Webinar Series

Shopping Safely Online and the Work of Cybersecurity Awareness and Behavior Change

December 18, 2019
NICE Cybersecurity Workforce Framework

Resource Center

Introducing a new website!

...to help provide information and resources on 

consulting and implementing a national-focused 

resource that categorizes and describes 

cybersecurity work.

nist.gov/nice/framework
Review and Updates to the 

NICE Cybersecurity Workforce Framework

We’re seeking input on updates to the 

NICE Cybersecurity Workforce Framework

Improvements to the NICE Framework

Awareness, Applications, and Uses of the NICE 

Framework

nist.gov/nice/framework

The public is invited to provide 

input by January 13, 2020.
Timeline for Review and Updates to NICE Framework

Engagement with Key 

Stakeholders

Pre-November 2019

Announcement of 

Request for Comments 

November 2019

Webinar to Describe 

Process and Request 

for Comments 

December 2019

Request for Comments 

Deadline

January 2020

Adjudicate Comments 

Received

January-February 2020

Consultative Process

March-May 2020

First Draft of Changes 

for Comments

June 2020

Final Draft of Changes

November 2020

Updates to Tasks, Knowledge, Skills, and Abilities , November 2019-2021
Shopping Safely OnlineHuman Security Career

https://sans.org/security-awareness
6

Your Speaker – Lance Spitzner

• Director, SANS Security Awareness

• Twenty years security professional

• Prior life as a tank officer
7

Agenda

• Securely Shopping

• Human Security as a Career
The Problem
9

Tis The Season

• Bad guys know this is the time of year people go 

online to find the perfect deal

• Bad guys setup dodgy websites or accounts that 

take your money and

• Steal / resell your credit card and information

• Never ship your item or ship counterfeit or stolen 

items

9
10

What NOT to Do
11
12
1313
www.christianlouboutin-shoe.com

14
15
16

Dodgy Contact

16
17

Dodgy Payment

17
18

What To Do?

• Be sure you are purchasing items from a website 

you trust. Safest is to use sites you or your family / 

friends have used in the past and know are good

• Buying something online from a site you never 

heard of to save $5 bucks is quickest path to pain
19

What to Look For

• Verify website has legitimate mailing address, 

email and phone number. Call number to confirm.

• Be very suspicious if website appears to be exact 

replica of well-known sites you have used before

• Grammar or spelling mistakes in site

• Check site’s name in Google for feedback

21
22

Third Party Sellers

• Some trusted websites have multiple third-party 

sellers (Amazon)

• Check each seller’s reputation, read comments

• Be wary of new sellers or extremely cheap

• What is the return policy?

22
23

Credit Card / Bank Accounts

• Use credit cards, not debit cards or wire transfer

• Review your credit card statements and have 

automated alerts for purchases

• Consider gift cards or PayPal as you do not give 

your credit card number

• Detected credit card fraud? Call your bank right 

away!
Q & A 

24
Career in Human 

Security
26

Security Awareness & Culture

• There is an entirely new field dedicated to the 

human side of cybersecurity.

• Role is to secure the Human Operating System

• Audience is entire workforce

• Focus on changing behaviors / culture, not skills.
2002 2004 2006 2008 2010 2012

Security Controls

Trustworthy Computing

Software Restriction Policies

Automatic Updating

Microsoft Secure Development Lifecycle

Firewall Enabled by Default

Baseline Security Analyzer

Data Execution Protection (DEP)

Malicious Software Removal Tool

Windows Defender

ASDL

User Account Control

Bitlocker

Windows Service Hardening

Mandatory Integrity Control

AppLocker

Encrypted File System

Microsoft Security Essentials

EMET

2014

HumanOS

WindowsOS

2016

Credential Guard

Biometrics

2018

Edge Browser

2020

Windows Sandbox

27
28

Laptop Human

Resources

Technology versus Human Investment

28
29

Time Spent on Awareness
30

Typical Background
31

Security Awareness Titles
32

Security Awareness Manager

• Strong soft skills (marketing, communications)

• Works with and engages people

• Focus is on behavior / culture change

• Field of organizational change

34
35

Career Path

sans.org/ssa-careerdev

35
36

Monthly OUCH Security Newsletter

sans.org/ouch
Q & A 

37
Thank You for Joining Us!

nist.gov/nice/webinars

38

Upcoming Webinar: “Learning Cybersecurity Principles for the Practice 

of Information Security”

When: Wednesday, January 29, 2020 at 2:00pm EST

Register: https://nistnice.adobeconnect.com/webinarjan2020/event/registration.html