Kaspersky\u2019s IT security economics in their 2019 report<\/a> discovered \u201cthat both enterprises and SMBs were most frequently affected by incidents as a result of inappropriate IT resource use by employees (52% enterprise, 50% SMBs).\u201d Furthermore, the Netwrix 2018 IT Risks Report<\/a> showed that human error was the leading cause of data loss (responsible for 50%).<\/p>\n\n\n\n I\u2019m sure after reading these stats that you want to make sure your employees aren\u2019t going to cause this type of damage to your organization. Well, the best way to stop this from happening is to train your employees to NOT make these mistakes. This type of training is called security awareness training<\/em> or cybersecurity awareness training<\/em>.<\/p>\n\n\n\n In this article, we\u2019ll take you through a five-step process that will help you develop and manage a security awareness training program. This can be loosely used as a security awareness training program template. But first, here is a more official explanation of what security awareness training is.<\/p>\n\n\n\n Security awareness training is what prepares your employees to respond to and handle security-related concerns. While security awareness training can touch on several topic areas, it\u2019s commonly used for cybersecurity training. From phishing emails to data breaches, the purpose of security awareness training for employees is to ensure they are ready to deal with any cybersecurity issues that come their way.<\/p>\n\n\n\n Here is the five-step process to building a security awareness training program.<\/p>\n\n\n\n The first step of the security awareness training process is to decide who is teaching the course or courses. Some of the questions you need to ask yourself and your team to get this figured out include:<\/p>\n\n\n\n Looking in-house is always a great place to start. This approach allows you to capitalize on your existing resources and not have to bring someone in from a third-party agency. If you do, this person would most likely be someone from the IT department.<\/p>\n\n\n\n It\u2019s important to remember that this won\u2019t be a small project. Planning what should be covered, preparing the materials, conducting the courses, and potential follow-up lessons could all be included in the process. Don\u2019t stress your IT team if they don\u2019t have the time.<\/p>\n\n\n\n There are several third-party services that you can hire to do this if you don\u2019t have an in-house candidate with bandwidth. Obviously, you will need to weigh the expenses to determine what\u2019s possible your budget when deciding who should head the security awareness training program.<\/p>\n\n\n\n But remember: Even if you have to shell out money for some quality training, the cost is still going to be significantly less than leaving your employees as uneducated, sitting ducks. People who have no cyber awareness are what cybercriminals love to prey upon.<\/p>\n\n\n\n Consider this following painful example of what happens when people lack phishing and cyber security awareness. Back in 2014, Xoom Corporation<\/a> \u201cdisclosed that $30.8 million in corporate cash was fraudulently transferred to overseas accounts\u201d due to a phishing attack. With results like that, you surely want your employees trained as well as possible.<\/p>\n\n\n\n Security awareness training is not a less-is-more type of thing \u2014 it\u2019s a more-is-more type of thing. But just how frequently should you require your employees to complete this type of training?<\/p>\n\n\n\n The Advanced Computing Systems Association (USENIX) released a 2020 report<\/a> titled \u201cAn investigation of phishing awareness and education over time: When and how to best remind users.\u201d In it, they shared that around the six-month mark after receiving security awareness training is when employees typically start to forget what they learned.<\/p>\n\n\n\n The training used for this study focused largely on phishing, but regardless, it shows you that people can be forgetful. Based on these findings, it makes sense to hold security awareness training every six months. You should also include the training when you first hire a new employee because they are unfamiliar with your systems and methods.<\/p>\n\n\n\n As far as who should receive security awareness training, the short answer is everyone. Every user (employees, interns, executives, etc.) who has access to your network, systems, data, and other resources should receive training because any of them could be a potential target. If you have contractors who use your network and\/or other resources, they should also undergo training as well.<\/p>\n\n\n\n The answer to step three very much depends on how your organization operates. Are you a shipping company that handles physical belongings on a daily basis? Do you have a large sales team that interacts with customers on the phone and via email often? Do they handle customers\u2019 personal information?<\/p>\n\n\n\n These are important questions to ask yourself. For most companies, there a few key areas that need to be covered in the training program.<\/p>\n\n\n\n Social engineering is a tactic where a hacker tricks or manipulates targets into providing information or performing other actions that they normally wouldn\u2019t. Cybercriminals try to create a sense of urgency or elicit reactions (fear, panic, curiosity, etc.) to get people to do what they want. A cybercriminal may attempt to get someone (often an employee) to:<\/p>\n\n\n\n Social engineering is integral to various types of cyber security attacks, including phishing and spear phishing. The latter is when a cybercriminal performs a very targeted phishing attack on a particular group or individual. This often involves the cybercriminal researching you personally and your organization\u2019s hierarchy to learn what they need to be convincing enough to pull off their attack.<\/p>\n\n\n\n So, if an employee can be reached by an outside party on any platform, then that platform is a topic that you should cover in your security awareness training. This includes email, text messages, phone calls, and social media. Phishing is a huge problem for organizations. Verizon\u2019s 2020 Data Breach Investigations Report<\/a> discovered that the top threat action varieties in breaches is phishing (coming in at more than 20%).<\/p>\n\n\n\n Employees need to be able to:<\/p>\n\n\n\n Employees who manage websites must know how to do so in a safe and secure manner. You may have a lot of employees interact with your website(s) on the back end, such as writers, SEO analyst, admins and so on. This is even more reason to include it in your security awareness training program template. Some topics that should be included in this section include:<\/p>\n\n\n\n Not updating your content management system (CMS) can create vulnerabilities in your CMS. These vulnerabilities can be exploited by hackers and result in your website becoming compromised. CMS updates are designed to patch these vulnerabilities. It\u2019s important to ensure through your training that all employees are aware of this. This helps create accountability to ensure the updates are made.<\/p>\n\n\n\n Another important topic your security awareness training should cover relates to accessing your organization\u2019s website. It\u2019s important to have a plan to eliminate accounts when employees leave. It\u2019s also important to limit access to the CMS based on what capabilities an employee needs to perform their job. This method is called POLP (principle of least privilege). A common example is a copywriter who publishes blogs \u2014 they likely don\u2019t need access beyond being able to publish their work.<\/p>\n\n\n\n Employees need to know how to protect their login information. They are the keys to your systems, network, etc. A Google \/ Harris Poll<\/a> from 2019 shows that 66% of people use the same password for more than one account. The same poll also shows that 43% of users have shared their passwords with someone in the past.<\/p>\n\n\n\n If you think sharing passwords is bad, then you\u2019re really going to love this next stat… The 2020 State of Password and Authentication Security Behaviors Report<\/a> discovered that \u201c42% of IT professionals report that their organization relies on sticky notes to manage passwords.\u201d Yes, you read that right: sticky notes! 42%!<\/p>\n\n\n\n If these stats show anything, it\u2019s that there are many organizations out there that are susceptible to brute force attacks and physical security intrusions. This means that password login credentials are likely to end up in the wrong hands. It\u2019s important to cover how to create strong passwords and how to manage your login credentials properly.<\/p>\n\n\n\n Another important thing for IT admins to keep in mind concerns secure password storage. You should never<\/em>, under any circumstance, store passwords in public-facing environments. All passwords should be salted and hashed on the backend, and those salted password hashes are the only things that should be stored. Be sure to review NIST\u2019S recommendations regarding secure password storage in their special publication \u201cDigital Identity Guidelines\u201d (SP-800-63B)<\/a>.<\/p>\n\n\n\n Employees should know how to spot a suspicious or malicious website. Users should only interact with websites that showcase the HTTPS and padlock icon beside that website\u2019s URL. And not just that \u2014 they should also click to read the certificate\u2019s details to verify the company\u2019s identity (both pictured below) to ensure they\u2019re connecting to the legitimate site. What this tells you is two things:<\/p>\n\n\n\n You should also look for a privacy policy on a website to know if it is legit. A privacy policy should tell you<\/a> how a website safely collects and handles your personal information. Knowing how this is done should provide you peace of mind when interacting with a website and act as a way to tell if a website is legit. <\/p>\n\n\n\n You should also look for websites that display site seals (which are also sometimes called trust badges). Similar to an SSL certificate, a site seal shows that a company has been vetted and deemed safe by a trusted third party (known as a certificate authority or CA). This is just another way to know a website is both secure and<\/em> safe.<\/p>\n\n\n\n Another important topic to cover is physical security. An easy way to think about physical security is to think of your job like your house. Do you let random strangers into your house? No. So, don\u2019t do it at your job! Make sure to cover basic things like not holding the door open, checking for IDs, and not leaving guests untended.<\/p>\n\n\n\n Also, just like your house, there are certain rooms or areas that are higher security and should be off-limits to everyone except select individuals. If you throw a party, you don\u2019t want your guests rummaging through your jewelry box or safe. Similarly, you don\u2019t want unauthorized individuals in sensitive areas. These are great topics to cover in your security awareness training for employees.<\/p>\n\n\n\n A VPN (virtual private network) basically turns a public network connection into a private network connection. Public networks are typically not encrypted, which makes them unsafe to browse on. This is important for your employees to know if they work remotely or decide to take off to a coffee shop to work on their lunch break. It is much safer to use a VPN in these situations. It\u2019s another great topic to cover in security awareness training for how they can stay safe online while on the go.<\/p>\n\n\n\n It\u2019s vital employees know what the plan is if they come across a cybersecurity issue. But before they can know that you first need to have a plan in place for that training to draw from. This means you\u2019ll need to figure out these items before putting together your cybersecurity awareness training program:<\/p>\n\n\n\n Answering these questions will help ensure you have a plan set in place for you and your employees when a cybersecurity issues arises. And remember, it\u2019s a matter of when<\/em> something will happen and not if<\/em>.<\/p>\n\n\n\n For more ideas on how to develop your cyber security awareness training and the topics to cover in it, be sure to check out the following resources:<\/p>\n\n\n\n It\u2019s important to follow up with your employees to make sure they are prepared. You can simulate a phishing test to see if your employees:<\/p>\n\n\n\nWhat Is Security Awareness Training?<\/h2>\n\n\n\n
Security Awareness Training Step One \u2013 Choose Who Teaches the Course(s)<\/h2>\n\n\n\n
Do You Have a Professional Who is Equipped to Teach the Course?<\/h3>\n\n\n\n
Does Our In-House Expert Have the Bandwidth to Tackle This Project?<\/h3>\n\n\n\n
Who Else Can Teach This Training If Not an Internal Person?<\/h3>\n\n\n\n
Security Awareness Training Step Two \u2013 Decide How Often You Will Offer the Course (and Who Should Complete It)<\/h2>\n\n\n\n
Security Awareness Training <\/a>Step Three \u2013 Decide What Topics to Focus on In Your Training<\/h2>\n\n\n\n
The Dangers of Social Engineering<\/h3>\n\n\n\n
Managing Access to a Website<\/h3>\n\n\n\n
Managing & Implementing CMS Updates<\/h4>\n\n\n\n
Determining Who Can Access Your Website<\/h4>\n\n\n\n
Protecting Login Information<\/h3>\n\n\n\n
![\"\"](\"https:\/\/cheapsslsecurity.com\/blog\/wp-content\/uploads\/2021\/03\/security-awareness-training-google-harris-poll-statistic.png\")
Safe Internet Browsing<\/h3>\n\n\n\n
![\"\"](\"https:\/\/cheapsslsecurity.com\/blog\/wp-content\/uploads\/2021\/03\/cheapsslsecurity-website-security-certificate-padlock-example.png\")
![\"\"](\"https:\/\/cheapsslsecurity.com\/blog\/wp-content\/uploads\/2021\/03\/website-privacy-policy.png\")
![\"\"](\"https:\/\/cheapsslsecurity.com\/blog\/wp-content\/uploads\/2021\/03\/website-trust-badge-cheapsslsecurity.png\"){kind=icon}
Physical Security Considerations<\/h3>\n\n\n\n
Using a VPN<\/h3>\n\n\n\n
Security Awareness Training Step Four \u2013 Have a Plan for Everything<\/h2>\n\n\n\n
Security Awareness Training Step Five \u2014 Ensuring Success<\/h2>\n\n\n\n