Integrated Source Management Portfolio (I

Security Awareness Training
ISMP Security Awareness Tra

Introduction

Welcome to security awareness training for the Integrated Source ManaPortfolio (ISMP). The information contained in this course is provided to Users of their responsibilities with regard to computer security while usinThis training is required by the Office of Management and Budget (OMB

Circular A-130 and the Nuclear Regulatory Commission (NRC) Office of Material Safety and Safeguards (NMSS). The course covers NRC policy on the authorized use of ISMP. The prac

in this course are designed to protect ISMP and ISMP information from disclosure, alteration, or destruction.You will be required to provide a digital acknowledgement of your unders

ISMP Rules of Behavior.If you have any questions, please contact the ISMP Helpdesk at 1-877-
ISMP Security Awareness Tra

Contents

Attitudes & FallaciesIT Security ThreatsIT Security MeasuresInformation SecuritySystem Use MessageRules of BehaviorBest Practices
ISMP Security Awareness Tra

Attitudes & Fallacies

Common Attitudes and Fallacies:

The security or system staff take care of Nobody WANTS my authenticators (e.g., digital certificate, hard token).It is MY machine.Security is NOT my priority.

Attention: Security is everyone’s respon
Two categories of IT security threats that ISMP should be aware of are:

Illegal System AccessViruses and Malicious Software 

Unauthorized users access the system by:

Using an authorized user’s login credentialsHacking into the system

Authorized users may also try to exceed their alevel of access and hack into other’s resources

ISMP Security Awareness Tra

IT Security Threats
ISMP Security Awareness Tra

IT Security Threats (cont.)

What is a computer virus?

A virus is a program that copies itself to other programA virus is just one type of malicious software.

Other Types of Malicious Software

Trojan – Disguised as a legitimate program, Trojans cback doors to a system.Time Bomb – Code on a computer that triggers some event at a particular time.Logic Bomb – Triggered by a particular event and behvirus. 
ISMP Security Awareness Tra

ISMP Users must be aware of the following IT security measures thimplemented to protect ISMP from IT Security Threats:

Strong authenticationCryptographyISMP User Responsibilities and Rules of Behavior

Types of Authenticators

Digital Certificate: the digital equivalent of an ID card. Also called a identity certificate, and public key certificate.Hard Token: a hardware security device that is used to authenticate smart card).One Time Password (OTP): a hardware security device providing VaProtection used to authenticate a user (e.g., a security token). Personal Identification Number (PIN): a number used to confirm a ususing a hard token.Password: a string of characters that is entered into a computer systto a resource.

IT Security Measures
ISMP Security Awareness Tra

Strong AuthenticationAccess to ISMP requires strong authentication using:

NRC ICAM-issued digital certificates stored on NRC ICAM-issued hais identity, Credential and Access Management)Digital certificates and hard tokens are PIN-protected.One Time Password (OTP) and PIN.

CryptographyKey Terms:

Encryption is the process of encoding messages or information in su

authorized parties can read it.

Federal Information Processing Standard Publication 140-2 (FIPS 14government computer security standard used to accredit cryptographAn encrypted connection is established between the ISMP User and 

ISMP data while it is transmitted over the internet.

FIPS 140-2 compliant cryptography must be used. Additional details 

the Rules of Behavior.

IT Security Measures (cont.)
ISMP Security Awareness Tra

ISMP User Responsibilities and Rules of Beh

To ensure the secure access and use of the sUsers are responsible for implementing securmeasures on their computer and local environThe ISMP Rules of Behavior define these mearesponsibilities.

IT Security Measures (cont.)
ISMP Security Awareness Tra

ISMP information is categorized as Sensitive UNon-Safeguards Information (SUNSI).SUNSI must not be viewed or accessed inadvwillfully by a person who is not authorized acc

Information Security
ISMP Security Awareness Tra

The ISMP System Use Notification Message is dthe user prior to each login attempt.The message informs the user that by using the he/she agrees to the following:

Consent to monitoring.No privacy expectations.Penalties for unauthorized access or misuse oand system data.

System Use Notification Messag
ISMP Security Awareness Tra

The ISMP Rules of Behavior establish a set of rules that dresident application user responsibilities and expected behregard to information and system usage.The ISMP Rules of Behavior cover the following:

ApplicabilityConsequence for NoncomplianceGeneral ProtectionsNRC Identity, Credential, and Access Management (ICAAuthenticatorsUser Desktops and Laptops

Rules of Behavior
ISMP Security Awareness Tra

AuthenticatorsWhen selecting a PIN, users should avoid using the following:

Your name, nickname, or initialsYour user identification code or name (user ID)Special datesYour spouse or child’s nameYour telephone number, employee number, or social security Anything that can be easily associated with youConsecutive or repeated numbers or letters (ABCDE, CCCCC88888)Dictionary words

Us3$tr0ngP@&SwOrd$!

Best Practices
ISMP Security Awareness Tra

Authenticators (cont.)

Sharing authenticators is prohibited.Never disclose or write down PINs.Remember to:

Protect yourself from misuse or abuse, protect your authenticators.Report compromised authenticator incidents.

Others

Cut and paste internet addresses from email messages into browserclicking links provided in the message.Do not download attachments, files, or programs from unknown sourNever supply personal information to unknown addresses.Do not download shareware, freeware, or other programs.Contact the ISMP Helpdesk for suspected virus or malicious code inc

Best Practices
ISMP Security Awareness Tra

CONGRATULATIONS 

This completes ISMP Security Awareness T