Text · page 4 of 16
Information Technology Why Should District Officials Provide IT Security Awareness Training? To minimize the risk of unauthorized access and misuse or loss of data and PPSI,1 District officials should provide periodic cybersecurity awareness training. This training should explain the proper rules of behavior for using the Internet, IT systems, data and PPSI and communicate related policies and procedures to all individuals using them. The training should center on emerging trends such as information theft, social engineering attacks2 and computer viruses and other types of malicious software, all of which may result in PPSI compromise. Training programs should be directed at the specific audience (e.g., system users or administrators) and include everything that attendees need to perform their jobs. The training should also cover key security concepts such as the dangers of downloading files and programs from the Internet or portable devices such as thumb drives; the importance of selecting strong passwords; any requirements related to protecting PPSI; the risks involved with using unsecured Wi-Fi connections; or how to respond if a virus or an information security breach is detected. The District’s acceptable use policy (AUP) and corresponding regulations for employees and students indicates that IT users must receive training on the proper use of its IT environment. IT Users Are Not Provided With Cybersecurity Training During our audit period, the District did not provide any cybersecurity awareness training to employees or students. Officials told us that students learned about cybersecurity through various classes, such as health and career classes, and employees were given updates and cybersecurity information through District emails. However, organized cybersecurity awareness training was not provided. The IT cybersecurity community identifies people as the weakest link in the chain to secure data and IT systems. District officials cannot protect the confidentiality, integrity and availability of data and computer systems without ensuring that users, or those who manage IT, understand the IT security policies and procedures and their roles and responsibilities related to IT and data security. Without cybersecurity awareness training, users may not understand their responsibilities and are more likely to be unaware of a situation that could compromise IT assets. As a result, data and PPSI could be at a greater risk for unauthorized access, misuse or loss. 1 Personal, private and sensitive information (PPSI) is any information to which unauthorized access, disclosure, modification, destruction or use – or disruption of access or use – could have or cause a severe impact on critical functions, employees, customers, third parties or other individuals or entities. 2 Social engineering attacks are methods used to deceive IT users into revealing confidential or sensitive information. 2 Of f ic e of t he New York State Comptroller