Training for staff - Data protection

[mdmd]

Hi all,

 

Does anyone know any good training for all staff with a test or something at the end, we have to have a refresher course to all staff and update our current VLE training also.

 

What do people use at the moment? Is it bespoke or a bought product?

 

Thanks

[malware]

We used GDPR Sentry for training. Test at the end and faux certificate.

[Andycat]

Not just GDPR, but this is pretty thorough (and scary in some cases for your average teacher)

 

https://www.ncsc.gov.uk/information/cyber-security-training-schools

[malware]

Not just GDPR, but this is pretty thorough (and scary in some cases for your average teacher)

 

https://www.ncsc.gov.uk/information/cyber-security-training-schools

 

I think I might implement this when teachers fail our phishing campaigns!

[Danp]

Just before half term I set all of our staff the task to complete the GDPR training on https://www.educare.co.uk/

[DavR]

I think I might implement this when teachers fail our phishing campaigns!

 

I recently sat through this half hour training video - it's a suitable punishment, put it that way!

[pete]

Educare was good when we had it. The National College ( https://thenationalcollege.co.uk/browse/search?search=data+protection&sort=new&cat=) is what we're currently subscribed to.

 

If you've done any in-house training (applying data protection concepts to job roles "OK, you as a department need to do X, Y and Z") it's worth refreshing that if there's been staff turnover since the last time.

[enjay]

We've used the NCSC stuff before too

 

I think I might implement this when teachers fail our phishing campaigns!

 

As in, you send phishing emails to staff? Is this a bought-in service or do you do it yourselves? How has it been received? I'd like to do it here, but Business Manager is concerned staff might not respond positively and would feel "tricked".

[DavR]

I'd like to do it here, but Business Manager is concerned staff might not respond positively and would feel "tricked".

 

Isn't that rather the point? To show them how easily it can be done. A bit of shame at being caught out is a powerful motivator to think twice next time.

[paulkerton]

Isn't that rather the point? To show them how easily it can be done. A bit of shame at being caught out is a powerful motivator to think twice next time.

That's exactly the point. It's like suggesting to your site manager that he should prepare the teaching staff for the fire alarm drill.

[malware]

We've used the NCSC stuff before too

 

 

 

As in, you send phishing emails to staff? Is this a bought-in service or do you do it yourselves? How has it been received? I'd like to do it here, but Business Manager is concerned staff might not respond positively and would feel "tricked".

 

Yes we have run a few and its surprising the amount of people that fall for it, I even try to make it less convincing but they still fall for it haha. We use gophish but there are a few others.

 

We do not actively tell them it was a phishing campaign, just change their password and run an AV scan on their system and hope that the inconvenience caused by this will make them be more careful in the future.

[enjay]

Yes we have run a few and its surprising the amount of people that fall for it, I even try to make it less convincing but they still fall for it haha. We use gophish but there are a few others.

 

We do not actively tell them it was a phishing campaign, just change their password and run an AV scan on their system and hope that the inconvenience caused by this will make them be more careful in the future.

 

How quick/easy to use is Gophish, and how varied are the templates?

 

I might not tell staff it was a phishing campaign from us (although at some point, we might want to publish the numbers, then we'd have to admit we'd done it), but I would tell them how they could have spotted it wasn't genuine. I have a "how to spot a fake email" email which I send round periodically anyway, so it wouldn't strike people as odd.

[malware]

How quick/easy to use is Gophish, and how varied are the templates?

 

I might not tell staff it was a phishing campaign from us (although at some point, we might want to publish the numbers, then we'd have to admit we'd done it), but I would tell them how they could have spotted it wasn't genuine. I have a "how to spot a fake email" email which I send round periodically anyway, so it wouldn't strike people as odd.

 

Both quick AND easy to setup, we didn't use their templates. They have a feature where you can enter a URL and they will rip the page and make it useable in the campaign, for us though, I sent myself a OneDrive shared file email and then recreated that as this is a common attack vector used by these people.

 

Added a few spelling mistakes here and there and when they clicked on the link to view the shared file it took them to a Google login (This should have been a major red flag) but we had a fair few people within 5 mins click the link and even enter personal email/pass for Google!

 

We've tried a lot of things to educate our staff but everything has seemed futile, so now we're forcing MFA and have a banner across every external emailing warning them not to click on links.

[enjay]

Both quick AND easy to setup, we didn't use their templates.

 

You install and run it on a server on-premise which you've made publicly available, yes?

 

so now we're forcing MFA

 

How do you force it? We've got it enabled here, but you can just click "cancel" and not set up MFA.

 

have a banner across every external emailing warning them not to click on links.

 

Which I'm sure people ignore. I clicked a link on an email to get here and read your post, for example.

[malware]

You install and run it on a server on-premise which you've made publicly available, yes?

 

How do you force it? We've got it enabled here, but you can just click "cancel" and not set up MFA.

 

Which I'm sure people ignore. I clicked a link on an email to get here and read your post, for example.

 

Yes that is correct.

 

You mean they can keep clicking cancel even after the 14 day grace period? This is for O365.

[enjay]

You mean they can keep clicking cancel even after the 14 day grace period? This is for O365.

 

Pass. We have it set for everyone, so students are told to click cancel. Is there a way of setting it to staff only and not allowing them to click cancel?

[malware]

Pass. We have it set for everyone, so students are told to click cancel. Is there a way of setting it to staff only and not allowing them to click cancel?

 

In Azure, you can go into Conditional Access, create a new policy and enable MFA in the Grant settings and in the Users and groups' click the 'Select users and groups' radio button, then users and groups checkmark and add your groups that way.

 

So that way we just add the staff groups and not the ones with students.

[enjay]

In Azure, you can go into Conditional Access, create a new policy and enable MFA in the Grant settings and in the Users and groups' click the 'Select users and groups' radio button, then users and groups checkmark and add your groups that way.

 

So that way we just add the staff groups and not the ones with students.

 

That's all done already. Bizarrely I have separate policies for staff and students, both appear to be enabled. So, I see how I could turn it off for students, but since it is already on for staff, I don't see how they're cancelling it after a specific grace period. Where is the grace period set? Maybe that part was never done...

[malware]

That's all done already. Bizarrely I have separate policies for staff and students, both appear to be enabled. So, I see how I could turn it off for students, but since it is already on for staff, I don't see how they're cancelling it after a specific grace period. Where is the grace period set? Maybe that part was never done...

 

Pass lol. We have had it setup for less than 2 weeks so I cannot tell you yet, pretty sure it is the default setting though.

 

Have a read here for a possible solution. I will keep an eye on it now as I was unaware they could keep hitting cancel.

Deployment considerations for Azure AD Multi-Factor Authentication | Microsoft Docs

[enjay]

I will keep an eye on it now as I was unaware they could keep hitting cancel.

 

Keep me posted on whether your users can also keep cancelling it!

 

Have a read here for a possible solution.

 

Ah, that talks about integration with NPS. We have got an NPS server which I've never really looked at. My predecessor set it up and my team don't know anything about it. It works (or possibly is doing nothing!) so I've left it alone...

[GrumbleDook]

The NCSC materials are good for CyberSec but that is only a tiny bit of what you need for data protection training.

 

You need to consider 3 areas.

 

General awareness training for new staff and existing staff (they could be slightly different but you train new staff at induction, and not wait for the annual refresher).

 

Role-specific training to support those dealing with SARs, records management (which includes data destruction), breach management, etc.

 

Remedial training from where any reviews, incidents or DPIAs help you identify a need.

 

I know a number of trainers that can cover this online and in person. DM me which is preferable and can suggest someone to you.

[GLangley]

We use Educare as an e-learning platform (they are part of TES). They have a basic course called A guide to UK Data Protection For Education, level 2. Our outsourced DPO also provides training modules on Information Security through HutSix.