Social Engineering Awareness Policy

The Social Engineering Awareness Policy bundle is a collection of policies and guidelines for employees of CodeBee. In order to protect CodeBee's assets, all employees need to defend the integrity and confidentiality of CodeBee's resources.

Purpose

This policy has the following purposes:

• To make employees aware that:
  • fraudulent social engineering attacks occur.
  • there are procedures that employees can use to detect attacks.
• Employees are made aware of techniques used for such attacks.
• Employees recognize they are an important part of CodeBee’s security. The integrity of an employee is the best line of defense for protecting sensitive information regarding CodeBee’s resources.
• To create specific procedures for employees to follow to help them make the best choice when:
  • Someone is contacting the employee - via phone, in person, email, fax or online - and elusively trying to collect CodeBee’s sensitive information.
  • The employee is being “socially pressured” or “socially encouraged or tricked” into sharing sensitive data.

Scope

Includes all employees of CodeBee, including temporary contractors or part-time employees participating with help desk customer service.

Policy

Sensitive information of CodeBee. will not be shared with an unauthorized individual if he/she uses words and/ or techniques such as the following:

• An “urgent matter”
• A “forgotten password”
• A “computer virus emergency”
• Any form of intimidation from “higher level management”
• Any “name dropping” by the individual which gives the appearance that it is coming from legitimate and authorized personnel.
• The requester requires release of information that will reveal passwords, model, serial number, or brand or quantity of CodeBee. resources.
• The techniques are used by an unknown (not promptly verifiable) individual via phone, email, online, fax, or in person.
• The techniques are used by a person that declares to be "affiliated" with CodeBee. such as a sub-contractor.
• The techniques are used by an individual that says he/she is a reporter for a well-known press editor or TV or radio company.
• The requester is using ego and vanity seducing methods, for example, rewarding the front desk employee with compliments about his/her intelligence, capabilities, or making inappropriate greetings (coming from a stranger).