I've worked for several different companies of which some had outsourced their IT-department. This means that the people at the company mostly use technology, but have no deeper understand of it, especially when it comes to security.
Therefore I was toying with the idea to offer 1 or 2 small workshops / trainings, so they can get at least an idea of WHY computer security is important and WHAT exactly is important. I would like to do this because I think, human knowledge should be shared, no matter the recipient and both sides might learn. My colleagues might understand security better and I might understand their point of view better.
So I sat down and tried to come up with a list of necessary and useful topics, keeping the target audience in mind.
Am I missing topics, should there be other topics? What is necessary to learn, when you deal with computer security?
- Why computer security? (Costs, Ransomware stopping a complete company, ...)
- Passwords (What is a good password, how to store, never use same PW on different accounts, ...)
- Lock the screen when leaving the workplace (Because...? Did not find good examples of what could happen, also is this a high priority?)
- Should I show a hacking example to visualize what it is? For example older phones / tablets are crackable pretty fast with open source software.
- Social Engineering (2 colleagues got a call and became victims to the CLSID-Scam, door gliding, USB sticks in the parking lot, ...)
- Internetsecurity (NoScript, deactivate Flash / JS, what's phishing, ...)
- Email encryption
- Protective measures (keep OS updated, use antivirus-software, dont use the admin-account as a default, ...)
I dont know which topics should be mandatory and in which order. The training might take 1 or even 2 hours. I would also create some cheat-sheets, so they can take away some written information, further reading etc.