Threat analysis - Digital Security Indicators - Revision history

Eva at 12:54, 27 August 2015

2015-08-27T12:54:17Z

Eva at 12:51, 27 August 2015

2015-08-27T12:51:00Z

Eva at 12:49, 27 August 2015

2015-08-27T12:49:49Z

Eva at 08:43, 29 July 2015

2015-07-29T08:43:10Z

Eva at 08:42, 29 July 2015

2015-07-29T08:42:34Z

Eva at 08:36, 29 July 2015

2015-07-29T08:36:52Z

Eva at 08:22, 29 July 2015

2015-07-29T08:22:39Z

Eva at 07:56, 29 July 2015

2015-07-29T07:56:37Z

Eva: Created page with "{{Tutorial |Title of the tutorial=Security Indicators: sharing and analysis |Kind of learning session=Holistic |Tutorial category=Discussion |Duration (hours)=75m |Learning ob..."

2015-07-29T07:47:28Z

Created page with "{{Tutorial |Title of the tutorial=Security Indicators: sharing and analysis |Kind of learning session=Holistic |Tutorial category=Discussion |Duration (hours)=75m |Learning ob..."

New page

{{Tutorial
|Title of the tutorial=Security Indicators: sharing and analysis
|Kind of learning session=Holistic
|Tutorial category=Discussion
|Duration (hours)=75m
|Learning objectives=To define and explore security indicators in their current situation. To know best practices around sharing and analysis of security indicators.
|Prerequisites=Ideally, output from Situational Analysis exercise
|Methodology=Methodology

Activity (10 minutes)
Give participants a scenario or series of scenarios wherein a HRD identifies security indicators and takes decisions which keep them safer. Example:
<gallery>
Example.jpg|Caption1
Example.jpg|Caption2
</gallery>
|Number of facilitators involved=1
|Technical needs=Flipchart
|Theoretical and on line resources=Holistic Security Guide

Front Line Defenders Workbook on Security https://www.frontlinedefenders.org/files/workbook_eng.pdf

Protection International Manual http://protectioninternational.org/publication/new-protection-manual-for-human-rights-defenders-3rd-edition/
}}

← Older revision		Revision as of 12:54, 27 August 2015
Line 47:		Line 47:

	Divide the group into pairs and tell participants they are going to be security consultants for one another. They will interview one another about one previous attack or security event which they have experienced and try to help one another identify the security indicators which did or may have alerted them to something being wrong. Each participant takes 5-10 minutes to explain the event to their partner. Their partner can then ask them questions or simply listen for 10 further minutes about the security indicators around the event. Together, they fill in a sample register of security indicators, and then swap roles.		Divide the group into pairs and tell participants they are going to be security consultants for one another. They will interview one another about one previous attack or security event which they have experienced and try to help one another identify the security indicators which did or may have alerted them to something being wrong. Each participant takes 5-10 minutes to explain the event to their partner. Their partner can then ask them questions or simply listen for 10 further minutes about the security indicators around the event. Together, they fill in a sample register of security indicators, and then swap roles.
−
−	~~''Further reflection''~~

	'''Discussion'''. Ask participants: What spaces have they made in the past for sharing and analysing security indicators? How can they integrate space for this into their current workflow? Could it be on the agenda at regular meetings? How will they do it during particular activities?		'''Discussion'''. Ask participants: What spaces have they made in the past for sharing and analysing security indicators? How can they integrate space for this into their current workflow? Could it be on the agenda at regular meetings? How will they do it during particular activities?

@@ Line 24: / Line 24: @@
 Do you have any similar experiences to share?
- == Input (15 minutes) ==
+== Input (15 minutes) ==
 Security indicators are anything out of the ordinary that we notice which may have an effect on our security. They are sometimes called security incidents, although they do not have to refer to concrete events. We can identify security indicators at various different moments in our daily life and work. Examples of these  include:

@@ Line 4: / Line 4: @@
 |Tutorial category=Discussion
 |Duration (hours)=75m
-|Learning objectives=To define and explore security indicators in their current situation. To know best practices around sharing and analysis of security indicators.
+|Learning objectives=To define and explore security indicators in their current situation.
 |Prerequisites=Ideally, output from Situational Analysis exercise.
-A safe and trusting environment must be created wherein people are not blamed for things they are perceived to have not done correctly or not been aware of. If necessary, you cn introduce tools for non-violent communication in order to facilitate sharing of security indicators.
 |Methodology=Methodology
@@ Line 12: / Line 14: @@
 Give participants a scenario or series of scenarios wherein a HRD identifies security indicators and takes decisions which keep them safer. Example:
 ''We noticed taxis started parking outside our office. Staff would often take these taxis rather than going to the nearest taxi rank as usual. The taxi drivers started conversations with the passengers, asking what they had been doing that day. Our organisation regularly met with other organisations to discuss their work and security issues. At the next meeting, we mentioned this security incident. Members of the other organisations present then realised that taxis had also started parking outside their offices too. We concluded that the authorities were either using taxi drivers to collect information on us, or had planted security personnel as taxi drivers. Our organisations then decided that the safest response would be to pretend we had not noticed , but we warned the staff not to say anything about their work in the taxis but instead to chat about harmelss issues.''
-Example from the Front Line Defenders Workbook on Security https://www.frontlinedefenders.org/files/workbook_eng.pdf
+[https://www.frontlinedefenders.org/files/workbook_eng.pdf Example from the Front Line Defenders Workbook on Security]
 == Discussion (10 minutes) ==
@@ Line 21: / Line 24: @@
 Do you have any similar experiences to share?
-''Input.'' What the HRDs have done in this scenario is a great example of noting, sharing and analysing security indicators, in order to make decisions about security.
+ == Input (15 minutes) ==
-== Input (15 minutes) ==
+Security indicators are anything out of the ordinary that we notice which may have an effect on our security. They are sometimes called security incidents, although they do not have to refer to concrete events. We can identify security indicators at various different moments in our daily life and work. Examples of these  include:
-−
 Security indicators are anything out of the ordinary that we notice which may have an effect on our security. They are sometimes called security incidents, although they do not have to refer to concrete events.
-−
 We can identify security indicators at various different moments in our daily life and work. Examples of these  include:
 . Receiving a letter from the authorities about an impending search of the office
 . Someone taking a picture of you in a public place
@@ Line 37: / Line 36: @@
 Furthermore, the behaviour of our electronic devices can also change and indicate to us that they may be compromised. Consider what indicators might alarm us to: a virus infection or someone breaking into our email accounts.
-The most important thing to do with security indicators is to record them and share them. Analysing them jointly is a good way to check our perceptions and jointly decide if a response is required.
+The most important thing to do with security indicators is to record them and share them. Analysing them jointly is a good way to check our perceptions and jointly decide if a response is required. Security indicators can also be positive indicators, that we are doing things right and taking effective security measures.
-If it's useful, introduce an example file for recording security indicators (below).
-REMEMBER: Security indicators can also be positive indicators, that we are doing things right and taking effective security measures. For example: Noting that authorities begin to act in protection of other HRDs in your region more effectively; Decreasing crime rates in an area where you work; Noting that your stress levels are lower and you are more alert than before to your security situation.
 == Deepening: Recording and Sharing Security Indicators (30 minutes) ==
@@ Line 45: / Line 42: @@
 ''For organisations''
-'''Step 1.''' Participants return (if possible) to the map of the trends in their context over the previous 12 months (see: [https://gendersec.tacticaltech.org/wiki/index.php/Threat_analysis_-_Situational_analysis Situational Analysis]) and add any attacks or other security-related events which have affected them during this period.
+Participants return (if possible) to the map of the trends in their context over the previous 12 months (see: [https://gendersec.tacticaltech.org/wiki/index.php/Threat_analysis_-_Situational_analysis Situational Analysis]) and add any attacks or other security-related events which have affected them during this period. Participants form one small group per incident identified, or organise into small groups according to their area of work or other affinities within the organisation. The task is for them to focus on a given security event they have suffered and share any security indicators that they can remember which may have alerted them to the event previously. They share and record the events in writing on an example format (provided) if they want to. Remind participants of the definition of security indicators. Each group reports back to the larger group on the security indicators they identified.
-−
-'''Step 2.''' Participants form one small group per incident identified, or organise into small groups according to their area of work or other affinities within the organisation.
-−
-'''Step 3.''' The task is for them to focus on a given security event they have suffered and share any security indicators that they can remember which may have alerted them to the event previously. They share and record the events in writing on an example format (provided) if they want to. Remind participants of the definition of security indicators.
-−
-'''Step 4.''' Each group reports back to the larger group on the security indicators they identified.
 ''For mixed Groups''
@@ Line 76: / Line 67: @@
 |Theoretical and on line resources=Holistic Security Guide
-Front Line Defenders Workbook on Security https://www.frontlinedefenders.org/files/workbook_eng.pdf
+[https://www.frontlinedefenders.org/files/workbook_eng.pdf Front Line Defenders Workbook on Security]
-Protection International Manual http://protectioninternational.org/publication/new-protection-manual-for-human-rights-defenders-3rd-edition/
+[http://protectioninternational.org/publication/new-protection-manual-for-human-rights-defenders-3rd-edition/ Protection International Manual]
 }}

@@ Line 62: / Line 62: @@
 Ask participants to reflect on their own organisation and what would be the best way to record Security Indicators, analyse them and take action where necessary, for  example:
 someone designated to keep a security indicators record book ; someone tasked with highlighting need for joint analysis of security indicators;  what would be an effective and realistic decision making process to decide of reaction is necessary i.e. who should be part of this, how are these decisions and their implementation documented for organizational learning);  this proposal could go into the planning/moving forward session at the end of the training.
 == Synthesis ==

@@ Line 47: / Line 47: @@
 '''Step 1.''' Participants return (if possible) to the map of the trends in their context over the previous 12 months (see: [https://gendersec.tacticaltech.org/wiki/index.php/Threat_analysis_-_Situational_analysis Situational Analysis]) and add any attacks or other security-related events which have affected them during this period.
 '''Step 2.''' Participants form one small group per incident identified, or organise into small groups according to their area of work or other affinities within the organisation.
 Step 3. The task is for them to focus on a given security event they have suffered and share any security indicators that they can remember which may have alerted them to the event previously. They share and record the events in writing on an example format (provided) if they want to. Remind participants of the definition of security indicators.
-Step 4. Each group reports back to the larger group on the security indicators they identified.
+'''Step 3.''' The task is for them to focus on a given security event they have suffered and share any security indicators that they can remember which may have alerted them to the event previously. They share and record the events in writing on an example format (provided) if they want to. Remind participants of the definition of security indicators.
 |Number of facilitators involved=1
 |Technical needs=Flipchart

@@ Line 10: / Line 10: @@
 Activity (10 minutes)
 Give participants a scenario or series of scenarios wherein a HRD identifies security indicators and takes decisions which keep them safer. Example:
-<gallery>
+''We noticed taxis started parking outside our office. Staff would often take these taxis rather than going to the nearest taxi rank as usual. The taxi drivers started conversations with the passengers, asking what they had been doing that day. Our organisation regularly met with other organisations to discuss their work and security issues. At the next meeting, we mentioned this security incident. Members of the other organisations present then realised that taxis had also started parking outside their offices too. We concluded that the authorities were either using taxi drivers to collect information on us, or had planted security personnel as taxi drivers. Our organisations then decided that the safest response would be to pretend we had not noticed , but we warned the staff not to say anything about their work in the taxis but instead to chat about harmelss issues.''
-Example.jpg|Caption1
-Example.jpg|Caption2
-</gallery>
 |Number of facilitators involved=1
 |Technical needs=Flipchart