Cyber Security in an Organization

Assignment Instructions
It was a hectic Monday morning at Berwicq. Jennifer Thompson (pictured), a marketing associate, was in a rush to finalize the quarterly report that was due in a few hours. Amid the chaos, she received an email that seemed to be from the IT department:
Subject: URGENT: Update Your Employee Account Now!
Dear Berwicq Team Member,
Due to a recent security breach, we are mandating all employees to immediately update their login credentials. Failure to comply within the next 24 hours will result in the suspension of your account.
Click here to update your information.
Best, Jamie Chen Senior Network Administrator, Berwicq
Under pressure and seeing the urgency in the email, Jennifer clicked the link without second thoughts. She was directed to a page that closely resembled Berwicq’s internal login portal. She entered her credentials, hit ‘Submit’, and went back to her report, thinking she’d averted a crisis.
Two hours later, the entire marketing team lost access to their shared drive where the quarterly report was saved. They also found strange emails sent from Jennifer’s account to external addresses, containing internal marketing strategies and upcoming product information. Simultaneously, the finance department reported unauthorized access attempts.
It didn’t take long for the IT department to trace the origin back to Jennifer’s compromised account. The so-called “urgent” email from IT was a phishing attempt, and Jennifer had fallen for it. Now, the quarterly report was at risk, confidential information was exposed, and the company faced another cybersecurity incident within weeks of a serious data breach.
Your Team’s Task
While Berwicq needs a comprehensive security awareness culture effort that goes beyond the mere checkbox compliance they have now, that is a complex process that other consultants have been tasked with. Your team has been entrusted with rolling out immediate engaging remedial materials aimed at educating Berwicq employees on best practices in physical security and cybersecurity. These materials will be delivered live to all Berwicq employees. All guidelines and practices should be backed by authoritative sources such as NIST.

1. Physical Security Training
   A. Topics to Cover
2. Identification and Badge System: Design a training module on the importance of badges, and how to properly use and store them.
3. Visitor Management: Create guidelines on how visitors should be checked in, escorted, and monitored.
4. Server Room Security: Outline best practices for entering and exiting server rooms. Discuss why propping doors open is a security risk.
5. Surveillance: Provide guidelines on the use and monitoring of security cameras.
6. Scenario-based Training: Develop a couple of scenarios where physical security could be compromised and ask employees to identify the lapses and suggest improvements.
   B. Deliverables
7. PowerPoint Presentation
8. Quizzes or Knowledge Checks (you can use 3rd party tools like Kahoot or Survey Monkey – you may use screen captures of 3rd party tool outputs)
9. Cybersecurity Training
   A. Topics to Cover
10. Password Policy: Explain strong password requirements, why sticky notes are a bad idea, and introduce the concept of a password manager.
11. Wi-Fi Security: Explain the risks associated with weak Wi-Fi passwords and public Wi-Fi. Discuss the importance of using secure connections like VPNs.
12. BYOD and MDM: Develop guidelines for using personal devices for work purposes and introduce the need for Mobile Device Management (MDM).
13. Social Engineering: Teach employees to recognize phishing emails and other forms of social engineering.
14. Scenario-based Training: Provide scenarios highlighting possible cybersecurity lapses, asking employees to identify risks and propose solutions.
    B. Deliverables
15. PowerPoint Presentation
16. Quizzes or Knowledge Checks (you can use 3rd party tools like Kahoot or Survey Monkey – you may use screen captures of 3rd party tool outputs)