Given that a large proportion of cyber attacks occur through employee error, security education and awareness training is an important defence against data breaches.
An annual mandatory security education and awareness training program keeps everybody up to date on cyber security threats. This could be the difference between whether or not a criminal gains access to your money, accounts or data.
To prevent breaches and attacks - data breaches can be very costly, whereas a security awareness training program is relatively inexpensive. It doesn’t take much to get serious returns.
To build a culture of security - training can change the habits and behaviour of staff and instil shared accountability thus keeping your business safe.
To make technological defences more robust - technological defences require input from people. Firewalls need to be turned on. Security warnings need to be acknowledged. Software needs to be updated. Today’s attackers typically target people, as they are seen as an easy way into protected networks.
What skill sets do they need? Although every awareness training includes basic information that is always relevant. Focus on countermeasures or behaviours relative to real, possible internal or external threats to the IT infrastructure. Complete a risk assessment and a business impact assessment (BIA) will help you identify weaknesses and areas of focus.
It is important to emphasise the human role in the cybersecurity chain. A review will help establish new security requirements and devise corrective actions that might need to be addressed through training.
The involvement and support of upper management will also determine the level of importance that the entire program and training will have in the eyes of employees and will show the commitment of the employer to security.
According to your objectives to ensure that the program meets the needs of the business and complies with regulations, related policies, procedures, standards, and guidelines. It is important that the program is realistic i.e. it is better to focus on changing online behaviours and on proper and safer use of any tools, providing specific information and training activities relevant to the employee’s work. Basic topics like social engineering, spear phishing, e-mail security, passwords, mobile devices security, and malware should always be included but what else needs to be taken into consideration? Some examples are different time zones, specific cultural issues that need to be addressed or taken into consideration? Is the workforce highly IT-literate in its entirety or requires more basic information?
The scope and objectives of the training must be clearly stated, and the importance of participation in the program emphasized. Managers should convey that awareness training is an essential part of the employee work day and responsibilities.
It is essential to devise mechanisms to ensure mandatory training is attended (i.e. blocking users’ access to certain systems if they don’t complete periodic security awareness) or determine who will be responsible for ensuring attendance to ensure personnel can get the training as they will be held accountable for their cyber negligence and malpractice.
Interactive learning can help in making the training more relevant and easier to relate to real-life cyber security-related incidents.
