Are you spending increasing amounts of time reacting to incidents where an end-user clicked on something, downloaded an unknown file, or entered credentials for a document they thought a coworker sent to them? It’s not just you.
A recent survey confirmed that cybersecurity threats are on the rise. 53% of IT professionals surveyed indicated an increase in phishing activity since the start of the COVID-19 pandemic.
With remote work continuing for many employees, IT departments find themselves playing defense against these cyberthreats. Sophisticated phishing techniques can catch even the most well-meaning employees off guard.
Regardless of how your network is monitored, secured, and maintained, the “human firewall” can be the weakest link in the chain. To combat this, practical security awareness training has become vital.
The need for security awareness training
Security awareness training is necessary to teach employees how to identify potential threats. All employees, regardless of job title and function, are susceptible to attacks. A 2020 MediaPRO and Osterman Research study found that only 17% of employees are very confident that they can identify a social engineering attack, while more than one-quarter of employees (28%) admitted a lack of confidence in identifying a phishing email.
Because company information is readily available through mobile devices, tablets, and laptops, there is always a risk of accidental exposure. Offhand clicks, done without hovering over a link, can spell disaster. Even two-factor authentication isn’t safe from social engineering schemes to obtain passwords and logins.
Importance of security-minded culture
Establishing a culture of security-minded employees goes beyond learning modules and quizzes. Security is the responsibility of all employees that have access to corporate systems.
Awareness and training are ongoing activities, not a checkbox to complete once a year. By recognizing good behavior (i.e., thanking employees for forwarding suspicious emails along to the Help Desk), you can continuously instill the importance of each employee’s part to protect the company. You should use all incidents as teachable moments. But there are some other, less obvious benefits of the security-minded culture.
A security-minded culture protects assets
The average cost of a data breach in 2020 was a staggering $3.86M. Companies need to defend themselves by helping to increase the effectiveness of the “human firewall.”
A security-minded culture empowers employees
Security awareness training can reduce human error and empower your staff to know when an incident is happening. By preparing employees and enabling them to take action (i.e., feeling comfortable saying no when a caller posing as an executive requests sensitive passwords), you will improve employee reaction time and empower your organization’s employees to make decisions to help the organization.
A security-minded culture prevents downtime
Time is money, and downtime can create a significant loss of revenue. When an incident occurs, systems can be taken offline to properly investigate and recover from an incident. If your employees are more security-minded, there will be fewer incidents that cause downtime.
A security-minded culture ensures compliance
Some industries have enhanced scrutiny for employee security awareness. Conducting training ensures that you meet regulations and show that you are doing your due diligence as an employer and vendor.
How to build a successful security awareness training program
Creating, or even improving your security awareness training program, doesn’t have to be a massive undertaking. Because this subject is so top-of-mind, you might find that now is the perfect opportunity to engage your organization and use the momentum to your advantage. Here are some steps to get you started:
Step 1: Gain stakeholder backing
Unfortunately, security can be viewed as a low-value cost center. It is crucial to make sure your program has senior leadership support. Providing research data and your current metrics on the current number of phishing emails your organization receives can help you explain the need for investment.
Step 2: Define security awareness education goals
Not all organizations will have the same plans for the subject matter, employee participation, and education methods. Identify security training that meets the needs of your business.
Step 3: Assess your audience
Because security is an organizational issue, your audience probably consists of a wide variety of backgrounds and skillsets. Not everyone going through training is well-versed in cybersecurity, and not everyone learns the same way. Get to know your audience and ensure you are aiming to meet their needs.
Step 4: Develop a program
The education you provide could be administered in many ways, including learning management modules, presentations, and onsite Q&A sessions. Your company should also be performing regular phishing tests to simulate outside threats.
Step 5: Perform ongoing training
Awareness training is not something that should just be done annually, but rather something that takes place on a regular cadence that makes sense for your organization. Making security guidance and education routine ensures that your employees keep up to date. Emerging threats are continuously discovered. Your company culture and meeting cadence can best determine the frequency and methods that work for you.
Step 6: Track results
Metrics provide insight into the effectiveness of the training, as well as provide measurable reports to leadership. Successful training will lead to more reported incidents as employees become more aware. The percentage of employees who have completed training, number of phishing exercises, and total real phishing threats detected are significant numbers to measure.
Gone phishing
Security awareness training is an essential part of any IT strategy, and one that you can’t afford to put off. Remote work paired with an increase in phishing threats creates a dangerous liability for your organization. All employees, regardless of position, need training to prevent a security incident.
Find out more about how Fusion Alliance works with clients to improve security awareness: We partnered with a large, Ohio-based utility company to reduce the risk created when employees use their personal devices at work.
