June 13, 2022
For this reason there is not currently an industry (or Government) recognised cyber security standard, or guideline, that doesn’t recommend the training of end users with some form of cybersecurity awareness programme.
Training your employees on how to follow basic security policy, identify suspicious emails and behaviour, and report any problems they encounter or suspect will significantly reduce an organisation’s cyber risk.
Developing a strong cyber security culture in the workforce should be the end result for any successful awareness programme. This is much easier said than done for those given the unenviable task of trying to accomplish this result, so here we provide tips on how to build a successful cybersecurity awareness programme…
Design a training programme that uses a combination of training techniques to keep employees engaged. Interactive eLearning modules, simulated phishing campaigns, awareness messaging campaigns, micro-modules and culture assessments are all ways to establish foundational security knowledge but also reinforce that knowledge and keep your staff engaged. Avoid only focussing on a single form of training.
To change mindsets and reduce the mistakes associated with end-user behaviours, security must become a regular pursuit. Once-a-year compliance training simply will not be enough to raise awareness and help your employees learn how to apply best practices. Use bite-size training to give your end users the benefit of regularly revisiting key cybersecurity topics to encourage knowledge retention. Without reinforcement, learners are put in the position to regularly rebuild – rather than build upon – a cyber security foundation.
Work with your company’s marketing or communication team here. Design security awareness messaging campaigns to keep the subject front-of-mind throughout the year – this is security marketing. Exactly the same approach as the top consumer brands are taking, awareness programmes should be designed to influence the user’s decision making process that benefits the advertiser. Design it to get your users to make better security decisions.
For any workplace culture to be successfully developed and maintained it requires support and buy-in from the leadership team and key stakeholders. Communicate your programme plans, timelines and objectives early on with your executive team and those stakeholders who will be integral to its success, such as department managers and tech support.
Don’t neglect to keep your employees in the loop – they are ultimately one of the most important stakeholders in any awareness programme and the better they understand the reasons for and benefits of the programme, the better they will support it.
Cyber security awareness may not be the sexiest or most exciting of subjects so the more your employees can relate with the training, the more engaged and responsive they will be.
Emphasise that good security practices should also be shared at home to help keep their families and personal lives safe online. Good cyber hygiene at home will translate to good cyber hygiene in the workplace.
Gamifying your security awareness programmes is a great way to get all employees involved and engaged. Departments and individuals can be rewarded on scoring systems built into the training modules and assessments – incentivise behaviour such as high scoring on knowledge assessments, training completion times and rates, and phishing email reporting.
Make cybersecurity training fun and competitive and behaviours will change in the process. Avoid singling out and punishing employees that are regularly failing knowledge assessments or phishing tests, never assume that because you find the subject easy to understand and implement that all employees also will. If employees are consistently failing, then take the time to close the knowledge gaps.
Be prepared for success. As your employees become more educated, aware and confident in identifying potential cybersecurity threats you will see a significant increase in the volume of reporting to the security team or IT department. This will be one of the strongest indicators that your awareness programme is being successful in truly changing behaviour. However, nothing will stall this growth in security culture worse than if the reporting process is poorly managed, or non-existent. Employees should be encouraged and thanked every time they are reporting in and be made to feel they are truly contributing to the organisation’s security. Be sure to include your incident reporting stats in your Awareness Programme Reports to show progress and return on investment, and be sure to share these reports with the employees themselves as well as the leadership team.
Take the time to adequately plan your security awareness programme before launching it. Whilst finding the right vendors, training platforms, training content and awareness material is very important – unless the programme is well executed and supported, it will fail to change behaviour or reduce your risk.
Please contact us if you’d like to learn about how we can help provide you with a robust, fully managed security awareness training platform quickly and easily.
