https://wiki.officience.com/api.php?action=feedcontributions&feedformat=atom&user=DucOfficience - User contributions [en]2026-08-01T03:01:39ZUser contributionsMediaWiki 1.43.1https://wiki.officience.com/index.php?title=Security&diff=988Security2019-07-24T18:43:23Z<p>Duc: /* See also */</p>
<hr />
<div>[[File:Edmund Hillary & Tenzing Norgay 1933.png]]<br />
<br />
<br />
== Who is responsible for computer security? ==<br />
'''Every member of Officience is responsible.'''<br />
<br />
* Offies are expected to act responsibly and ethically when accessing Officience’s electronic data and technology resources.<br />
* The security of a system is only as good as its weakest link. If even one person does not pay attention to security, the security of the whole system is compromised. Read example on [[Thalès Security]]. <br />
<br />
Good Security Standards follow the "90/10" Rule :<br />
<br />
* 10% of security safeguards are technical.<br />
* 90% of security safeguards rely on the computer user (YOU) to adhere to good computing practices.<br />
<br />
== Security Topics ==<br />
=== Best security practices for Offies===<br />
* Data protection - classification level of information<br />
* Working Area<br />
* Desktop/Laptop Security<br />
* Laptop security while on traveling or remote work<br />
* Mobile device security<br />
* Password usage<br />
* Internet Usage<br />
* Email usage<br />
* Data Backup & storage<br />
* Use of Encryption<br />
* Media Destruction<br />
<br />
=== Protection from viruses, trojan horses, malicious codes ===<br />
* Potential threats<br />
* Malicious software<br />
* Signs of malware & example<br />
* How to protect against malware<br />
* Instant Messaging<br />
* P2P file sharing<br />
* Identity theft<br />
* Social engineering<br />
* Email phishing<br />
* Avoid being a victim<br />
* Reporting security breaches<br />
<br />
== Data protection : Classification level of information==<br />
<br />
== NDA (Non-disclosure agreement)==<br />
See [[Non-Disclosure Agreement]]<br />
<br />
== Protecting data at work ==<br />
'''The best way to secure your system is to use a managed workstation. '''<br />
IT Support automatically updates anti-virus and patches on managed systems. <br />
Here are some additional tips to protect your data.<br />
* Use strong passwords<br />
* Pay attention to your computer's security<br />
* Use email safely<br />
* Use the Internet responsibly and securely<br />
* Dispose of media properly<br />
<br />
'''Pay attention to your computer's security'''<br />
* Lock your computer with a password-protected screen saver before leaving your desk unattended. <br />
* Before you go home, log off the network. <br />
* Manage your data in a manner that reflects its sensitivity.<br />
<br />
== Protecting data at home ==<br />
If you use your home computer to access applications at Offy and your home computer is not properly protected, you can put Offy’s systems at risk.<br />
* Use unprivileged account for normal use<br />
* Always use anti-virus software<br />
* Use VPN to connect if possible<br />
* Apply patches regularly<br />
* Perform regular backups<br />
* Shutdown your computer when not in use<br />
* Work securely from home <br />
* Protect against Malware<br />
* Make wireless networks secure<br />
<br />
IT Helpdesk does not provide support for home computers. If you need additional assistance with your home computer, please contact to us at: itsupportATofficience.com<br />
<br />
== Working Area ==<br />
* '''Clear your desk at the end of day.'''<br />
* '''Don't''' leave sensitive information (paper, cd/dvd,...) on your desk without protection.<br />
* '''Don't''' try to plug any other devices into Officience network without approvals from ITS<br />
* '''Don't''' use personal devices (laptop,...) without approvals from direct manager & ITS<br />
<br />
== Desktop/Laptop Security ==<br />
* '''Lock screen as soon as leaving your seat'''<br />
* Set password-enabled screen saver with inactive timeout, recommend 15 minutes<br />
* Antivirus & firewall must be installed and enabled in the desktop<br />
* Enable & install Windows, Linux & third party updates if available<br />
* Don’t install software without ITS involvement<br />
<br />
== Laptop Security on traveling, remote work ==<br />
* Apply best security practices for desktop, laptop above<br />
* Keep only necessary documents on your laptop<br />
* '''Set password for confidential documents'''<br />
* Encrypt the storage for confidential information<br />
* Use open public wireless carefully. <br />
* Use only VPN to connect to Officience information systems<br />
<br />
== Mobile devices Security ==<br />
* Never leave a smartphone unattended. Make it a personal habit to keep the phone closed at all time<br />
* Keep only necessary documents on your phones<br />
* Set password for confidential documents<br />
* Use open public wireless carefully. <br />
* Don't send private, personal information without vpn or ssl protection<br />
<br />
== Password Usage ==<br />
'''Use strong passwords :'''<br />
* Minimum of 8 characters in length<br />
* Not a dictionary word or proper name<br />
* Not the same as your user ID<br />
* Change within a maximum of 90 days<br />
<br />
'''Memorize It – Don’t write it down!'''<br />
Password Exchange : <br />
* No password sharing <br />
* Don’t send user & password in the same email without encryption<br />
<br />
Best practice are:<br />
<br />
* User id in 1 email & password in another email<br />
* User id in email & password provided face-to-face, phone call, hangout<br />
<sup>Superscript text</sup><br />
<br />
== Keep Your Computer Safe ==<br />
<br />
== Internet Safety ==<br />
<br />
== Internet Usage ==<br />
Internet is for professional use.<br />
<br />
Use the Internet responsibly and securely :<br />
* Don't post sensitive company information or company-related comments on message boards, in chat rooms or anywhere else on the Internet. <br />
* Don't visit inappropriate Internet sites. <br />
<br />
== Email Usage ==<br />
'''Use email safely :'''<br />
* Never open suspicious or unsolicited attachments<br />
* Avoid responding to spam<br />
* never provide credit card numbers, passwords or personal information in response to email messages<br />
* install anti-virus software and update frequently<br />
<br />
'''Double check the recipients before sending emails''' <br />
<br />
'''Do not use corporate email for illegal actions'''<br />
<br />
== Data Backup & Storage ==<br />
<br />
* Store your data in network drives to keep prevent data loss. All network drives are backuped <br />
* Backup retention period is 1 week i.e your oldest data can be recovered is 1 week<br />
* Data ⇒ Backup to Google Cloud (using Offy account)<br />
* Data ⇒ Backup to Customer or Offy SharePoint<br />
<br />
== Use of Encryption ==<br />
* Confidential information must be stored on the secure network with restricted access.<br />
* Whenever it is requested by the information owner to store on any devices other than the secure network server, it must be encrypted.<br />
* All confidential information transmitted to an email outside domain officience.com must be encrypted.<br />
<br />
== Media Destruction ==<br />
<br />
'''Dispose of media properly :'''<br />
Before electronic media is disposed of, appropriate care must be taken to ensure that no unauthorized person can access data by ordinary means. Electronic media such as floppy disks, rewritable CD-ROMS, zip disks, videotapes, and audiotapes should be erased if the media type allows it or destroyed if erasure is not possible.<br />
<br />
== Protection from viruses, trojan horses, malicious codes ==<br />
=== Potential threats ===<br />
* Malicious Software (viruses, trojans, worms, spyware, or other)<br />
* Instant Messaging<br />
* Peer-to-Peer File Sharing<br />
* Identity Theft<br />
* Social Engineering<br />
* Some applications such as Instant Messaging (IM), Peer-to-Peer (P2P) file sharing, pose serious security risks. You should consider anything typed into IM or transferred through P2P to be visible to the entire internet.<br />
* When used in conjunction with Internet sites outside of Offy, they can cause undesirable and damaging consequences. For example, you are most likely to encounter malware browsing an external website. '''When accessing external websites''', members of Offy must be especially cautious<br />
<br />
== Malicious software ==<br />
Malicious software (malware) is a serious threat. These are programs that can "infect" other programs, damage hard drives, erase critical information, take critical systems off-line, and forward your data to external sites without your knowledge.<br />
<br />
'''Malware includes:'''<br />
* Viruses<br />
* Worms<br />
* Trojan Horse programs<br />
* Spyware<br />
* Programs which accidentally harm any system or data<br />
<br />
=== Malware (cont) ===<br />
<br />
=== Malware Example ===<br />
<br />
=== Signs of malware ===<br />
* Slowdown<br />
* Pop-Ups<br />
* Crashes<br />
* Suspicious hard drive activity<br />
* Running out of hard drive space<br />
* Unusually high network activity<br />
* New browser homepage, new toolbars and/or unwanted websites accessed without your input<br />
* Unusual messages or programs that start automatically<br />
* Your security solution is disabled<br />
* Your friends tell you that they are getting strange messages from you<br />
* New, unfamiliar icons on desktop + battery life drains quickly<br />
* You see unusual error messages<br />
* You are unable to access the Control Panel, Task Manager, Registry Editor or Command Prompt<br />
<br />
=== Signs of malware: Example ===<br />
<br />
=== What to do if your PC infected with malware ===<br />
<br />
Anti-virus software running on Offy’s managed workstations protects against most malware. <br />
<br />
Should you suspect that your computer is infected, take immediate action:<br />
* Unplug the computer from the network<br />
* Read the notice carefully…Is it from your real antivirus program? <br />
* What does the notice say your AV program did with the infected file?<br />
* SCAN the hard drive to see if the malware has been dealt with<br />
* Shutdown your system<br />
* Contact the IT Helpdesk for help.<br />
<br />
== Instant Messaging ==<br />
<br />
Instant messaging is the popular method of typing online conversations in real time.<br />
Risks of Externally Hosted Instant Messaging:<br />
* No virus protection<br />
* A separate "exit" action is needed to stop it<br />
* Hijacking and impersonation<br />
* Malicious code<br />
* Unauthorized access<br />
* Poor password security<br />
* Broadcasts the computer's presence online even if the interface is closed<br />
* The data is sent to an external host before going to the intended recipient<br />
<br />
On our Skype network, someone in your contact list send you a file, it’s has icon similar to a PDF or DOC file, but, in fact it’s an execute file. If you receive and open the file, your PC will infected with virus/trojan.<br />
<br />
== P2P file sharing ==<br />
P2P (Peer-to-Peer) means file sharing between users on the Internet. Examples are Gnutella, KaZaA, Napster, Morpheus, eDonkey, BitTorrent and BearShare.<br />
<br />
P2P file sharing is inherently insecure and lives on the fringes of legality. Badly-coded clients, viruses and Trojan Horses and potential lawsuits are just some of the many threats that users must face when they venture into the untamed wilderness of the P2P world. Some threats are:<br />
* Some P2P programs share everything on your computer with anyone by default. <br />
* Some P2P programs themselves contain "spyware".<br />
* Much of the P2P activity is automatic, and its use is unmonitored. <br />
* Creating multiple copies of a copyrighted work, music or videos and sharing them is illegal.<br />
* Computers running P2P programs can be used to spread malware, share private documents, or use your file server for store-and-forward. <br />
* Various types of illegal files can be downloaded and re-shared over these P2P networks by mistake.<br />
<br />
== Identity theft ==<br />
<br />
identity theft is the unauthorized collection and use of your personal information for criminal purposes. This information can be used to open credit card and bank accounts, redirect mail, establish cellular phone service...If this happens, you could be left with the bills, charges, bad checks, and taxes.<br />
<br />
== Social engineering ==<br />
<br />
Social engineering is the practice of obtaining confidential information by manipulation of legitimate users. A social engineer will commonly use the telephone or Internet to trick people into revealing sensitive information or getting them to do something that is against typical policies.<br />
<br />
== Some example about phishing mail ==<br />
<br />
'''Fishing (fake email)''' : Phishing” is the act of sending an email pretending to be from someone “official” with the intention of gaining personal information.<br />
<br />
== Avoid being a victim ==<br />
<br />
Be suspicious of unsolicited phone calls, visits, or email messages from individuals asking about employees or other internal information.<br />
If an unknown individual claims to be from a legitimate organization, try to verify his or her identity directly with the company. <br />
* Do not provide personal information or information about your organization unless you are certain of a person's authority to have the information. <br />
* Do not reveal personal or financial information in email, and do not respond to email solicitations for this information. This includes following links sent in email. <br />
If you are unsure whether an email request is legitimate, try to verify it by contacting the company directly. Do not use contact information provided on a web site connected to the request.<br />
<br />
== Reporting security breaches ==<br />
<br />
=== What is a security incident? ===<br />
<br />
Anytime you suspect a Offy computer has been compromised, whether that involves theft, hacking, a vicious virus, unauthorized use of IT technology or you witness an inappropriate or offensive use of email or the Web, you should report the incident, or seek help and advice from IT Support. <br />
<br />
=== Why should I report a security incident ? ===<br />
<br />
If your system has been infected or any data has been lost, IT Support resources can help you clean up your system. Furthermore, as a user of the network, you should be aware of your rights and responsibilities. <br />
How do I report a security incident?<br />
Report security violations and computing problems to the IT Help Desk at:<br />
* itsupportATofficience.com<br />
* securityATofficience.com<br />
<br />
== DEVICE USE ==<br />
Guidelines for usage include:<br />
* Storage and access of sexually explicit, racist, and hate oriented materials is prohibited.<br />
* Illegal and/or fraudulent practices are prohibited.<br />
* Installation of devices and software for non-business related activities is prohibited. This includes, but is not limited to, gaming devices/software, instant messaging software, wallpaper and screensavers not installed by IT.<br />
* Attachment of devices and/or software to allow external access to the Offy network not explicitly approved by IT is prohibited.<br />
* Installation of software not properly licensed, if required, is prohibited.<br />
* Deactivation of support tools, including antivirus software, systems security, and monitoring tools.<br />
<br />
== Useful Email & Websites ==<br />
<br />
'''Websites'''<br />
* Corporate website: www.officience.com<br />
* HRMS: hr4you.officience.com<br />
* Corporate webmail: mail.officience.com<br />
* Intranet: offyspace.com<br />
* Helpdesk request: http://offyspace.com/sc/<br />
<br />
'''Emails:'''<br />
* IT Support: itsupportATofficience.com<br />
* HR support: hrATofficience.com<br />
* security alert: securityATofficience.com<br />
<br />
== See also ==<br />
*[https://wiki.officience.com/Security_Policy Security policy framework] following ISO/IEC 27001:2013<br />
* [[Security team]]<br />
* [[Thalès Security]]<br />
<br />
== Reference ==<br />
* [https://docs.google.com/presentation/d/1snClXs8nCWRoOe5Mw-WfVTxgnEQVGat6b5gAMR2ZChg Security Training] (by Hoai Linh NGO, 2017)<br />
<br />
*[https://wiki.officience.com/Security_Appendix Security appendices]</div>Duchttps://wiki.officience.com/index.php?title=Security&diff=987Security2019-07-24T18:39:57Z<p>Duc: /* See also */</p>
<hr />
<div>[[File:Edmund Hillary & Tenzing Norgay 1933.png]]<br />
<br />
<br />
== Who is responsible for computer security? ==<br />
'''Every member of Officience is responsible.'''<br />
<br />
* Offies are expected to act responsibly and ethically when accessing Officience’s electronic data and technology resources.<br />
* The security of a system is only as good as its weakest link. If even one person does not pay attention to security, the security of the whole system is compromised. Read example on [[Thalès Security]]. <br />
<br />
Good Security Standards follow the "90/10" Rule :<br />
<br />
* 10% of security safeguards are technical.<br />
* 90% of security safeguards rely on the computer user (YOU) to adhere to good computing practices.<br />
<br />
== Security Topics ==<br />
=== Best security practices for Offies===<br />
* Data protection - classification level of information<br />
* Working Area<br />
* Desktop/Laptop Security<br />
* Laptop security while on traveling or remote work<br />
* Mobile device security<br />
* Password usage<br />
* Internet Usage<br />
* Email usage<br />
* Data Backup & storage<br />
* Use of Encryption<br />
* Media Destruction<br />
<br />
=== Protection from viruses, trojan horses, malicious codes ===<br />
* Potential threats<br />
* Malicious software<br />
* Signs of malware & example<br />
* How to protect against malware<br />
* Instant Messaging<br />
* P2P file sharing<br />
* Identity theft<br />
* Social engineering<br />
* Email phishing<br />
* Avoid being a victim<br />
* Reporting security breaches<br />
<br />
== Data protection : Classification level of information==<br />
<br />
== NDA (Non-disclosure agreement)==<br />
See [[Non-Disclosure Agreement]]<br />
<br />
== Protecting data at work ==<br />
'''The best way to secure your system is to use a managed workstation. '''<br />
IT Support automatically updates anti-virus and patches on managed systems. <br />
Here are some additional tips to protect your data.<br />
* Use strong passwords<br />
* Pay attention to your computer's security<br />
* Use email safely<br />
* Use the Internet responsibly and securely<br />
* Dispose of media properly<br />
<br />
'''Pay attention to your computer's security'''<br />
* Lock your computer with a password-protected screen saver before leaving your desk unattended. <br />
* Before you go home, log off the network. <br />
* Manage your data in a manner that reflects its sensitivity.<br />
<br />
== Protecting data at home ==<br />
If you use your home computer to access applications at Offy and your home computer is not properly protected, you can put Offy’s systems at risk.<br />
* Use unprivileged account for normal use<br />
* Always use anti-virus software<br />
* Use VPN to connect if possible<br />
* Apply patches regularly<br />
* Perform regular backups<br />
* Shutdown your computer when not in use<br />
* Work securely from home <br />
* Protect against Malware<br />
* Make wireless networks secure<br />
<br />
IT Helpdesk does not provide support for home computers. If you need additional assistance with your home computer, please contact to us at: itsupportATofficience.com<br />
<br />
== Working Area ==<br />
* '''Clear your desk at the end of day.'''<br />
* '''Don't''' leave sensitive information (paper, cd/dvd,...) on your desk without protection.<br />
* '''Don't''' try to plug any other devices into Officience network without approvals from ITS<br />
* '''Don't''' use personal devices (laptop,...) without approvals from direct manager & ITS<br />
<br />
== Desktop/Laptop Security ==<br />
* '''Lock screen as soon as leaving your seat'''<br />
* Set password-enabled screen saver with inactive timeout, recommend 15 minutes<br />
* Antivirus & firewall must be installed and enabled in the desktop<br />
* Enable & install Windows, Linux & third party updates if available<br />
* Don’t install software without ITS involvement<br />
<br />
== Laptop Security on traveling, remote work ==<br />
* Apply best security practices for desktop, laptop above<br />
* Keep only necessary documents on your laptop<br />
* '''Set password for confidential documents'''<br />
* Encrypt the storage for confidential information<br />
* Use open public wireless carefully. <br />
* Use only VPN to connect to Officience information systems<br />
<br />
== Mobile devices Security ==<br />
* Never leave a smartphone unattended. Make it a personal habit to keep the phone closed at all time<br />
* Keep only necessary documents on your phones<br />
* Set password for confidential documents<br />
* Use open public wireless carefully. <br />
* Don't send private, personal information without vpn or ssl protection<br />
<br />
== Password Usage ==<br />
'''Use strong passwords :'''<br />
* Minimum of 8 characters in length<br />
* Not a dictionary word or proper name<br />
* Not the same as your user ID<br />
* Change within a maximum of 90 days<br />
<br />
'''Memorize It – Don’t write it down!'''<br />
Password Exchange : <br />
* No password sharing <br />
* Don’t send user & password in the same email without encryption<br />
<br />
Best practice are:<br />
<br />
* User id in 1 email & password in another email<br />
* User id in email & password provided face-to-face, phone call, hangout<br />
<sup>Superscript text</sup><br />
<br />
== Keep Your Computer Safe ==<br />
<br />
== Internet Safety ==<br />
<br />
== Internet Usage ==<br />
Internet is for professional use.<br />
<br />
Use the Internet responsibly and securely :<br />
* Don't post sensitive company information or company-related comments on message boards, in chat rooms or anywhere else on the Internet. <br />
* Don't visit inappropriate Internet sites. <br />
<br />
== Email Usage ==<br />
'''Use email safely :'''<br />
* Never open suspicious or unsolicited attachments<br />
* Avoid responding to spam<br />
* never provide credit card numbers, passwords or personal information in response to email messages<br />
* install anti-virus software and update frequently<br />
<br />
'''Double check the recipients before sending emails''' <br />
<br />
'''Do not use corporate email for illegal actions'''<br />
<br />
== Data Backup & Storage ==<br />
<br />
* Store your data in network drives to keep prevent data loss. All network drives are backuped <br />
* Backup retention period is 1 week i.e your oldest data can be recovered is 1 week<br />
* Data ⇒ Backup to Google Cloud (using Offy account)<br />
* Data ⇒ Backup to Customer or Offy SharePoint<br />
<br />
== Use of Encryption ==<br />
* Confidential information must be stored on the secure network with restricted access.<br />
* Whenever it is requested by the information owner to store on any devices other than the secure network server, it must be encrypted.<br />
* All confidential information transmitted to an email outside domain officience.com must be encrypted.<br />
<br />
== Media Destruction ==<br />
<br />
'''Dispose of media properly :'''<br />
Before electronic media is disposed of, appropriate care must be taken to ensure that no unauthorized person can access data by ordinary means. Electronic media such as floppy disks, rewritable CD-ROMS, zip disks, videotapes, and audiotapes should be erased if the media type allows it or destroyed if erasure is not possible.<br />
<br />
== Protection from viruses, trojan horses, malicious codes ==<br />
=== Potential threats ===<br />
* Malicious Software (viruses, trojans, worms, spyware, or other)<br />
* Instant Messaging<br />
* Peer-to-Peer File Sharing<br />
* Identity Theft<br />
* Social Engineering<br />
* Some applications such as Instant Messaging (IM), Peer-to-Peer (P2P) file sharing, pose serious security risks. You should consider anything typed into IM or transferred through P2P to be visible to the entire internet.<br />
* When used in conjunction with Internet sites outside of Offy, they can cause undesirable and damaging consequences. For example, you are most likely to encounter malware browsing an external website. '''When accessing external websites''', members of Offy must be especially cautious<br />
<br />
== Malicious software ==<br />
Malicious software (malware) is a serious threat. These are programs that can "infect" other programs, damage hard drives, erase critical information, take critical systems off-line, and forward your data to external sites without your knowledge.<br />
<br />
'''Malware includes:'''<br />
* Viruses<br />
* Worms<br />
* Trojan Horse programs<br />
* Spyware<br />
* Programs which accidentally harm any system or data<br />
<br />
=== Malware (cont) ===<br />
<br />
=== Malware Example ===<br />
<br />
=== Signs of malware ===<br />
* Slowdown<br />
* Pop-Ups<br />
* Crashes<br />
* Suspicious hard drive activity<br />
* Running out of hard drive space<br />
* Unusually high network activity<br />
* New browser homepage, new toolbars and/or unwanted websites accessed without your input<br />
* Unusual messages or programs that start automatically<br />
* Your security solution is disabled<br />
* Your friends tell you that they are getting strange messages from you<br />
* New, unfamiliar icons on desktop + battery life drains quickly<br />
* You see unusual error messages<br />
* You are unable to access the Control Panel, Task Manager, Registry Editor or Command Prompt<br />
<br />
=== Signs of malware: Example ===<br />
<br />
=== What to do if your PC infected with malware ===<br />
<br />
Anti-virus software running on Offy’s managed workstations protects against most malware. <br />
<br />
Should you suspect that your computer is infected, take immediate action:<br />
* Unplug the computer from the network<br />
* Read the notice carefully…Is it from your real antivirus program? <br />
* What does the notice say your AV program did with the infected file?<br />
* SCAN the hard drive to see if the malware has been dealt with<br />
* Shutdown your system<br />
* Contact the IT Helpdesk for help.<br />
<br />
== Instant Messaging ==<br />
<br />
Instant messaging is the popular method of typing online conversations in real time.<br />
Risks of Externally Hosted Instant Messaging:<br />
* No virus protection<br />
* A separate "exit" action is needed to stop it<br />
* Hijacking and impersonation<br />
* Malicious code<br />
* Unauthorized access<br />
* Poor password security<br />
* Broadcasts the computer's presence online even if the interface is closed<br />
* The data is sent to an external host before going to the intended recipient<br />
<br />
On our Skype network, someone in your contact list send you a file, it’s has icon similar to a PDF or DOC file, but, in fact it’s an execute file. If you receive and open the file, your PC will infected with virus/trojan.<br />
<br />
== P2P file sharing ==<br />
P2P (Peer-to-Peer) means file sharing between users on the Internet. Examples are Gnutella, KaZaA, Napster, Morpheus, eDonkey, BitTorrent and BearShare.<br />
<br />
P2P file sharing is inherently insecure and lives on the fringes of legality. Badly-coded clients, viruses and Trojan Horses and potential lawsuits are just some of the many threats that users must face when they venture into the untamed wilderness of the P2P world. Some threats are:<br />
* Some P2P programs share everything on your computer with anyone by default. <br />
* Some P2P programs themselves contain "spyware".<br />
* Much of the P2P activity is automatic, and its use is unmonitored. <br />
* Creating multiple copies of a copyrighted work, music or videos and sharing them is illegal.<br />
* Computers running P2P programs can be used to spread malware, share private documents, or use your file server for store-and-forward. <br />
* Various types of illegal files can be downloaded and re-shared over these P2P networks by mistake.<br />
<br />
== Identity theft ==<br />
<br />
identity theft is the unauthorized collection and use of your personal information for criminal purposes. This information can be used to open credit card and bank accounts, redirect mail, establish cellular phone service...If this happens, you could be left with the bills, charges, bad checks, and taxes.<br />
<br />
== Social engineering ==<br />
<br />
Social engineering is the practice of obtaining confidential information by manipulation of legitimate users. A social engineer will commonly use the telephone or Internet to trick people into revealing sensitive information or getting them to do something that is against typical policies.<br />
<br />
== Some example about phishing mail ==<br />
<br />
'''Fishing (fake email)''' : Phishing” is the act of sending an email pretending to be from someone “official” with the intention of gaining personal information.<br />
<br />
== Avoid being a victim ==<br />
<br />
Be suspicious of unsolicited phone calls, visits, or email messages from individuals asking about employees or other internal information.<br />
If an unknown individual claims to be from a legitimate organization, try to verify his or her identity directly with the company. <br />
* Do not provide personal information or information about your organization unless you are certain of a person's authority to have the information. <br />
* Do not reveal personal or financial information in email, and do not respond to email solicitations for this information. This includes following links sent in email. <br />
If you are unsure whether an email request is legitimate, try to verify it by contacting the company directly. Do not use contact information provided on a web site connected to the request.<br />
<br />
== Reporting security breaches ==<br />
<br />
=== What is a security incident? ===<br />
<br />
Anytime you suspect a Offy computer has been compromised, whether that involves theft, hacking, a vicious virus, unauthorized use of IT technology or you witness an inappropriate or offensive use of email or the Web, you should report the incident, or seek help and advice from IT Support. <br />
<br />
=== Why should I report a security incident ? ===<br />
<br />
If your system has been infected or any data has been lost, IT Support resources can help you clean up your system. Furthermore, as a user of the network, you should be aware of your rights and responsibilities. <br />
How do I report a security incident?<br />
Report security violations and computing problems to the IT Help Desk at:<br />
* itsupportATofficience.com<br />
* securityATofficience.com<br />
<br />
== DEVICE USE ==<br />
Guidelines for usage include:<br />
* Storage and access of sexually explicit, racist, and hate oriented materials is prohibited.<br />
* Illegal and/or fraudulent practices are prohibited.<br />
* Installation of devices and software for non-business related activities is prohibited. This includes, but is not limited to, gaming devices/software, instant messaging software, wallpaper and screensavers not installed by IT.<br />
* Attachment of devices and/or software to allow external access to the Offy network not explicitly approved by IT is prohibited.<br />
* Installation of software not properly licensed, if required, is prohibited.<br />
* Deactivation of support tools, including antivirus software, systems security, and monitoring tools.<br />
<br />
== Useful Email & Websites ==<br />
<br />
'''Websites'''<br />
* Corporate website: www.officience.com<br />
* HRMS: hr4you.officience.com<br />
* Corporate webmail: mail.officience.com<br />
* Intranet: offyspace.com<br />
* Helpdesk request: http://offyspace.com/sc/<br />
<br />
'''Emails:'''<br />
* IT Support: itsupportATofficience.com<br />
* HR support: hrATofficience.com<br />
* security alert: securityATofficience.com<br />
<br />
== See also ==<br />
*[https://wiki.officience.com/Security_Policy Security policy details] following ISO/IEC 27001:2013 <br />
* [[Security team]]<br />
* [[Thalès Security]]<br />
<br />
== Reference ==<br />
* [https://docs.google.com/presentation/d/1snClXs8nCWRoOe5Mw-WfVTxgnEQVGat6b5gAMR2ZChg Security Training] (by Hoai Linh NGO, 2017)<br />
<br />
*[https://wiki.officience.com/Security_Appendix Security appendices]</div>Duchttps://wiki.officience.com/index.php?title=Security&diff=986Security2019-07-24T18:38:59Z<p>Duc: /* See also */</p>
<hr />
<div>[[File:Edmund Hillary & Tenzing Norgay 1933.png]]<br />
<br />
<br />
== Who is responsible for computer security? ==<br />
'''Every member of Officience is responsible.'''<br />
<br />
* Offies are expected to act responsibly and ethically when accessing Officience’s electronic data and technology resources.<br />
* The security of a system is only as good as its weakest link. If even one person does not pay attention to security, the security of the whole system is compromised. Read example on [[Thalès Security]]. <br />
<br />
Good Security Standards follow the "90/10" Rule :<br />
<br />
* 10% of security safeguards are technical.<br />
* 90% of security safeguards rely on the computer user (YOU) to adhere to good computing practices.<br />
<br />
== Security Topics ==<br />
=== Best security practices for Offies===<br />
* Data protection - classification level of information<br />
* Working Area<br />
* Desktop/Laptop Security<br />
* Laptop security while on traveling or remote work<br />
* Mobile device security<br />
* Password usage<br />
* Internet Usage<br />
* Email usage<br />
* Data Backup & storage<br />
* Use of Encryption<br />
* Media Destruction<br />
<br />
=== Protection from viruses, trojan horses, malicious codes ===<br />
* Potential threats<br />
* Malicious software<br />
* Signs of malware & example<br />
* How to protect against malware<br />
* Instant Messaging<br />
* P2P file sharing<br />
* Identity theft<br />
* Social engineering<br />
* Email phishing<br />
* Avoid being a victim<br />
* Reporting security breaches<br />
<br />
== Data protection : Classification level of information==<br />
<br />
== NDA (Non-disclosure agreement)==<br />
See [[Non-Disclosure Agreement]]<br />
<br />
== Protecting data at work ==<br />
'''The best way to secure your system is to use a managed workstation. '''<br />
IT Support automatically updates anti-virus and patches on managed systems. <br />
Here are some additional tips to protect your data.<br />
* Use strong passwords<br />
* Pay attention to your computer's security<br />
* Use email safely<br />
* Use the Internet responsibly and securely<br />
* Dispose of media properly<br />
<br />
'''Pay attention to your computer's security'''<br />
* Lock your computer with a password-protected screen saver before leaving your desk unattended. <br />
* Before you go home, log off the network. <br />
* Manage your data in a manner that reflects its sensitivity.<br />
<br />
== Protecting data at home ==<br />
If you use your home computer to access applications at Offy and your home computer is not properly protected, you can put Offy’s systems at risk.<br />
* Use unprivileged account for normal use<br />
* Always use anti-virus software<br />
* Use VPN to connect if possible<br />
* Apply patches regularly<br />
* Perform regular backups<br />
* Shutdown your computer when not in use<br />
* Work securely from home <br />
* Protect against Malware<br />
* Make wireless networks secure<br />
<br />
IT Helpdesk does not provide support for home computers. If you need additional assistance with your home computer, please contact to us at: itsupportATofficience.com<br />
<br />
== Working Area ==<br />
* '''Clear your desk at the end of day.'''<br />
* '''Don't''' leave sensitive information (paper, cd/dvd,...) on your desk without protection.<br />
* '''Don't''' try to plug any other devices into Officience network without approvals from ITS<br />
* '''Don't''' use personal devices (laptop,...) without approvals from direct manager & ITS<br />
<br />
== Desktop/Laptop Security ==<br />
* '''Lock screen as soon as leaving your seat'''<br />
* Set password-enabled screen saver with inactive timeout, recommend 15 minutes<br />
* Antivirus & firewall must be installed and enabled in the desktop<br />
* Enable & install Windows, Linux & third party updates if available<br />
* Don’t install software without ITS involvement<br />
<br />
== Laptop Security on traveling, remote work ==<br />
* Apply best security practices for desktop, laptop above<br />
* Keep only necessary documents on your laptop<br />
* '''Set password for confidential documents'''<br />
* Encrypt the storage for confidential information<br />
* Use open public wireless carefully. <br />
* Use only VPN to connect to Officience information systems<br />
<br />
== Mobile devices Security ==<br />
* Never leave a smartphone unattended. Make it a personal habit to keep the phone closed at all time<br />
* Keep only necessary documents on your phones<br />
* Set password for confidential documents<br />
* Use open public wireless carefully. <br />
* Don't send private, personal information without vpn or ssl protection<br />
<br />
== Password Usage ==<br />
'''Use strong passwords :'''<br />
* Minimum of 8 characters in length<br />
* Not a dictionary word or proper name<br />
* Not the same as your user ID<br />
* Change within a maximum of 90 days<br />
<br />
'''Memorize It – Don’t write it down!'''<br />
Password Exchange : <br />
* No password sharing <br />
* Don’t send user & password in the same email without encryption<br />
<br />
Best practice are:<br />
<br />
* User id in 1 email & password in another email<br />
* User id in email & password provided face-to-face, phone call, hangout<br />
<sup>Superscript text</sup><br />
<br />
== Keep Your Computer Safe ==<br />
<br />
== Internet Safety ==<br />
<br />
== Internet Usage ==<br />
Internet is for professional use.<br />
<br />
Use the Internet responsibly and securely :<br />
* Don't post sensitive company information or company-related comments on message boards, in chat rooms or anywhere else on the Internet. <br />
* Don't visit inappropriate Internet sites. <br />
<br />
== Email Usage ==<br />
'''Use email safely :'''<br />
* Never open suspicious or unsolicited attachments<br />
* Avoid responding to spam<br />
* never provide credit card numbers, passwords or personal information in response to email messages<br />
* install anti-virus software and update frequently<br />
<br />
'''Double check the recipients before sending emails''' <br />
<br />
'''Do not use corporate email for illegal actions'''<br />
<br />
== Data Backup & Storage ==<br />
<br />
* Store your data in network drives to keep prevent data loss. All network drives are backuped <br />
* Backup retention period is 1 week i.e your oldest data can be recovered is 1 week<br />
* Data ⇒ Backup to Google Cloud (using Offy account)<br />
* Data ⇒ Backup to Customer or Offy SharePoint<br />
<br />
== Use of Encryption ==<br />
* Confidential information must be stored on the secure network with restricted access.<br />
* Whenever it is requested by the information owner to store on any devices other than the secure network server, it must be encrypted.<br />
* All confidential information transmitted to an email outside domain officience.com must be encrypted.<br />
<br />
== Media Destruction ==<br />
<br />
'''Dispose of media properly :'''<br />
Before electronic media is disposed of, appropriate care must be taken to ensure that no unauthorized person can access data by ordinary means. Electronic media such as floppy disks, rewritable CD-ROMS, zip disks, videotapes, and audiotapes should be erased if the media type allows it or destroyed if erasure is not possible.<br />
<br />
== Protection from viruses, trojan horses, malicious codes ==<br />
=== Potential threats ===<br />
* Malicious Software (viruses, trojans, worms, spyware, or other)<br />
* Instant Messaging<br />
* Peer-to-Peer File Sharing<br />
* Identity Theft<br />
* Social Engineering<br />
* Some applications such as Instant Messaging (IM), Peer-to-Peer (P2P) file sharing, pose serious security risks. You should consider anything typed into IM or transferred through P2P to be visible to the entire internet.<br />
* When used in conjunction with Internet sites outside of Offy, they can cause undesirable and damaging consequences. For example, you are most likely to encounter malware browsing an external website. '''When accessing external websites''', members of Offy must be especially cautious<br />
<br />
== Malicious software ==<br />
Malicious software (malware) is a serious threat. These are programs that can "infect" other programs, damage hard drives, erase critical information, take critical systems off-line, and forward your data to external sites without your knowledge.<br />
<br />
'''Malware includes:'''<br />
* Viruses<br />
* Worms<br />
* Trojan Horse programs<br />
* Spyware<br />
* Programs which accidentally harm any system or data<br />
<br />
=== Malware (cont) ===<br />
<br />
=== Malware Example ===<br />
<br />
=== Signs of malware ===<br />
* Slowdown<br />
* Pop-Ups<br />
* Crashes<br />
* Suspicious hard drive activity<br />
* Running out of hard drive space<br />
* Unusually high network activity<br />
* New browser homepage, new toolbars and/or unwanted websites accessed without your input<br />
* Unusual messages or programs that start automatically<br />
* Your security solution is disabled<br />
* Your friends tell you that they are getting strange messages from you<br />
* New, unfamiliar icons on desktop + battery life drains quickly<br />
* You see unusual error messages<br />
* You are unable to access the Control Panel, Task Manager, Registry Editor or Command Prompt<br />
<br />
=== Signs of malware: Example ===<br />
<br />
=== What to do if your PC infected with malware ===<br />
<br />
Anti-virus software running on Offy’s managed workstations protects against most malware. <br />
<br />
Should you suspect that your computer is infected, take immediate action:<br />
* Unplug the computer from the network<br />
* Read the notice carefully…Is it from your real antivirus program? <br />
* What does the notice say your AV program did with the infected file?<br />
* SCAN the hard drive to see if the malware has been dealt with<br />
* Shutdown your system<br />
* Contact the IT Helpdesk for help.<br />
<br />
== Instant Messaging ==<br />
<br />
Instant messaging is the popular method of typing online conversations in real time.<br />
Risks of Externally Hosted Instant Messaging:<br />
* No virus protection<br />
* A separate "exit" action is needed to stop it<br />
* Hijacking and impersonation<br />
* Malicious code<br />
* Unauthorized access<br />
* Poor password security<br />
* Broadcasts the computer's presence online even if the interface is closed<br />
* The data is sent to an external host before going to the intended recipient<br />
<br />
On our Skype network, someone in your contact list send you a file, it’s has icon similar to a PDF or DOC file, but, in fact it’s an execute file. If you receive and open the file, your PC will infected with virus/trojan.<br />
<br />
== P2P file sharing ==<br />
P2P (Peer-to-Peer) means file sharing between users on the Internet. Examples are Gnutella, KaZaA, Napster, Morpheus, eDonkey, BitTorrent and BearShare.<br />
<br />
P2P file sharing is inherently insecure and lives on the fringes of legality. Badly-coded clients, viruses and Trojan Horses and potential lawsuits are just some of the many threats that users must face when they venture into the untamed wilderness of the P2P world. Some threats are:<br />
* Some P2P programs share everything on your computer with anyone by default. <br />
* Some P2P programs themselves contain "spyware".<br />
* Much of the P2P activity is automatic, and its use is unmonitored. <br />
* Creating multiple copies of a copyrighted work, music or videos and sharing them is illegal.<br />
* Computers running P2P programs can be used to spread malware, share private documents, or use your file server for store-and-forward. <br />
* Various types of illegal files can be downloaded and re-shared over these P2P networks by mistake.<br />
<br />
== Identity theft ==<br />
<br />
identity theft is the unauthorized collection and use of your personal information for criminal purposes. This information can be used to open credit card and bank accounts, redirect mail, establish cellular phone service...If this happens, you could be left with the bills, charges, bad checks, and taxes.<br />
<br />
== Social engineering ==<br />
<br />
Social engineering is the practice of obtaining confidential information by manipulation of legitimate users. A social engineer will commonly use the telephone or Internet to trick people into revealing sensitive information or getting them to do something that is against typical policies.<br />
<br />
== Some example about phishing mail ==<br />
<br />
'''Fishing (fake email)''' : Phishing” is the act of sending an email pretending to be from someone “official” with the intention of gaining personal information.<br />
<br />
== Avoid being a victim ==<br />
<br />
Be suspicious of unsolicited phone calls, visits, or email messages from individuals asking about employees or other internal information.<br />
If an unknown individual claims to be from a legitimate organization, try to verify his or her identity directly with the company. <br />
* Do not provide personal information or information about your organization unless you are certain of a person's authority to have the information. <br />
* Do not reveal personal or financial information in email, and do not respond to email solicitations for this information. This includes following links sent in email. <br />
If you are unsure whether an email request is legitimate, try to verify it by contacting the company directly. Do not use contact information provided on a web site connected to the request.<br />
<br />
== Reporting security breaches ==<br />
<br />
=== What is a security incident? ===<br />
<br />
Anytime you suspect a Offy computer has been compromised, whether that involves theft, hacking, a vicious virus, unauthorized use of IT technology or you witness an inappropriate or offensive use of email or the Web, you should report the incident, or seek help and advice from IT Support. <br />
<br />
=== Why should I report a security incident ? ===<br />
<br />
If your system has been infected or any data has been lost, IT Support resources can help you clean up your system. Furthermore, as a user of the network, you should be aware of your rights and responsibilities. <br />
How do I report a security incident?<br />
Report security violations and computing problems to the IT Help Desk at:<br />
* itsupportATofficience.com<br />
* securityATofficience.com<br />
<br />
== DEVICE USE ==<br />
Guidelines for usage include:<br />
* Storage and access of sexually explicit, racist, and hate oriented materials is prohibited.<br />
* Illegal and/or fraudulent practices are prohibited.<br />
* Installation of devices and software for non-business related activities is prohibited. This includes, but is not limited to, gaming devices/software, instant messaging software, wallpaper and screensavers not installed by IT.<br />
* Attachment of devices and/or software to allow external access to the Offy network not explicitly approved by IT is prohibited.<br />
* Installation of software not properly licensed, if required, is prohibited.<br />
* Deactivation of support tools, including antivirus software, systems security, and monitoring tools.<br />
<br />
== Useful Email & Websites ==<br />
<br />
'''Websites'''<br />
* Corporate website: www.officience.com<br />
* HRMS: hr4you.officience.com<br />
* Corporate webmail: mail.officience.com<br />
* Intranet: offyspace.com<br />
* Helpdesk request: http://offyspace.com/sc/<br />
<br />
'''Emails:'''<br />
* IT Support: itsupportATofficience.com<br />
* HR support: hrATofficience.com<br />
* security alert: securityATofficience.com<br />
<br />
== See also ==<br />
*[https://wiki.officience.com/Security_Policy Security policy details] <br />
* [[Security team]]<br />
* [[Thalès Security]]<br />
<br />
== Reference ==<br />
* [https://docs.google.com/presentation/d/1snClXs8nCWRoOe5Mw-WfVTxgnEQVGat6b5gAMR2ZChg Security Training] (by Hoai Linh NGO, 2017)<br />
<br />
*[https://wiki.officience.com/Security_Appendix Security appendices]</div>Duchttps://wiki.officience.com/index.php?title=Security&diff=985Security2019-07-24T18:38:16Z<p>Duc: /* Reference */</p>
<hr />
<div>[[File:Edmund Hillary & Tenzing Norgay 1933.png]]<br />
<br />
<br />
== Who is responsible for computer security? ==<br />
'''Every member of Officience is responsible.'''<br />
<br />
* Offies are expected to act responsibly and ethically when accessing Officience’s electronic data and technology resources.<br />
* The security of a system is only as good as its weakest link. If even one person does not pay attention to security, the security of the whole system is compromised. Read example on [[Thalès Security]]. <br />
<br />
Good Security Standards follow the "90/10" Rule :<br />
<br />
* 10% of security safeguards are technical.<br />
* 90% of security safeguards rely on the computer user (YOU) to adhere to good computing practices.<br />
<br />
== Security Topics ==<br />
=== Best security practices for Offies===<br />
* Data protection - classification level of information<br />
* Working Area<br />
* Desktop/Laptop Security<br />
* Laptop security while on traveling or remote work<br />
* Mobile device security<br />
* Password usage<br />
* Internet Usage<br />
* Email usage<br />
* Data Backup & storage<br />
* Use of Encryption<br />
* Media Destruction<br />
<br />
=== Protection from viruses, trojan horses, malicious codes ===<br />
* Potential threats<br />
* Malicious software<br />
* Signs of malware & example<br />
* How to protect against malware<br />
* Instant Messaging<br />
* P2P file sharing<br />
* Identity theft<br />
* Social engineering<br />
* Email phishing<br />
* Avoid being a victim<br />
* Reporting security breaches<br />
<br />
== Data protection : Classification level of information==<br />
<br />
== NDA (Non-disclosure agreement)==<br />
See [[Non-Disclosure Agreement]]<br />
<br />
== Protecting data at work ==<br />
'''The best way to secure your system is to use a managed workstation. '''<br />
IT Support automatically updates anti-virus and patches on managed systems. <br />
Here are some additional tips to protect your data.<br />
* Use strong passwords<br />
* Pay attention to your computer's security<br />
* Use email safely<br />
* Use the Internet responsibly and securely<br />
* Dispose of media properly<br />
<br />
'''Pay attention to your computer's security'''<br />
* Lock your computer with a password-protected screen saver before leaving your desk unattended. <br />
* Before you go home, log off the network. <br />
* Manage your data in a manner that reflects its sensitivity.<br />
<br />
== Protecting data at home ==<br />
If you use your home computer to access applications at Offy and your home computer is not properly protected, you can put Offy’s systems at risk.<br />
* Use unprivileged account for normal use<br />
* Always use anti-virus software<br />
* Use VPN to connect if possible<br />
* Apply patches regularly<br />
* Perform regular backups<br />
* Shutdown your computer when not in use<br />
* Work securely from home <br />
* Protect against Malware<br />
* Make wireless networks secure<br />
<br />
IT Helpdesk does not provide support for home computers. If you need additional assistance with your home computer, please contact to us at: itsupportATofficience.com<br />
<br />
== Working Area ==<br />
* '''Clear your desk at the end of day.'''<br />
* '''Don't''' leave sensitive information (paper, cd/dvd,...) on your desk without protection.<br />
* '''Don't''' try to plug any other devices into Officience network without approvals from ITS<br />
* '''Don't''' use personal devices (laptop,...) without approvals from direct manager & ITS<br />
<br />
== Desktop/Laptop Security ==<br />
* '''Lock screen as soon as leaving your seat'''<br />
* Set password-enabled screen saver with inactive timeout, recommend 15 minutes<br />
* Antivirus & firewall must be installed and enabled in the desktop<br />
* Enable & install Windows, Linux & third party updates if available<br />
* Don’t install software without ITS involvement<br />
<br />
== Laptop Security on traveling, remote work ==<br />
* Apply best security practices for desktop, laptop above<br />
* Keep only necessary documents on your laptop<br />
* '''Set password for confidential documents'''<br />
* Encrypt the storage for confidential information<br />
* Use open public wireless carefully. <br />
* Use only VPN to connect to Officience information systems<br />
<br />
== Mobile devices Security ==<br />
* Never leave a smartphone unattended. Make it a personal habit to keep the phone closed at all time<br />
* Keep only necessary documents on your phones<br />
* Set password for confidential documents<br />
* Use open public wireless carefully. <br />
* Don't send private, personal information without vpn or ssl protection<br />
<br />
== Password Usage ==<br />
'''Use strong passwords :'''<br />
* Minimum of 8 characters in length<br />
* Not a dictionary word or proper name<br />
* Not the same as your user ID<br />
* Change within a maximum of 90 days<br />
<br />
'''Memorize It – Don’t write it down!'''<br />
Password Exchange : <br />
* No password sharing <br />
* Don’t send user & password in the same email without encryption<br />
<br />
Best practice are:<br />
<br />
* User id in 1 email & password in another email<br />
* User id in email & password provided face-to-face, phone call, hangout<br />
<sup>Superscript text</sup><br />
<br />
== Keep Your Computer Safe ==<br />
<br />
== Internet Safety ==<br />
<br />
== Internet Usage ==<br />
Internet is for professional use.<br />
<br />
Use the Internet responsibly and securely :<br />
* Don't post sensitive company information or company-related comments on message boards, in chat rooms or anywhere else on the Internet. <br />
* Don't visit inappropriate Internet sites. <br />
<br />
== Email Usage ==<br />
'''Use email safely :'''<br />
* Never open suspicious or unsolicited attachments<br />
* Avoid responding to spam<br />
* never provide credit card numbers, passwords or personal information in response to email messages<br />
* install anti-virus software and update frequently<br />
<br />
'''Double check the recipients before sending emails''' <br />
<br />
'''Do not use corporate email for illegal actions'''<br />
<br />
== Data Backup & Storage ==<br />
<br />
* Store your data in network drives to keep prevent data loss. All network drives are backuped <br />
* Backup retention period is 1 week i.e your oldest data can be recovered is 1 week<br />
* Data ⇒ Backup to Google Cloud (using Offy account)<br />
* Data ⇒ Backup to Customer or Offy SharePoint<br />
<br />
== Use of Encryption ==<br />
* Confidential information must be stored on the secure network with restricted access.<br />
* Whenever it is requested by the information owner to store on any devices other than the secure network server, it must be encrypted.<br />
* All confidential information transmitted to an email outside domain officience.com must be encrypted.<br />
<br />
== Media Destruction ==<br />
<br />
'''Dispose of media properly :'''<br />
Before electronic media is disposed of, appropriate care must be taken to ensure that no unauthorized person can access data by ordinary means. Electronic media such as floppy disks, rewritable CD-ROMS, zip disks, videotapes, and audiotapes should be erased if the media type allows it or destroyed if erasure is not possible.<br />
<br />
== Protection from viruses, trojan horses, malicious codes ==<br />
=== Potential threats ===<br />
* Malicious Software (viruses, trojans, worms, spyware, or other)<br />
* Instant Messaging<br />
* Peer-to-Peer File Sharing<br />
* Identity Theft<br />
* Social Engineering<br />
* Some applications such as Instant Messaging (IM), Peer-to-Peer (P2P) file sharing, pose serious security risks. You should consider anything typed into IM or transferred through P2P to be visible to the entire internet.<br />
* When used in conjunction with Internet sites outside of Offy, they can cause undesirable and damaging consequences. For example, you are most likely to encounter malware browsing an external website. '''When accessing external websites''', members of Offy must be especially cautious<br />
<br />
== Malicious software ==<br />
Malicious software (malware) is a serious threat. These are programs that can "infect" other programs, damage hard drives, erase critical information, take critical systems off-line, and forward your data to external sites without your knowledge.<br />
<br />
'''Malware includes:'''<br />
* Viruses<br />
* Worms<br />
* Trojan Horse programs<br />
* Spyware<br />
* Programs which accidentally harm any system or data<br />
<br />
=== Malware (cont) ===<br />
<br />
=== Malware Example ===<br />
<br />
=== Signs of malware ===<br />
* Slowdown<br />
* Pop-Ups<br />
* Crashes<br />
* Suspicious hard drive activity<br />
* Running out of hard drive space<br />
* Unusually high network activity<br />
* New browser homepage, new toolbars and/or unwanted websites accessed without your input<br />
* Unusual messages or programs that start automatically<br />
* Your security solution is disabled<br />
* Your friends tell you that they are getting strange messages from you<br />
* New, unfamiliar icons on desktop + battery life drains quickly<br />
* You see unusual error messages<br />
* You are unable to access the Control Panel, Task Manager, Registry Editor or Command Prompt<br />
<br />
=== Signs of malware: Example ===<br />
<br />
=== What to do if your PC infected with malware ===<br />
<br />
Anti-virus software running on Offy’s managed workstations protects against most malware. <br />
<br />
Should you suspect that your computer is infected, take immediate action:<br />
* Unplug the computer from the network<br />
* Read the notice carefully…Is it from your real antivirus program? <br />
* What does the notice say your AV program did with the infected file?<br />
* SCAN the hard drive to see if the malware has been dealt with<br />
* Shutdown your system<br />
* Contact the IT Helpdesk for help.<br />
<br />
== Instant Messaging ==<br />
<br />
Instant messaging is the popular method of typing online conversations in real time.<br />
Risks of Externally Hosted Instant Messaging:<br />
* No virus protection<br />
* A separate "exit" action is needed to stop it<br />
* Hijacking and impersonation<br />
* Malicious code<br />
* Unauthorized access<br />
* Poor password security<br />
* Broadcasts the computer's presence online even if the interface is closed<br />
* The data is sent to an external host before going to the intended recipient<br />
<br />
On our Skype network, someone in your contact list send you a file, it’s has icon similar to a PDF or DOC file, but, in fact it’s an execute file. If you receive and open the file, your PC will infected with virus/trojan.<br />
<br />
== P2P file sharing ==<br />
P2P (Peer-to-Peer) means file sharing between users on the Internet. Examples are Gnutella, KaZaA, Napster, Morpheus, eDonkey, BitTorrent and BearShare.<br />
<br />
P2P file sharing is inherently insecure and lives on the fringes of legality. Badly-coded clients, viruses and Trojan Horses and potential lawsuits are just some of the many threats that users must face when they venture into the untamed wilderness of the P2P world. Some threats are:<br />
* Some P2P programs share everything on your computer with anyone by default. <br />
* Some P2P programs themselves contain "spyware".<br />
* Much of the P2P activity is automatic, and its use is unmonitored. <br />
* Creating multiple copies of a copyrighted work, music or videos and sharing them is illegal.<br />
* Computers running P2P programs can be used to spread malware, share private documents, or use your file server for store-and-forward. <br />
* Various types of illegal files can be downloaded and re-shared over these P2P networks by mistake.<br />
<br />
== Identity theft ==<br />
<br />
identity theft is the unauthorized collection and use of your personal information for criminal purposes. This information can be used to open credit card and bank accounts, redirect mail, establish cellular phone service...If this happens, you could be left with the bills, charges, bad checks, and taxes.<br />
<br />
== Social engineering ==<br />
<br />
Social engineering is the practice of obtaining confidential information by manipulation of legitimate users. A social engineer will commonly use the telephone or Internet to trick people into revealing sensitive information or getting them to do something that is against typical policies.<br />
<br />
== Some example about phishing mail ==<br />
<br />
'''Fishing (fake email)''' : Phishing” is the act of sending an email pretending to be from someone “official” with the intention of gaining personal information.<br />
<br />
== Avoid being a victim ==<br />
<br />
Be suspicious of unsolicited phone calls, visits, or email messages from individuals asking about employees or other internal information.<br />
If an unknown individual claims to be from a legitimate organization, try to verify his or her identity directly with the company. <br />
* Do not provide personal information or information about your organization unless you are certain of a person's authority to have the information. <br />
* Do not reveal personal or financial information in email, and do not respond to email solicitations for this information. This includes following links sent in email. <br />
If you are unsure whether an email request is legitimate, try to verify it by contacting the company directly. Do not use contact information provided on a web site connected to the request.<br />
<br />
== Reporting security breaches ==<br />
<br />
=== What is a security incident? ===<br />
<br />
Anytime you suspect a Offy computer has been compromised, whether that involves theft, hacking, a vicious virus, unauthorized use of IT technology or you witness an inappropriate or offensive use of email or the Web, you should report the incident, or seek help and advice from IT Support. <br />
<br />
=== Why should I report a security incident ? ===<br />
<br />
If your system has been infected or any data has been lost, IT Support resources can help you clean up your system. Furthermore, as a user of the network, you should be aware of your rights and responsibilities. <br />
How do I report a security incident?<br />
Report security violations and computing problems to the IT Help Desk at:<br />
* itsupportATofficience.com<br />
* securityATofficience.com<br />
<br />
== DEVICE USE ==<br />
Guidelines for usage include:<br />
* Storage and access of sexually explicit, racist, and hate oriented materials is prohibited.<br />
* Illegal and/or fraudulent practices are prohibited.<br />
* Installation of devices and software for non-business related activities is prohibited. This includes, but is not limited to, gaming devices/software, instant messaging software, wallpaper and screensavers not installed by IT.<br />
* Attachment of devices and/or software to allow external access to the Offy network not explicitly approved by IT is prohibited.<br />
* Installation of software not properly licensed, if required, is prohibited.<br />
* Deactivation of support tools, including antivirus software, systems security, and monitoring tools.<br />
<br />
== Useful Email & Websites ==<br />
<br />
'''Websites'''<br />
* Corporate website: www.officience.com<br />
* HRMS: hr4you.officience.com<br />
* Corporate webmail: mail.officience.com<br />
* Intranet: offyspace.com<br />
* Helpdesk request: http://offyspace.com/sc/<br />
<br />
'''Emails:'''<br />
* IT Support: itsupportATofficience.com<br />
* HR support: hrATofficience.com<br />
* security alert: securityATofficience.com<br />
<br />
== See also ==<br />
* [[Security team]]<br />
* [[Thalès Security]]<br />
<br />
== Reference ==<br />
* [https://docs.google.com/presentation/d/1snClXs8nCWRoOe5Mw-WfVTxgnEQVGat6b5gAMR2ZChg Security Training] (by Hoai Linh NGO, 2017)<br />
<br />
*[https://wiki.officience.com/Security_Appendix Security appendices]</div>Duchttps://wiki.officience.com/index.php?title=Security&diff=984Security2019-07-24T18:37:15Z<p>Duc: /* Reference */</p>
<hr />
<div>[[File:Edmund Hillary & Tenzing Norgay 1933.png]]<br />
<br />
<br />
== Who is responsible for computer security? ==<br />
'''Every member of Officience is responsible.'''<br />
<br />
* Offies are expected to act responsibly and ethically when accessing Officience’s electronic data and technology resources.<br />
* The security of a system is only as good as its weakest link. If even one person does not pay attention to security, the security of the whole system is compromised. Read example on [[Thalès Security]]. <br />
<br />
Good Security Standards follow the "90/10" Rule :<br />
<br />
* 10% of security safeguards are technical.<br />
* 90% of security safeguards rely on the computer user (YOU) to adhere to good computing practices.<br />
<br />
== Security Topics ==<br />
=== Best security practices for Offies===<br />
* Data protection - classification level of information<br />
* Working Area<br />
* Desktop/Laptop Security<br />
* Laptop security while on traveling or remote work<br />
* Mobile device security<br />
* Password usage<br />
* Internet Usage<br />
* Email usage<br />
* Data Backup & storage<br />
* Use of Encryption<br />
* Media Destruction<br />
<br />
=== Protection from viruses, trojan horses, malicious codes ===<br />
* Potential threats<br />
* Malicious software<br />
* Signs of malware & example<br />
* How to protect against malware<br />
* Instant Messaging<br />
* P2P file sharing<br />
* Identity theft<br />
* Social engineering<br />
* Email phishing<br />
* Avoid being a victim<br />
* Reporting security breaches<br />
<br />
== Data protection : Classification level of information==<br />
<br />
== NDA (Non-disclosure agreement)==<br />
See [[Non-Disclosure Agreement]]<br />
<br />
== Protecting data at work ==<br />
'''The best way to secure your system is to use a managed workstation. '''<br />
IT Support automatically updates anti-virus and patches on managed systems. <br />
Here are some additional tips to protect your data.<br />
* Use strong passwords<br />
* Pay attention to your computer's security<br />
* Use email safely<br />
* Use the Internet responsibly and securely<br />
* Dispose of media properly<br />
<br />
'''Pay attention to your computer's security'''<br />
* Lock your computer with a password-protected screen saver before leaving your desk unattended. <br />
* Before you go home, log off the network. <br />
* Manage your data in a manner that reflects its sensitivity.<br />
<br />
== Protecting data at home ==<br />
If you use your home computer to access applications at Offy and your home computer is not properly protected, you can put Offy’s systems at risk.<br />
* Use unprivileged account for normal use<br />
* Always use anti-virus software<br />
* Use VPN to connect if possible<br />
* Apply patches regularly<br />
* Perform regular backups<br />
* Shutdown your computer when not in use<br />
* Work securely from home <br />
* Protect against Malware<br />
* Make wireless networks secure<br />
<br />
IT Helpdesk does not provide support for home computers. If you need additional assistance with your home computer, please contact to us at: itsupportATofficience.com<br />
<br />
== Working Area ==<br />
* '''Clear your desk at the end of day.'''<br />
* '''Don't''' leave sensitive information (paper, cd/dvd,...) on your desk without protection.<br />
* '''Don't''' try to plug any other devices into Officience network without approvals from ITS<br />
* '''Don't''' use personal devices (laptop,...) without approvals from direct manager & ITS<br />
<br />
== Desktop/Laptop Security ==<br />
* '''Lock screen as soon as leaving your seat'''<br />
* Set password-enabled screen saver with inactive timeout, recommend 15 minutes<br />
* Antivirus & firewall must be installed and enabled in the desktop<br />
* Enable & install Windows, Linux & third party updates if available<br />
* Don’t install software without ITS involvement<br />
<br />
== Laptop Security on traveling, remote work ==<br />
* Apply best security practices for desktop, laptop above<br />
* Keep only necessary documents on your laptop<br />
* '''Set password for confidential documents'''<br />
* Encrypt the storage for confidential information<br />
* Use open public wireless carefully. <br />
* Use only VPN to connect to Officience information systems<br />
<br />
== Mobile devices Security ==<br />
* Never leave a smartphone unattended. Make it a personal habit to keep the phone closed at all time<br />
* Keep only necessary documents on your phones<br />
* Set password for confidential documents<br />
* Use open public wireless carefully. <br />
* Don't send private, personal information without vpn or ssl protection<br />
<br />
== Password Usage ==<br />
'''Use strong passwords :'''<br />
* Minimum of 8 characters in length<br />
* Not a dictionary word or proper name<br />
* Not the same as your user ID<br />
* Change within a maximum of 90 days<br />
<br />
'''Memorize It – Don’t write it down!'''<br />
Password Exchange : <br />
* No password sharing <br />
* Don’t send user & password in the same email without encryption<br />
<br />
Best practice are:<br />
<br />
* User id in 1 email & password in another email<br />
* User id in email & password provided face-to-face, phone call, hangout<br />
<sup>Superscript text</sup><br />
<br />
== Keep Your Computer Safe ==<br />
<br />
== Internet Safety ==<br />
<br />
== Internet Usage ==<br />
Internet is for professional use.<br />
<br />
Use the Internet responsibly and securely :<br />
* Don't post sensitive company information or company-related comments on message boards, in chat rooms or anywhere else on the Internet. <br />
* Don't visit inappropriate Internet sites. <br />
<br />
== Email Usage ==<br />
'''Use email safely :'''<br />
* Never open suspicious or unsolicited attachments<br />
* Avoid responding to spam<br />
* never provide credit card numbers, passwords or personal information in response to email messages<br />
* install anti-virus software and update frequently<br />
<br />
'''Double check the recipients before sending emails''' <br />
<br />
'''Do not use corporate email for illegal actions'''<br />
<br />
== Data Backup & Storage ==<br />
<br />
* Store your data in network drives to keep prevent data loss. All network drives are backuped <br />
* Backup retention period is 1 week i.e your oldest data can be recovered is 1 week<br />
* Data ⇒ Backup to Google Cloud (using Offy account)<br />
* Data ⇒ Backup to Customer or Offy SharePoint<br />
<br />
== Use of Encryption ==<br />
* Confidential information must be stored on the secure network with restricted access.<br />
* Whenever it is requested by the information owner to store on any devices other than the secure network server, it must be encrypted.<br />
* All confidential information transmitted to an email outside domain officience.com must be encrypted.<br />
<br />
== Media Destruction ==<br />
<br />
'''Dispose of media properly :'''<br />
Before electronic media is disposed of, appropriate care must be taken to ensure that no unauthorized person can access data by ordinary means. Electronic media such as floppy disks, rewritable CD-ROMS, zip disks, videotapes, and audiotapes should be erased if the media type allows it or destroyed if erasure is not possible.<br />
<br />
== Protection from viruses, trojan horses, malicious codes ==<br />
=== Potential threats ===<br />
* Malicious Software (viruses, trojans, worms, spyware, or other)<br />
* Instant Messaging<br />
* Peer-to-Peer File Sharing<br />
* Identity Theft<br />
* Social Engineering<br />
* Some applications such as Instant Messaging (IM), Peer-to-Peer (P2P) file sharing, pose serious security risks. You should consider anything typed into IM or transferred through P2P to be visible to the entire internet.<br />
* When used in conjunction with Internet sites outside of Offy, they can cause undesirable and damaging consequences. For example, you are most likely to encounter malware browsing an external website. '''When accessing external websites''', members of Offy must be especially cautious<br />
<br />
== Malicious software ==<br />
Malicious software (malware) is a serious threat. These are programs that can "infect" other programs, damage hard drives, erase critical information, take critical systems off-line, and forward your data to external sites without your knowledge.<br />
<br />
'''Malware includes:'''<br />
* Viruses<br />
* Worms<br />
* Trojan Horse programs<br />
* Spyware<br />
* Programs which accidentally harm any system or data<br />
<br />
=== Malware (cont) ===<br />
<br />
=== Malware Example ===<br />
<br />
=== Signs of malware ===<br />
* Slowdown<br />
* Pop-Ups<br />
* Crashes<br />
* Suspicious hard drive activity<br />
* Running out of hard drive space<br />
* Unusually high network activity<br />
* New browser homepage, new toolbars and/or unwanted websites accessed without your input<br />
* Unusual messages or programs that start automatically<br />
* Your security solution is disabled<br />
* Your friends tell you that they are getting strange messages from you<br />
* New, unfamiliar icons on desktop + battery life drains quickly<br />
* You see unusual error messages<br />
* You are unable to access the Control Panel, Task Manager, Registry Editor or Command Prompt<br />
<br />
=== Signs of malware: Example ===<br />
<br />
=== What to do if your PC infected with malware ===<br />
<br />
Anti-virus software running on Offy’s managed workstations protects against most malware. <br />
<br />
Should you suspect that your computer is infected, take immediate action:<br />
* Unplug the computer from the network<br />
* Read the notice carefully…Is it from your real antivirus program? <br />
* What does the notice say your AV program did with the infected file?<br />
* SCAN the hard drive to see if the malware has been dealt with<br />
* Shutdown your system<br />
* Contact the IT Helpdesk for help.<br />
<br />
== Instant Messaging ==<br />
<br />
Instant messaging is the popular method of typing online conversations in real time.<br />
Risks of Externally Hosted Instant Messaging:<br />
* No virus protection<br />
* A separate "exit" action is needed to stop it<br />
* Hijacking and impersonation<br />
* Malicious code<br />
* Unauthorized access<br />
* Poor password security<br />
* Broadcasts the computer's presence online even if the interface is closed<br />
* The data is sent to an external host before going to the intended recipient<br />
<br />
On our Skype network, someone in your contact list send you a file, it’s has icon similar to a PDF or DOC file, but, in fact it’s an execute file. If you receive and open the file, your PC will infected with virus/trojan.<br />
<br />
== P2P file sharing ==<br />
P2P (Peer-to-Peer) means file sharing between users on the Internet. Examples are Gnutella, KaZaA, Napster, Morpheus, eDonkey, BitTorrent and BearShare.<br />
<br />
P2P file sharing is inherently insecure and lives on the fringes of legality. Badly-coded clients, viruses and Trojan Horses and potential lawsuits are just some of the many threats that users must face when they venture into the untamed wilderness of the P2P world. Some threats are:<br />
* Some P2P programs share everything on your computer with anyone by default. <br />
* Some P2P programs themselves contain "spyware".<br />
* Much of the P2P activity is automatic, and its use is unmonitored. <br />
* Creating multiple copies of a copyrighted work, music or videos and sharing them is illegal.<br />
* Computers running P2P programs can be used to spread malware, share private documents, or use your file server for store-and-forward. <br />
* Various types of illegal files can be downloaded and re-shared over these P2P networks by mistake.<br />
<br />
== Identity theft ==<br />
<br />
identity theft is the unauthorized collection and use of your personal information for criminal purposes. This information can be used to open credit card and bank accounts, redirect mail, establish cellular phone service...If this happens, you could be left with the bills, charges, bad checks, and taxes.<br />
<br />
== Social engineering ==<br />
<br />
Social engineering is the practice of obtaining confidential information by manipulation of legitimate users. A social engineer will commonly use the telephone or Internet to trick people into revealing sensitive information or getting them to do something that is against typical policies.<br />
<br />
== Some example about phishing mail ==<br />
<br />
'''Fishing (fake email)''' : Phishing” is the act of sending an email pretending to be from someone “official” with the intention of gaining personal information.<br />
<br />
== Avoid being a victim ==<br />
<br />
Be suspicious of unsolicited phone calls, visits, or email messages from individuals asking about employees or other internal information.<br />
If an unknown individual claims to be from a legitimate organization, try to verify his or her identity directly with the company. <br />
* Do not provide personal information or information about your organization unless you are certain of a person's authority to have the information. <br />
* Do not reveal personal or financial information in email, and do not respond to email solicitations for this information. This includes following links sent in email. <br />
If you are unsure whether an email request is legitimate, try to verify it by contacting the company directly. Do not use contact information provided on a web site connected to the request.<br />
<br />
== Reporting security breaches ==<br />
<br />
=== What is a security incident? ===<br />
<br />
Anytime you suspect a Offy computer has been compromised, whether that involves theft, hacking, a vicious virus, unauthorized use of IT technology or you witness an inappropriate or offensive use of email or the Web, you should report the incident, or seek help and advice from IT Support. <br />
<br />
=== Why should I report a security incident ? ===<br />
<br />
If your system has been infected or any data has been lost, IT Support resources can help you clean up your system. Furthermore, as a user of the network, you should be aware of your rights and responsibilities. <br />
How do I report a security incident?<br />
Report security violations and computing problems to the IT Help Desk at:<br />
* itsupportATofficience.com<br />
* securityATofficience.com<br />
<br />
== DEVICE USE ==<br />
Guidelines for usage include:<br />
* Storage and access of sexually explicit, racist, and hate oriented materials is prohibited.<br />
* Illegal and/or fraudulent practices are prohibited.<br />
* Installation of devices and software for non-business related activities is prohibited. This includes, but is not limited to, gaming devices/software, instant messaging software, wallpaper and screensavers not installed by IT.<br />
* Attachment of devices and/or software to allow external access to the Offy network not explicitly approved by IT is prohibited.<br />
* Installation of software not properly licensed, if required, is prohibited.<br />
* Deactivation of support tools, including antivirus software, systems security, and monitoring tools.<br />
<br />
== Useful Email & Websites ==<br />
<br />
'''Websites'''<br />
* Corporate website: www.officience.com<br />
* HRMS: hr4you.officience.com<br />
* Corporate webmail: mail.officience.com<br />
* Intranet: offyspace.com<br />
* Helpdesk request: http://offyspace.com/sc/<br />
<br />
'''Emails:'''<br />
* IT Support: itsupportATofficience.com<br />
* HR support: hrATofficience.com<br />
* security alert: securityATofficience.com<br />
<br />
== See also ==<br />
* [[Security team]]<br />
* [[Thalès Security]]<br />
<br />
== Reference ==<br />
* [https://docs.google.com/presentation/d/1snClXs8nCWRoOe5Mw-WfVTxgnEQVGat6b5gAMR2ZChg Security Training] (by Hoai Linh NGO, 2017)<br />
<br />
*[https://wiki.officience.com/Security_Appendix Security appencices]<br />
<br />
*[https://wiki.officience.com/Security_Policy Security policy details]</div>Duchttps://wiki.officience.com/index.php?title=How_do_I_know_what_events_are_happening_at_OffyPlex&diff=921How do I know what events are happening at OffyPlex2018-09-23T22:11:22Z<p>Duc: How to sync Offyplex events on your own agenda</p>
<hr />
<div>Wow, this place is so lively, I'm getting lost with all these events at Offyplex ! <br /><br />
How can I conveniently stay aware about what is happening in OffyPlex?<br /><br />
I dream that I could automatically have all these events showing up in my phone's calendar app automagically, without having to move a finger ... <br /><br />
<br /><br />
Well, dream no more ! And let me show you how to do that with 3 very simple steps:<br /><br />
# Go to [http://calendar.google.com calendar.google.com] and login with our tribe’s account<br />
# Search for "Officience Events" in the left box<br />
# Choose one of the two emails: events@officience.com or offyevents@officience.com<br />
<br />
Congratulations ! The events will now be displayed in your calendar with a special color and synchronized automatically.</div>Duchttps://wiki.officience.com/index.php?title=Product_Presentation&diff=510Product Presentation2017-11-21T10:04:19Z<p>Duc: /* Main guidance */</p>
<hr />
<div>== Audience ==<br />
You're so proud of what we have done for client X, and now you want to make a product presentation to sell it to other clients ? Here are a few advices on how to make your product presentation appealing.<br />
<br />
== General guidance ==<br />
For PowerPoint, here is my Bible, is very short to read, it's from my marketing guru Seth Godin (I've read ALL his books !). It's called "[https://drive.google.com/a/officience.com/file/d/0Bzj0QwcgvarebmpzNUE0VTNjZjQ/view Really BAD powerpoint, and how to avoid it]". Read it !<br />
<br />
The basic idea : for each side you should decide which '''emotion you want people to feel'''. And you start from that emotion to decide what you put in the slide. That will constraint you a lot in terms of idea. You'll have to put only one idea per slide. The role of the emotion is to make the idea sticky, by associating the two together. From one slide to another, the emotions will vary and that will form a story that drags your audience along.<br />
<br />
Next, you need '''a thesis''' You don't make slides to explain, you make slides to convince, to sell something. So you need to focus sharp on that thing you sell and which makes you '''unique'''.<br />
<br />
Example :<br />
"outsource your testing" : so many other people say that, why listen to you specifically ? :-(<br />
"Vietnam is the best country for outsourcing testing" : wow, I'm curious to hear how you can prove that ! :-)<br />
<br />
Now, unique does not mean selfish ! Here is another example :<br />
"Officience is the best company for outsourcing testing" : Meh, this is just advertising. I won't believe a single word of it. :-(<br />
<br />
And the challenge is of course that you can't lie. So you need to find the right angle to tell your story. An angle that will make you friends, and where you are legitimate to be speaking about it. Note that I am specifically referring to '''you making friends''', as an individual, because since Offi is a people-centric environment, the objective is not to convince customers to work with Officience, but to convince human beings to make projects with other human beings that is you. You don't need to sell Officience brand, sell your personal brand instead<br />
<br />
'''The side benefit is that you will get to work with people who appreciate you, life will be more fun :-) !'''<br />
<br />
== Typical outline ==<br />
<br />
=== Intro about Officience ===<br />
Started long time ago (2006), lots of employees (250), to reassure people. Some context about Vietnam and its booming economy is cool too.<br />
<br />
=== The service we offer ===<br />
Here you can use the jargon of your industry to help people understand very quickly the service by using standardized terms. At this stage the customer know what we want to do for him.<br />
<br />
=== Our strengths ===<br />
The idea here is to make it look neutral. Like : in which circumstances is it a good idea to work with us ? It should look like it's not always 100% a good idea.<br />
<br />
=== A few technical details ===<br />
Aim is to show it's real we have experience and we know what we're talkign about<br />
* process design<br />
* Logos of the technologies we prefer.<br />
<br />
=== Success Story ===<br />
To reassure the customer, give an example of a past project that worked so well as case study :<br />
* Context and objectives<br />
* The solutions we deployed<br />
* The "extra mile" what we delivered extra the the custoemr didn't expect :-)<br />
<br />
=== The team ===<br />
Last but not least, highlight of the key engagement people surrounding this product, show they human face, make them feel we already know each other, and share things in common.<br />
<br />
== Where to get inspired ? ==<br />
<br />
[[marketing.officience.com]] is our Google Site where you can find all the presentations we've done in the past. In particular the "Corporate Brochure" presentation has general statements about Offi that you may want to embed or link in your presentation.</div>Duchttps://wiki.officience.com/index.php?title=Product_Presentation&diff=509Product Presentation2017-11-21T10:03:44Z<p>Duc: /* Typical outline */</p>
<hr />
<div>== Audience ==<br />
You're so proud of what we have done for client X, and now you want to make a product presentation to sell it to other clients ? Here are a few advices on how to make your product presentation appealing.<br />
<br />
== Main guidance ==<br />
For PowerPoint, here is my Bible, is very short to read, it's from my marketing guru Seth Godin (I've read ALL his books !). It's called "[https://drive.google.com/a/officience.com/file/d/0Bzj0QwcgvarebmpzNUE0VTNjZjQ/view Really BAD powerpoint, and how to avoid it]". Read it !<br />
<br />
The basic idea : for each side you should decide which '''emotion you want people to feel'''. And you start from that emotion to decide what you put in the slide. That will constraint you a lot in terms of idea. You'll have to put only one idea per slide. The role of the emotion is to make the idea sticky, by associating the two together. From one slide to another, the emotions will vary and that will form a story that drags your audience along.<br />
<br />
Next, you need '''a thesis''' You don't make slides to explain, you make slides to convince, to sell something. So you need to focus sharp on that thing you sell and which makes you '''unique'''.<br />
<br />
Example :<br />
"outsource your testing" : so many other people say that, why listen to you specifically ? :-(<br />
"Vietnam is the best country for outsourcing testing" : wow, I'm curious to hear how you can prove that ! :-)<br />
<br />
Now, unique does not mean selfish ! Here is another example :<br />
"Officience is the best company for outsourcing testing" : Meh, this is just advertising. I won't believe a single word of it. :-(<br />
<br />
And the challenge is of course that you can't lie. So you need to find the right angle to tell your story. An angle that will make you friends, and where you are legitimate to be speaking about it. Note that I am specifically referring to '''you making friends''', as an individual, because since Offi is a people-centric environment, the objective is not to convince customers to work with Officience, but to convince human beings to make projects with other human beings that is you. You don't need to sell Officience brand, sell your personal brand instead<br />
<br />
'''The side benefit is that you will get to work with people who appreciate you, life will be more fun :-) !'''<br />
<br />
== Typical outline ==<br />
<br />
=== Intro about Officience ===<br />
Started long time ago (2006), lots of employees (250), to reassure people. Some context about Vietnam and its booming economy is cool too.<br />
<br />
=== The service we offer ===<br />
Here you can use the jargon of your industry to help people understand very quickly the service by using standardized terms. At this stage the customer know what we want to do for him.<br />
<br />
=== Our strengths ===<br />
The idea here is to make it look neutral. Like : in which circumstances is it a good idea to work with us ? It should look like it's not always 100% a good idea.<br />
<br />
=== A few technical details ===<br />
Aim is to show it's real we have experience and we know what we're talkign about<br />
* process design<br />
* Logos of the technologies we prefer.<br />
<br />
=== Success Story ===<br />
To reassure the customer, give an example of a past project that worked so well as case study :<br />
* Context and objectives<br />
* The solutions we deployed<br />
* The "extra mile" what we delivered extra the the custoemr didn't expect :-)<br />
<br />
=== The team ===<br />
Last but not least, highlight of the key engagement people surrounding this product, show they human face, make them feel we already know each other, and share things in common.<br />
<br />
== Where to get inspired ? ==<br />
<br />
[[marketing.officience.com]] is our Google Site where you can find all the presentations we've done in the past. In particular the "Corporate Brochure" presentation has general statements about Offi that you may want to embed or link in your presentation.</div>Duchttps://wiki.officience.com/index.php?title=Product_Presentation&diff=508Product Presentation2017-11-21T09:55:19Z<p>Duc: /* Main guidance */</p>
<hr />
<div>== Audience ==<br />
You're so proud of what we have done for client X, and now you want to make a product presentation to sell it to other clients ? Here are a few advices on how to make your product presentation appealing.<br />
<br />
== Main guidance ==<br />
For PowerPoint, here is my Bible, is very short to read, it's from my marketing guru Seth Godin (I've read ALL his books !). It's called "[https://drive.google.com/a/officience.com/file/d/0Bzj0QwcgvarebmpzNUE0VTNjZjQ/view Really BAD powerpoint, and how to avoid it]". Read it !<br />
<br />
The basic idea : for each side you should decide which '''emotion you want people to feel'''. And you start from that emotion to decide what you put in the slide. That will constraint you a lot in terms of idea. You'll have to put only one idea per slide. The role of the emotion is to make the idea sticky, by associating the two together. From one slide to another, the emotions will vary and that will form a story that drags your audience along.<br />
<br />
Next, you need '''a thesis''' You don't make slides to explain, you make slides to convince, to sell something. So you need to focus sharp on that thing you sell and which makes you '''unique'''.<br />
<br />
Example :<br />
"outsource your testing" : so many other people say that, why listen to you specifically ? :-(<br />
"Vietnam is the best country for outsourcing testing" : wow, I'm curious to hear how you can prove that ! :-)<br />
<br />
Now, unique does not mean selfish ! Here is another example :<br />
"Officience is the best company for outsourcing testing" : Meh, this is just advertising. I won't believe a single word of it. :-(<br />
<br />
And the challenge is of course that you can't lie. So you need to find the right angle to tell your story. An angle that will make you friends, and where you are legitimate to be speaking about it. Note that I am specifically referring to '''you making friends''', as an individual, because since Offi is a people-centric environment, the objective is not to convince customers to work with Officience, but to convince human beings to make projects with other human beings that is you. You don't need to sell Officience brand, sell your personal brand instead<br />
<br />
'''The side benefit is that you will get to work with people who appreciate you, life will be more fun :-) !'''<br />
<br />
== Typical outline ==<br />
<br />
Intro about Officience<br />
The service we offer<br />
Our strengths (in which circumstances we are a good pick)<br />
Some technical details (process or tool) to show it's real<br />
* process design<br />
* Logos of the technologies we prefer.<br />
Success Story : an example of a past project that worked so well :<br />
* Context and objectives<br />
* The solutions we deployed<br />
* The "extra mile" what we delivered extra the the custoemr didn't expect :-)<br />
The team : highlight of the key engagement people surrounding this product<br />
<br />
== Where to get inspired ? ==<br />
<br />
[[marketing.officience.com]] is our Google Site where you can find all the presentations we've done in the past. In particular the "Corporate Brochure" presentation has general statements about Offi that you may want to embed or link in your presentation.</div>Duchttps://wiki.officience.com/index.php?title=Product_Presentation&diff=507Product Presentation2017-11-21T09:54:35Z<p>Duc: How to make a product presentation slideware</p>
<hr />
<div>== Audience ==<br />
You're so proud of what we have done for client X, and now you want to make a product presentation to sell it to other clients ? Here are a few advices on how to make your product presentation appealing.<br />
<br />
== Main guidance ==<br />
For PowerPoint, here is my Bible, is very short to read, it's from my marketing guru Seth Godin (I've read ALL his books !). It's called "[https://drive.google.com/a/officience.com/file/d/0Bzj0QwcgvarebmpzNUE0VTNjZjQ/view Really BAD powerpoint, and how to avoid it]". Read it !<br />
<br />
The basic idea : for each side you should decide which '''emotion you want people to feel'''. And you start from that emotion to decide what you put in the slide. That will constraint you a lot in terms of idea. You'll have to put only one idea per slide. The role of the emotion is to make the idea sticky, by associating the two together. From one slide to another, the emotions will vary and that will form a story that drags your audience along.<br />
<br />
Next, you need '''a thesis''' You don't make slides to explain, you make slides to convince, to sell something. So you need to focus sharp on that thing you sell and which makes you '''unique'''.<br />
<br />
Example :<br />
"outsource your testing" : so many other people say that, why listen to you specifically ? :-(<br />
"Vietnam is the best country for outsourcing testing" : wow, I'm curious to hear how you can prove that ! :-)<br />
<br />
Now, unique does not mean selfish ! Here is another example :<br />
"Officience is the best company for outsourcing testing" : Meh, this is just advertising. I won't believe a single word of it. :-(<br />
<br />
And the challenge is of course that you can't lie. So you need to find the right angle to tell your story. An angle that will make you friends, and where you are legitimate to be speaking about it. Note that I am specifically referring to '''you making friends''', as an individual, because since Offi is a people-centric environment, the objective is not to convince customers to work with Officience, but to convince human beings to make projects with other human beings that is you. You don't need to sell Officience brand, sell your personal brand instead<br />
<br />
*The side benefit is that you will get to work with people who appreciate you, life will be more fun :-) !*<br />
<br />
== Typical outline ==<br />
<br />
Intro about Officience<br />
The service we offer<br />
Our strengths (in which circumstances we are a good pick)<br />
Some technical details (process or tool) to show it's real<br />
* process design<br />
* Logos of the technologies we prefer.<br />
Success Story : an example of a past project that worked so well :<br />
* Context and objectives<br />
* The solutions we deployed<br />
* The "extra mile" what we delivered extra the the custoemr didn't expect :-)<br />
The team : highlight of the key engagement people surrounding this product<br />
<br />
== Where to get inspired ? ==<br />
<br />
[[marketing.officience.com]] is our Google Site where you can find all the presentations we've done in the past. In particular the "Corporate Brochure" presentation has general statements about Offi that you may want to embed or link in your presentation.</div>Duc