Business Daily Media

4 Tips for Getting Started with Cyber Awareness and Security Training

  • Written by Tyler Moffitt, Senior Security Analyst, Webroot + Carbonite

The pandemic transformed workplaces overnight: remote working conditions accelerated years into the future as entire companies learned new ways of collaborating, communicating and doing business. Unfortunately, not all impacts have been positive. There’s been an intense uplift in cyber-attacks, with Australia’s scamwatch reporting an increase of over 50,000 last year when compared with 2019. The value of the total attacks in 2020 was over $32 million more than 2019 observed, with businesses being the chief victim targeted by scams.

Blame it on increased phishing, already overstretched IT budgets or an increased use of home networks and technology by WFH employees. However, most of these classic issues we tend to ‘blame’ stem from a lack of awareness and cyber education. When these elements are properly engrained in an organization’s processes and culture, the number of risks to the business decreases.

Given that IT staff, especially those at SMBs and MSPs, are tasked with a lot of responsibilities, yet often lack proper resources and time, it can be difficult to get a cybersecurity training and awareness program up and running and maintained. Outlined below are four recommendations IT teams should take when starting a security awareness training or education initiative.

  1. Obtain Buy-in from Stakeholders

It’s a given that business stakeholders acknowledge the importance of security tools – after all, news headlines are only getting scarier and more novel as they reflect the latest breaches and hacks. But being removed from the day-to-day IT and cybersecurity management, these stakeholders often appreciate a critical eye looking at whether the business has the right tools or is using them in the right way. What they need is to clearly understand the threats that are present and popular, the risks that ill-informed personnel may be exposed to and the risks that those personnel can introduce to the business.

Obtaining stakeholder buy-in at the start of a security awareness training initiative is also important as business leaders should play an active, consistent role in promoting the importance of security awareness and compliance across the business and to all employees.

  1. Begin with a Baseline Phishing Campaign

Test employees with a phishing campaign, without warning or context, to establish a baseline understanding of how they understand and identify phishing threats. The baseline phishing test will help businesses see clearly which employees need extra education or guidance and also enables businesses to track progress with each additional phishing test. Our data indicates that the average click-through rate for a phishing simulation campaign is 11 percent – meaning that percentage of employees clicked on what would have been a real phishing link in the test scenario. That drops to eight percent in the second campaign, but by the eleventh in a calendar year it’s down to five percent.

  1. Require Compliance and Security Training

Establish a framework of training campaigns that highlights common and timely cybersecurity topics including phishing, malware, social engineering, strong password policies and more. Negotiate with stakeholders which employees or departments will need customized courses to best tailor the program where possible, or to identify training that needs to be required by all employees because of the business’ industry. For example, employees of a healthcare provider must understand HIPPA compliance protocol, for instance, and be able to identify an email spoofing a large insurance provider.

Real-world training should also mirror real-world events, such as news related to COVID-19, because cyber criminals adapt phishing tactics quickly to take advantage of news headlines and public interest.

  1. Test Regularly

While a baseline test is a good start to get a feel for the cyber preparedness of the office, measuring if the learning has resonated with users is key to fostering cyber resilience and truly seeing ROI. For workforces, repetition and reiterating key messages of the security training will be crucial. Holding regular simulations, with ‘chunked’ learning modules of 4-5 minutes will reinforce education without accompanying fatigue.

For businesses that are unable to run monthly tests, adjust to a quarterly cadence or the needs of your training program. Whatever the testing cycle, ensure you re-test only those who failed each test so that training doesn’t become a nuisance to those who passed.

As WFH setups seem to be ending in the near future, having a cyber aware and cyber resilient workforce is a must to prevent the threats of tomorrow, today. Educating workforces is a long-term commitment and expecting overnight change from remote workforces is unreasonable. But in building an effective security awareness program that involves all employees, IT and important stakeholders, workplaces can create cyber resilience through an informed and equipped audience to help drastically reduce cyber risks to the business.

Tyler Moffitt, Sr. Security Analyst, Webroot

Business Reports

Why shortages remain common 2½ years into the pandemic

A frequent sight during the pandemic.Diana Haronis/MomentShortages of basic goods still plague the U.S. economy – 2½ years after the pandemic’s onset turned global supply chains upside down.Want a new car? You m...

Liked and shared: How social media can elevate your customer experience

Don’t neglect this golden opportunity to connect with customers and win mind and market share. Is social media central to your business development strategy, or something you squeeze into your schedule, as and when? For man...

Optus | Commentary on governance, policy and procedure - Rackspace Technology

“This incident is all about governance, policy and procedure. You can have the best security solutions in place, but you are vulnerable to breaches without the right policies and procedures overlaid with effective governance...

Jucy to take over Apollo Tourism and Leisure

Major Tourism Merger Accelerates Rental Firm’s Trans-Tasman Expansion by Four Year's A merger between two of Australasia’s largest rental vehicle firms is set to advance the trans-Tasman expansion plans of a third major...

Is taking parental leave career suicide?

Taking parental leave can be career suicide. But it doesn’t have to be. Many employees hesitate to take the parental leave they need because they’re worried it will hurt their career, that they’ll lose their position or g...

Employees in ANZ considering quitting because of mismatched values with their employer

Four in ten employees in Australia and New Zealand considering quitting because of mismatched values with their employer  54% of employees say it’s more important than ever for company leaders to speak up  As employees pla...

Web Busters - Break into local search