.  You must gain approval from your agency in order to use your personally owned computer in a telework environment. 
  False  
  True
16.  At a minimum, USDA requires that each agency and staff office develop two contingency plans. Which of the following is a required contingency plan? 
  Certification Plan  
  Disaster Recovery Plan  
  Accreditation Plan  
  Configuration Management Plan  
17.  Which of the following items should NOT be used for sensitive information? 
  Office telephones  
  Cell phones  
  Fax machines  
  Laptop computers

- 15.  You must gain approval from your agency in order to use your personally owned computer in a telework environment.
-   False
-   True
- 16.  At a minimum, USDA requires that each agency and staff office develop two contingency plans. Which of the following is a required contingency plan?
-   Certification Plan
-   Disaster Recovery Plan
-   Accreditation Plan
-   Configuration Management Plan
- 17.  Which of the following items should NOT be used for sensitive information?
-   Office telephones
-   Cell phones
-   Fax machines
-   Laptop computers

## 18. Visiting pornography and gambling Web sites on the Internet is permitted on Government computers. 
  True  
  False
19.  Which of the following relies on weaknesses in human nature rather than software to trick people into revealing passwords, personal information, and other information? 
  Internet threats  
  Social engineering  
  Insider threats  
  The intruder
20.  What is a small piece of code that attaches itself to another program, does not run on its own, and executes when the host program is run? 
  Worm  
  Virus  
  Trojan horse  
  Spyware 

- 18. Visiting pornography and gambling Web sites on the Internet is permitted on Government computers.
-   True
-   False
- 19.  Which of the following relies on weaknesses in human nature rather than software to trick people into revealing passwords, personal information, and other information?
-   Internet threats
-   Social engineering
-   Insider threats
-   The intruder
- 20.  What is a small piece of code that attaches itself to another program, does not run on its own, and executes when the host program is run?
-   Worm
-   Virus
-   Trojan horse
-   Spyware

## You should now read and sign your security agreement.  Be sure to get your supervisor’s signature on it.  The original should be kept in a file by the supervisor.