This post was originally published in French only. We translated it in 2026 so the archive reads the same in both languages. Read the original →

Dominic had convinced us to produce a first security awareness video. The original video was reworked and reformatted so it could be presented as a series of short awareness clips.

Setting the scene


[youtube=http://youtu.be/KlRuEi2ar6M">http://youtu.be/KlRuEi2ar6M]

The information held by organizations is very valuable to external third parties. The premise of the video casts organized crime as the external agent, but anyone or any organization can play that external agent, and their designs can vary just as much, ranging from simple information theft to industrial espionage.

Impersonation over the phone


[youtube=http://youtu.be/V0sAHT0oq1Q">http://youtu.be/V0sAHT0oq1Q]

The information that can be gleaned from the Internet and social networks lets attackers build credible social engineering scenarios. It is therefore important to limit the information published on the Internet to what is actually useful for conducting business. Likewise, it is important to make users aware that they should limit the information they share on the Internet and social networks. It is also important to teach users not to disclose sensitive information, such as their password, PIN or credit card number, to someone who calls them. They should properly identify the person on the other end of the line, either by asking questions that identify them beyond a reasonable doubt, or by calling them back at a known public number.

Remote takeover of a workstation


[youtube=http://youtu.be/I8qqwfbcI3s">http://youtu.be/I8qqwfbcI3s]

Make sure employees know to quickly report unusual activity they notice on their workstation, such as the CD drive opening by itself, windows popping up unexpectedly, the mouse pointer moving on its own, or the workstation being unusually slow. It's a sign that malicious code (Netbus or BO2k if we go back to the original context of the video, or the Flame worm if we look at what's in the news) is present on the workstation and giving access to an unauthorized third party. In addition, first-line IT support staff need to be trained to spot this type of problem and route it to the people responsible for security.

Piggybacking into a building


[youtube=http://youtu.be/EKyOt1T_8Yc">http://youtu.be/EKyOt1T_8Yc]

Make employees aware that they should not let in anyone who doesn't have company identification, and give them questions to ask to challenge someone who doesn't seem to be authorized on the premises. When a visitor names the person they want to meet, escort them to that person.

Impersonating a technician at ACME company


[youtube=http://youtu.be/STy76Z-6aBs">http://youtu.be/STy76Z-6aBs]

Make employees aware that they should not give out sensitive information, such as passwords and SIN, to a stranger who shows up at their desk. Likewise, they should not let anyone work on their workstation unless there has been a request for service or an official communication detailing the nature of the intervention.

Searching for confidential documents on desks, in the trash and on printers


[youtube=http://youtu.be/vABiz8GhvXM">http://youtu.be/vABiz8GhvXM]

Make employees who handle sensitive documents aware that they should always lock them up when away for an extended period, shred them when the document reaches end of life, and pick them up promptly from the printer.

Installing a physical keylogger on an ACME employee's workstation


[youtube=http://youtu.be/b9aiLj4XVcY">http://youtu.be/b9aiLj4XVcY]

A keylogger captures everything typed on the keyboard, such as passwords or other sensitive information. Installing a physical keylogger can leave traces the user can notice. Likewise, software keyloggers, which come with many of the malicious programs currently in circulation, can be detected by the user when they notice anomalies on their workstation. When the user has a reasonable suspicion that there is a keylogger, they should contact the company's security team so that it can be checked.

Connecting to ACME's network and information assets through a wireless access point


[youtube=http://youtu.be/t7vEpc6HLoY">http://youtu.be/t7vEpc6HLoY]

An unauthorized device can give full access to the company network from outside its physical perimeter. The clip shows the use of a wireless access point that can be bought cheaply at most big-box electronics stores. It is also possible to use devices that use cellular frequencies or that open a reverse shell. To guard against this type of threat, the company must put in place means to detect and limit unauthorized devices, in order to limit potential information leakage.

Exploiting an ACME employee's poor computer usage habits


[youtube=http://youtu.be/-YVHCquaL50">http://youtu.be/-YVHCquaL50]

Once a user is properly authenticated on their workstation, it carries that person's digital identity. When it is left unattended, someone with bad intentions can use that person's identity to carry out actions. As a result, the user will be held responsible for those actions. It is important to make users aware of the value of their digital identity and inform them of the measures available to protect it, such as locking their workstation. It is also recommended to put technical measures in place to help users protect their digital identity, by automatically locking or expiring their session after a set delay.

Physical theft of a laptop from ACME's offices


[youtube=http://youtu.be/swXV6W9_BDM">http://youtu.be/swXV6W9_BDM]

To deter a thief, add identification markings to the computer and lock it to a fixed object. When away for an extended period, take the laptop with you or store it in a locked cabinet. To protect the information on the disk, it is recommended to encrypt it so that it is useless to a third party.

Theft of ACME's president's laptop from his car


[youtube=http://youtu.be/FnwN-5wy1RU">http://youtu.be/FnwN-5wy1RU]

When a laptop has to be carried in a car, it is recommended not to leave it unattended. Ideally, always keep it with you. If that's not possible, put it in the trunk so it is out of sight of anyone who might be tempted to steal it. Even so, leaving it in an unattended vehicle carries a risk of theft.

Conclusion

These clips show only a tiny part of the threats organizations face. For organizations to be in a good position to fight these threats, they should use reference frameworks such as the ISO 27000 family or Cobit 5. Professional associations such as ISACA and events such as Hackfest are useful sources of information to prepare the organization for threats.

Here are a few activities that can help your organization:

  • Put a security policy in place
  • Put a security management framework in place within the organization
  • Classify information assets
  • Plan the human organization of security
  • Ensure physical security
  • Define responsibilities and procedures for security management
  • Plan access controls
  • Ensure systems development and maintenance
  • Establish business continuity management
  • Ensure compliance with applicable standards and laws