Digital Security

What is the "Clean Desk Policy"?

A prescription that requires you to clean the desk.

A prescription that asks you to keep your desk tidy.

A prescription that requires you not to leave sensitive material unattended on your desk.

A series of good practices, how to lock up sensitive documents before leaving the office.

1/17

The management program has two-factor authentication. Do you know what it is?

It is an additional protection to the simple password, first enter the password and then a code generated by the token.

It is a system that only wastes time.

It is a system that authenticates twice on the management program, so if it is not used for some time, access lasts twice.

2/17

How to recognize a spear phishing email?

A spear phishing email is deceptive to recognize because it is created based on the interests or activities of the victim and seems to come from a regular interlocutor. They can usually contain: an attachment, which often includes malware; a link to download a malware or insert access credentials or credit cards, or the text invites you to make a money transfer.

A spear phishing email is always written in an ungrammatical and impersonal way.

A spear phishing email always comes from an unknown sender. They can usually contain: an attachment, which often includes malware; a link from which you download malware or insert login credentials or credit cards; or the text invites to make a money transfer.

An email of phishing phishing is an unwelcome advertising email.

3/17

What are the main differences between a phishing email and a spear phishing email?

Spear phishing is an advanced version of phishing, through a communication modeled on the recipient of the communication, created by malicious users who have collected specific information, for example through social engineering techniques, specific research on the individual or organization to hit.

Spear phishing unlike phishing is an unwanted email that contains advertising information received from a regular interlocutor.

A spear phishing email is a sporadic communication, while a phishing email is a pervasive and continuous communication.

There is no difference.

4/17

What is the risk resulting from an email spear phishing?

A spear phishing email aims to steal money through embezzlement or blackmail.

A spear phishing email aims to steal sensitive business data, damage reputation, espionage.

A spear phishing email through pervasive marketing campaigns induces the individual or company to invest in high-yield financial products.

A spear phishing email invites you to buy commercial products.

5/17

What is the best behavior to keep in case you have the reasonable suspicion of having opened a suspicious attachment or link?

Immediately notify your manager and IT representative of the email received and the suspicious action performed, then turn off the computer.

Never disclose sensitive information unless you are certain that the source is legitimate and have the title to receive such information.

Send the email to a colleague to verify that even by opening the attachment or the link on his computer there is an anomalous behavior.

Click on the link or open the attachment from your smartphone instead of from your computer.

6/17

You are in front of a screen asking you to enter a new password, which of these are secure?

qwerty1234

Password01

H3pk7 @ 1!

Giorgio11121985

7/17

The IT support installs the new version of the work management software. After doing its configurations it tells us our new password. To remember it quickly what do you do?

I open my password manager and save it in my passwords.

Phone the colleague and ask you to write it on the fly somewhere and then you will pass by to take it.

Mark it on a post-it and hide it under the keyboard, it's the best way to remember it.

Ask the support to leave the access without a password, so you can choose it later.

8/17

What must a password have to be effective?

It must be easy to remember.

It must contain at least 8 numbers.

It must be at least 8 characters long, contain upper and lower case letters and special characters.

It must be easy to recover.

9/17

You made a backup of confidential documents on a USB stick:

Always carry it with you for greater security.

You always leave it in the office.

You should not create unauthorized backups.

Leave it on your desk so you always have it available.

10/17

Select one or more places in the office where an attacker could access confidential data:

Waste bin.

Notebook notes.

Printer.

USB flash drives.

11/17

Why is it important to adopt and follow the "Clean Desk Policy"?

12/17

Do you know which legal text currently regulates and protects individuals with regard to the processing of personal data and the free circulation of such data?

Yes it is the EU regulation 2016/679 also known as GDPR (General Data Protection Regulation).

Yes it is the EU regulation 2016/679 also known as GDPR (General Data Protection Regulation), but it does not apply to Public Administrations.

Yes it is the Legislative Decree 196/2003 also known as the Privacy Code.

Yes it is Legislative Decree 196/2003 also known as the Privacy Code, but it does not apply to Public Administrations.

13/17

The new management software is installed in the office, it allows access to more structured information, without having to go around to the right and left to verify the data of a practice, it is a nice step forward! Too bad it was developed out of the company network and that needs credentials different from those of the PC to use it ... You have to set the new password to use it, how do you proceed?

When the new software asks you to create the password for your user, put the usual password you use for the PC, for gmail and for other services you use often, at least you are sure not to forget it!

When creating the new password, open your complex password management software, create a new one, and insert it, making sure it matches the one provided by the software... you won't remember it by heart, but it will be there when you need it!

Another password? uhm... you will use your secret technique that allows you to create long, complicated passwords, but only you can understand / remember. Your encoding is infallible, until now.

The password "unitedgo" will be fine, and since it's the fourth time you change it, add a nice 4!

Check if your IT support manager has any recommendations on how to proceed, waiting for the application to be integrated with your local PC user, eliminating the need for another password!

14/17

You often use a specially modified password to always remember how to log in and not having to write your credentials around. Most of the password is the same, between the various sites, but some letters change to differentiate it according to the site. In the office you have to modify your credentials and this time it seems that the email is rather threatening, they recommend not using passwords that you already use, how do you behave?

You decide that you will build a new, different password, which you will remember well, but which has nothing to do with the one you use for yourself.

Use the password you remember, at least the base, and add the right sequence to remind you that this is the working one.

You decide that the time has come to move to a more structured system and look for a tool for preserving digital credentials (password manager), to which you can entrust with a single password, all the others, making them more complex.

Create credentials that do not use any of the previous passwords and since the e-mail is so threatening, lengthen the password by turning it into a pass phrase!

15/17

You are comfortably at your PC, check your corporate mail, at a certain point the following e-mail appears "Subject: confirmation of user password change management software you use every day". There is a button to proceed... what do you do?

Follow the instructions and click, you will be presented with a form to enter the current password, and put it new. Remember that you have to change it for a while, then provide...

Open the email, in fact it seems to remind you that you have to change the password and some time has passed since you last remembered, open the email, click and change the password.

Follow the link, change the password by adding the month and year number to the end of the one you remember well.

Open the email in full screen, you never know, and read well if the email is sent from within the company or from outside and check the sender by reading the email address, then only if it comes back , click and see where the page sends you, checking also the web address that opens... in case of further suspicions call IT support...

16/17

A colleague calls you and tells you that he has lost his credentials to access the management program. What do you do to help him?

You give him your credentials, so you solve the problem quickly and he can work safely.

Recommend him to call IT support to reset his accesses.

If the "recover password" button is available, I advise you to use it, the email will arrive where you can change it. In that case you suggest him to enter a simple password such as the daughter's name and date of birth.

If the "recover button" is available, use it and to change the password using a password generated with its password manager software.

17/17

Digital Security

for the Public Administration

Self-assessment quiz

Follow us on