Social Engineering Awareness Policy
The Social Engineering Awareness Policy bundle is a collection of policies and guidelines for employees of Tuxis In order to protect Tuxis's assets, all employees need to defend the integrity and confidentiality of Tuxis's resources.
This policy has the following purposes:
- To make employees aware that:
- fraudulent social engineering attacks occur.
- there are procedures that employees can use to detect attacks.
- Employees are made aware of techniques used for such attacks.
- Employees recognize they are an important part of Tuxis’s security. The integrity of an employee is the best line of defense for protecting sensitive information regarding Tuxis’s resources.
- To create specific procedures for employees to follow to help them make the best choice when:
- Someone is contacting the employee - via phone, in person, email, fax or online - and elusively trying to collect Tuxis’s sensitive information.
- The employee is being “socially pressured” or “socially encouraged or tricked” into sharing sensitive data.
Includes all employees of Tuxis, including temporary contractors or part-time employees participating with help desk customer service.
Sensitive information of Tuxis will not be shared with an unauthorized individual if he/she uses words and/ or techniques such as the following:
- An “urgent matter”
- A “forgotten password”
- A “computer virus emergency”
- Any form of intimidation from “higher level management”
- Any “name dropping” by the individual which gives the appearance that it is coming from legitimate and authorized personnel.
- The requester requires release of information that will reveal passwords, model, serial number, or brand or quantity of Tuxis resources.
- The techniques are used by an unknown (not promptly verifiable) individual via phone, email, online, fax, or in person.
- The techniques are used by a person that declares to be "affiliated" with Tuxis such as a sub-contractor.
- The techniques are used by an individual that says he/she is a reporter for a well-known press editor or TV or radio company.
- The requester is using ego and vanity seducing methods, for example, rewarding the front desk employee with compliments about his/her intelligence, capabilities, or making inappropriate greetings (coming from a stranger).