Workplace Security Awareness - Instructor's Guide

Workplace Security Awareness

Instructor’s Guide

A Destination Management SeriesPalm Tran Training & Organizational Development Section

Introduction

Employees are often the target of intentional acts such as sabotage or violence. As an employee, you are an integral part of Palm Tran’s security solutions.

Course Goal

The goal of this course is to strengthen awareness of and reduce exposure to events involving workplace violence and increase your knowledge of specific things you can do to keep your organization safe.

Course Objectives

After successfully completing this course, participants will be able to do the following:

Be more aware of potential security threats Prevent workplace security related incidents React appropriately

Course Outline

The following topics will be covered in this course:

Indicators of Potential Workplace Violence Components of Risk Understanding Threats Protecting Workplace Information

The training session will conclude with a 10 item quiz. All participants will be issued a certificate of completion.

This course was adapted from the online course offered by the Federal Emergency Management Agency (FEMA). These materials are provided for informational purposes only and are solely intended for the use of the transit industry. Use of the materials in this program have been reviewed for compliance with local procedures and applicable State, Federal, and local laws and regulation, Palm Tran policies, practices, procedures and collective bargaining agreements.

Workplace Security AwarenessPalm Tran Training & Organizational Development | 2

Indicators of Potential Workplace Violence

Potentially violent employees typically do not just “snap” they tend to display behavioral signs over a long period of time. Some of the behaviors are:

Increased use of alcohol and/or illegal drugs

Unexplained absenteeism; vague physical complaints

Explosive outbursts of anger or rage without provocation

Increase in unsolicited comments about firearms, other dangerous weapons, and violent crimes


Key Points to Remember

Workplace Violence can often be managed and treated if recognized.If you notice indicators of behavior in a coworker that can become violent, report your observations to your immediate supervisor or security personnel immediately. Do not wait for something to happen before you react.

Components of RiskComponents of Risk Include:

Threats: may occur naturally or through human action, and involve the potential to harm life, information, operations, the environment and/or property

Vulnerability: physical features or operational attributes that render an entity open to exploitation or susceptible to a given hazard

Consequence (Impact): the effect of an event, incident, or occurrence and may involve public, health & safety, economic, psychological, and governance impacts


Key Points to RememberRisk is the potential for an unwanted outcome resulting from an incident, event, or occurrence.Vulnerability involves physical features or operational attributes that render an entity open to exploitation or subject to a given hazard.

Understanding ThreatsThe most common threat to the workplace is unauthorized access and security. Other threats and security issues include:

Suspicious package delivery

Loitering or unescorted visitors

Bomb threats

Unusual events or suspicious items including fumes, odors, liquids or disassembled electrical components such as wires

Unattended, abandoned or suspicious vehicles

Open access doors with easy entry

Allowing cars to “piggy-back” through access gates


Key Points to RememberAccess and security control threats can be prevented by controlling doors and other entrances.Employees should never approach a suspicious vehicle or question the driver of a vehicle on Palm Tran’s property. Employees should however, report the incident to their immediate supervisor or security personnel.Bomb Threat Checklists are extremely valuable and should be made available at all workstations.Use open-ended questions when addressing a suspected intruder.

Protecting Workplace InformationPalm Tran collects and stores information to serve our customers. Our customers trust that we will follow common privacy law principles which include:

Privacy Act of 1974

Freedom of Information Act (FOIA)

Health Insurance Portability & Accountability Act of 1996 (HIPPA)


Key Points to RememberWhen handling personally identifiable information (PII) apply the “need to know” principle prior to disclosing PII to other personnel.The use of “Social Engineering” involves tricking someone to provide personal information that can compromise a security system.Theft is the unlawful or unauthorized acquisition, by fraud or deceit.

Protecting Workplace Information (cont’d)Safeguard confidential information by:

Destroying sensitive information by the appropriate method i.e. shredder Never email sensitive information to unauthorized individuals Protecting passwords Avoid downloading information from unknown sources or internet sites, including

“pop-up” windows

Identity theft occurs when someone uses your personal identifying information via the use of Peer-to-Peer Software, which involves remote-control access, bypassing firewalls, or direct access to another computer, but does not include data storage.


Key Points to RememberInformation and Cyber Threats can be protected through the use of password procedures, information encryption software and firewalls.Malicious Code involves any software or program that comes in many forms and is designed to disrupt the normal operation of a computer by allowing an unauthorized process to occur or by granting unauthorized access.Confidentiality, availability, and integrity or data can be adversely impacted by malicious code.Peer-to-Peer Software includes remote-control access, bypassing firewalls, or direct access to another computer, but does not include data storage.

Comments, Question & Quiz Each Participant will complete a 15 question multiple choice quiz Upon obtaining a passing score (minimum of 11 questions correct),

certificate will be issued by the Organizational Development section Remember Safety Begins With You!


Workplace Security Awareness Quiz

Name____________________ Date____________ Division____________________

1. Indicators of potential workplace violence:o A. are completely individualized and therefore impossible to protect againsto B. Can only be recognized by trained mental health expertso C. Cannot usually be identified before an employee “snaps” and commits a violent acto D. Can often be managed and treated if recognized

2. Tricking someone to reveal personal information, passwords, and other information that can compromise a security system is known as:

o A. Telephone Solicitationo B. Hackingo C. Social Engineeringo D. Mass Marketing

3. Password procedures, information encryption software, and firewalls are examples of measures taken to address:

o A. Information and cyber threatso B. Workplace violence threatso C. Criminal and terrorist threatso D. Access and security control threats

4. When employees collect or handle personally identifiable information (PII), they should:

o A. Collect as much PII as they can at first contact with the individual to avoid having to get other data later

o B. Apply the “need to know” principle before disclosing PII to other personnelo C. share that information with other coworkers upon requesto D. Recognize that sharing PII is often permissible if done for what one believes is the

greater good of the community

5. TRUE or FALSE: Bomb threat checklists are extremely valuable and should be made available at all workstations

o A. Trueo B. False

6. Any software or program that comes in many forms and is designed to disrupt the normal operation of a computer by allowing an unauthorized process to occur or by granting unauthorized access is known as:

o A. Hackingo B. Peer-to-Peer Software


o C. Trojan Horseo D. Malicious Code

7. TRUE or FALSE: If you notice indicators of potentially violent behavior in a coworker, you must wait until you see something violent actually happen before reporting your suspicions to security personnel or human resources.

o A. Trueo B. False

8. Vulnerability can be defined as:o A. A natural or manmade occurrence, individual, entity, or action that has or indicates

the potential to harm life, information, operations, the environment, and/or property.o B. The impact or effect of an event, incident, or occurrenceo C. Physical features or operational attributes that render an entity open to exploitation

or susceptible to a given hazardo D. The potential for an unwanted outcome resulting from an incident, event, or

occurrence

9. When addressing a suspected intruder, it is best to:o A. Use open-ended questions when asking the person the purpose of his/her visito B. Maintain civility and trust your intuition about whether to let him or her passo C. Attempt to shake hands with the individual, to see if the handshake is reciprocatedo D. Leave it up to coworkers who know more people in the building to decide what to do

10. TRUE or FALSE: The security goals of confidentiality, availability, and integrity of data can be adversely impacted by malicious code.

o A. Trueo B. False

11. An unlawful or unauthorized acquisition, by fraud or deceit, is known as a:o A. Container Breacho B. Diversiono C. Thefto D. Consequence

12. TRUE or FALSE: When noticing a suspicious vehicle on the property, a responsible employee should approach the driver and ask if he/she needs assistance.

o A. Trueo B. False

13. The potential for an unwanted outcome resulting from an incident, event, or occurrence is:

o A. threat


o B. vulnerabilityo C. Consequenceo D. Risk

14. Which of the following statements is NOT true about peer-to-peer (P2P) software?

o A. P2P software provides direct access to another computer. Some examples include file sharing, Internet meeting, or chat messaging software.

o B. Peer-to-peer software can bypass firewall and antivirus systems by hiding activities of users, such as file transfers.

o C. Some P2P programs have remote-control capabilities, allowing users to take control of a computer from another computer somewhere else in the world.

o D. P2P software includes any data storage device that you can remove from a computer and take with you to a peer’s computer.

15. Controlling doors and other entrances is an example of a measure taken to address:

o A. Workplace violence threatso B. Access and security control threatso C. Criminal and terrorist threatso D. Information and cyber threats


Documents

Workplace Security Awareness - Instructor's Guide