Discover the information daily activities yield.

Meet with adversaries.

Perform business impact analysis surveys.

Scrutinize their organizations' daily activities.

Analyze indicators, to determine the information an adversary can glean ?both from routine and nonroutine activities.

Espionage

Transposition cipher

Key exchange

Arithmancy

Steganography

Accidental or intentional data deletion

Severe weather disasters

Employee terminations

Employee administrative leave

Minor power outages

Managed Security Gateway

Access control lists on a router

Personal firewall

Network intrusion-detection system

Anti-virus software

uses smart cards, hardware tokens, and biometrics to authenticate users; also known as three-factor authentication

requires the use of one-time passwords, so users authenticate only once, with a given set of credentials

requires users to re-authenticate at each server and access control

stores user credentials locally, so that users need only authenticate the first time a local machine is used

allows users to authenticate once, and then uses tokens or other credentials to manage subsequent authentication attempts

Internal users try to gain unauthorized access to information assets outside the organizational perimeter.

External-intrusion attempts from sources outside the LAN are not granted permissions or rights to an organization's information assets.

External users attempt to access public resources.

External intruders attempt exploitation of vulnerabilities, to remove their own access.

Internal users perform inappropriate acts on assets to which they have been given rights or permissions.

Lock

Access control list

Background check

Token

Firewall

Single sign-on

Decentralized access control

Hybrid access control

Layered access control

Mandatory access control

Distributed denial-of-service

Teardrop

Birthday

FTP Bounce

Salami

Training material should be accessible and attractive.

Delivery mechanisms should allow easy development of additional materials, to complement core material.

Security-awareness training materials should never contradict an organizational security policy.

Appropriate language should be used to facilitate localization, should training materials require translation.

Written documentation should be archived, in case of disaster.