HOW TO TRAIN YOUR STAFF ON CYBERSECURITY
Should every company train its employees on cybersecurity? Modern businesses depend on data and confidential information completely and this data nearly always is managed by people. So if your staff is unaware of the latest types of cyberattacks and basic rules of information security, your company is practically powerless and extremely vulnerable to data breaches.
According to Kaspersky Lab research, more than 60% of businesses around the globe already invest in different training programs. And anyway, cybercrime and data losses rise enormously and they are expected to cost companies $8 trillion in the next five years. This is an indicator that no business is immune from hackers. And now is the best time for every business to launch employee cybersecurity training.
Humans are considered the biggest problem and weakest link in cybersecurity as they make mistakes but some mistakes are totally unacceptable. These might include clicking on suspicious links, opening unknown email attachments, using the same passwords. These common errors are the result of a lack of training and security awareness.
So, where to start?
To minimize careless cybersecurity mistakes and encourage employee vigilance, you should talk with your employees on cybersecurity regularly. Regularly means at least once a month. Security issues should always be on the top of employees’ minds. Inform your staff about the latest techniques and penetration methods that hackers use. Employees should know what impact a breach could have on a company as a whole and on each staff member separately; they also should be aware of the danger posed by social engineering, phishing, malware and ransomware attacks etc. Bear in mind that if held annually, all the information of security trainings will be forgotten almost immediately.
Faux phishing attacks
An effective method of training employees is faux phishing attack. Using this method you may train employees on how to recognize and handle emails that may contain dangerous links and attachments. Moreover, staff members will learn to recognize phishing attempts and malware-loaded communications. Why is this critical? 30% of data breaches, according to Verizon 2016 data Breach Investigations report, are caused by employees’ negligence, for example opening suspicious emails.
Again on passwords
Your cybersecurity trainings should include classes on the importance of strong passwords. Do forget about “123qwe” as the reliable one. Verizon states that 63% of data leakages happened mainly because of weak or stolen passwords. Passwords must be complicated, contain upper- and lower-case letters and numbers but at the same time be easy-to-remember.
Social engineering attacks
The devil is as black as he’s painted. Social engineering is the manipulation of people, not machines, in order to breach company’s systems and steal confidential data. Today it is one of the leading security threats as it is based on the vulnerability of human psychology. Employees must understand different kinds and tactics of social engineering and know how to prevent social engineering from putting your business at risk of being hacked. For this purpose, part of your training should be aimed at clarification of the danger of phone calls and emails from third-parties pretending to be your co-worker with urgent problem that requires an access to confidential data and information. In fact, these are attempts to gather as much information about your business as possible.
All staff members should be involved
Even well-educated on cyber security specialists tend to make mistakes so all personnel should be involved in constant training including IT and IS professionals, CEOs and CISOs. Top managers are especially vulnerable because they have high access to all confidential data. Also, IT staff is key target because of their administrative access to all corporate networks and resources. Cybercriminals with the intention to hack corporate networks often know who the executives are which means that company management is even more at risk.
Conduct regular testing and assessments
Any training needs assessment and analysis so test your staff regularly. You should know their level of knowledge and skills in order to see gaps and soft spots. What to include in your tests? For example, fake phishing attacks to see how many employees will click on those suspicious links and consequently provide information. For those who fell for the false phishing emails conduct additional trainings, create multiple courses and workshops. Moreover, you may also see how many employees will transmit confidential company data over email if asked on a website or service.
Ongoing nature
Information security training should be ongoing, regular and keep up with the latest cyber security trends and techniques. Inform your employees about the latest sophisticated security threats and infiltration methods as they evolve daily and regularly hold live demos during classes. It may be useful to send emails and bulletins with different security tips and reminders as well as technical solutions and advice on how to monitor and mitigate cyber risks and which steps to take after a data breach.
To draw the conclusion, one can say that companies should constantly conduct security awareness training and necessarily include practical examples of the most common security threats and vulnerabilities. Employees must have a clear understanding that ignorance, carelessness and unwillingness to study will invariably lead to constant data losses and hackers’ attacks.
