Written by: Jay H.
The most significant cybersecurity risk to an organization is its employees. Equipping your employees with the right knowledge can turn risky workers into cybersecurity assets. To achieve this, educate your workforce on cybersecurity threats through regular security awareness training. Not sure where to start when drafting your training session? Here are five topics to consider covering in your security awareness training:
1. Phishing
Successful spear phishing causes ninety-five percent of all attacks targeting enterprise networks. This alarming statistic demonstrates the importance of teaching phishing awareness. Therefore, in your training sessions, be sure to cover standard scam emails and tips for identifying phishing attacks, including:
- Do not trust unsolicited emails
- Look for spelling and grammar errors
- Hover over the URL to see if it is linking to a legitimate website
- Do not send funds to people who request them by email
- Be wary of and do not download unsolicited attachments
- Phishing attacks can happen on any medium, including email, SMS, etc.
2. Password Security
Most users have dozens of online accounts that are accessible by providing a username and password. Users can jeopardize these accounts with poor password management. That said, ensure that users are practicing proper password security, including:
- Using a strong and unique password for each online account
- Enabling multi-factor authentication
- Using a password manager to generate and store passwords
- Never sharing their passwords with other people, including family members
3. Safe Internet Habits
Knowing how to stay safe while Internet browsing is essential for every worker. So, teach safe Internet habits in your security awareness training, including:
- Recognizing suspicious and spoofed domains
- The difference between HTTP and HTTPS and why it matters
- The dangers of downloading unverified software off the Internet
4. Environmental Controls
Securing your devices is just one element of security awareness. Educate your employees on the risks the physical work environment presents, such as:
- Leaving passwords or other sensitive information on pieces of paper on one’s desk
- Leaving a computer on and passwordless when not at one’s desk
- Disallowing someone to follow an employee into a restricted area (“tailgating”)
- Ensuring visitors or unauthorized employees aren’t watching as users enter credentials (“shoulder surfing”)
5. Bring-Your-Own-Device (BYOD) Policy
Many companies allow employees to bring in their own devices to work. While this may be productive for the employees, this can present security risks without adequately securing the devices. Therefore, security awareness training should cover BYOD policies, including:
- Securing devices with strong passwords or PINs
- Enabling full-disk encryption
- Using a VPN on public Wi-Fi networks
- Installing a reputable antivirus on all devices
- Downloading software and apps from verified sources
- Applying software patches to keep programs up-to-date and secure
Threats Are Constantly Evolving
The security landscape doesn’t stay the same for long. It is essential to regularly conduct security awareness training to ensure employees are aware of the newest threats. Note that this list is not comprehensive but rather serves as a starting guide to begin planning your sessions. If you need help developing your training session, check out our IT consulting services and contact us today to see how we can help you.
Comments are closed.