Security Awareness, Training, and Education

1. Security Awareness, Training, and Education JSAC April 2013 Jim Bass JSAC

2. “A Security Awareness Program Sets the Stage for Training by Changing Organizational Attitudes to Realize the Importance of Security and Adverse Consequences of Failure.” National Institute of Standards and Technology

3. …..Say That Again……..? • Awareness • The Threat Is Real • Dire Consequences May Ensue • Training • Compliance with NISPOM, Program Regulations, ITAR, etc. • Gaining Skills • Education • Ongoing process of enhancing knowledge, remembering facts and understanding concepts

4. NISPOM 3-100 “Contractors shall provide all cleared employees with security training and briefings commensurate with their involvement with classified information.”

5. Initial Briefing – Keep It Simple Threat Awareness Overview of the Classification System Reporting Requirements Procedures and Duties Associated with the Job Who to Call!!!!!!!!

6. Threat Awareness What is the Threat International, Domestic, Industrial Espionage, Foreign Intelligence, What Methods are Employed to Collect Elicitation, PHISHING, Foreign Contacts, Social Media, IT Intrusions Recent Cases Just GOOGLE “Recent Espionage Cases” DSS, FBI, NCIS, AFOSI, 902nd MI Group Current Collection Trends

7. Overview of the Classification System No Need to Drill Too Deep Three Levels of Classification and What They Mean Safeguarding AIS CAVEATS NATO, CNWDI, RD, etc. Marking Requirements Documents, Media, Hardware, etc.

8. Reporting Requirements Very Important !!! Suspicious Contacts Security Violations Adverse Information Foreign Travel (if required) Foreign Contact Attendance at Trade Shows or Other Events with Significant Foreign Presence

9. Security Procedures and Duties Applicable to the Job Lots of Foreign Travel or Contact? Working in a Closed Area? AIS ? Marketing or Business Development? Special Briefings Required ? R&D ? Manufacturing ?

10. Know Your Audienceor Training the Reluctant Marketeer Executive Level Briefings….short and to the point. Tell them What they NEED to Know. International Marketing and Business Development. Awareness and Reporting Requirements Dangers of Complacency ITAR and EAR - Especially in Light of Export Reform CI Subject Matter Expert Briefings and Debriefings Collect Business Cards

11. Subject Matter Experts Can Enhance and Lend Extra Credibility DSS OSI NCIS 902nd MI Group Legal Department Export Compliance/Empowered Officials

12. Awareness, Education, and Training as a Product Changing Organizational Attitudes

13. Resources and Methods Company Newsletters Great for Special Events or Current Topics “Security Slot” Desktop Publishing Website Space on the Company Website or Build a Security Website Security Bulletins Videos Expensive to Produce Commercially Available Computer Based Products

14. Other Stuff…….. Posters Some Commercially Available Best if Geared to Your Company Desktop Reminders Great for End of Day Checks Giveaways Pens, Rulers, Lanyards, etc. Pamphlets

17. Desk Guides and Handbooks

18. Visual Advertising Readable A Quick, Easily Understood Message Legible “Don’t Make Me Work” Well Organized Not Busy, Not Cluttered Succinct

19. What’s Wrong With This Poster???

21. ¡Los campesinos no esasí... la tierraesmía. Ahorabaje! General Francisco Franco.

23. Don’t Neglect Your Own Training • NCMS • JSAC • ASIS • National Security Institute – IMPACT • DSS • Network, Network, Network Some More

24. “It can’t happen here!”

26. “The single greatest obstacle to espionage is education.” StanislavLevchenko, former KGB officer.

27. Key to Effectivity Reinforce Reinforce Reinforce

28. Jim Bass james.a.bass@lmco.com 972-603-2250 682-554-6657