As Cybersecurity Awareness Month just passed, the team here at Compuquip Cybersecurity thought it would be a good idea to put together a list of tips to help other organizations improve their cybersecurity awareness. While improving security awareness really should be a year-round effort, the fact that October is Cybersecurity Awareness Month makes a great excuse to focus on the subject.
Cyber threats are simply too prevalent—and their potential impacts too severe—for any organization to ignore. Having a strong cybersecurity-aware culture can do wonders to blunt cyber risks because it helps ensure that every employee understands and follows basic best practices for cybersecurity.
With this in mind, here are a few cybersecurity awareness tips organizations of all sizes and industries can benefit from:
1) Set Up a Formal Cybersecurity Training Program
One of the most direct ways to increase cybersecurity awareness in any organization is to create a formal training program centered on cybersecurity practices. When an organization has a formal cybersecurity training program, there is little room for doubt that security awareness is an important issue to the larger organization—not to mention that the employees have been made aware of what they should and should not do.
In fact, starting a cybersecurity training program helps to shore up one of the biggest network security vulnerabilities in any organization: the people who work for the organization. Insider threats consistently rank high on top cyber threat lists, as employees may accidentally fall for phishing attacks or similar social engineering attacks. In fact, according to Securitymagazine.com, “Financial pretexting and phishing represent 98 percent of social incidents and 93 percent of all breaches investigated.”
Training employees to recognize phishing and social engineering attacks helps them to be more aware of these cyber threats—reducing the likelihood that they’ll fall for these schemes in the future.
2) Test Employee Cybersecurity Awareness
Aside from simply handing employees training resources and expecting them to commit the information to memory, it’s important to engage in a bit of learning by doing. In other words, organizations need to test employees on their security awareness from time to time to ensure that the lessons were actually learned. These tests can take numerous forms—from simple assessments that occur at the end of a training program to randomized fake phishing emails designed to see if employees will fall for them.
Testing employee cybersecurity awareness helps to reinforce the lessons from the formal training programs—as well as highlighting gaps in security awareness amongst employees. For example, if more than half of all employees fall for the same trick, odds are good that this is an awareness gap that needs to be addressed.
On completing a test, it may help to provide the assessment results to employees so they can see what they need to work on. Businesses can also have their IT security teams review these results so they can modify the security program to account for the weakness (or recommend training resources to close the security gap).
Practical testing, or learning by doing, can be particularly effective for improving retention of information—which naturally leads to better cybersecurity awareness. As noted in one Forbes article on the subject of experiential learning, “Retention and confidence are far greater when participants have had the opportunity to practice coaching, delegating and listening. Combine that with reflection time and feedback, and you have the best training scenario and ROI!”
3) Circulate Major Cybersecurity Incidents in Meetings or Newsletters
Another way to raise awareness of cyber risks in an organization is to highlight major cybersecurity events in your industry when they occur. Regrettably, it probably won’t be too long before there are several good examples to share—one Business Insider article published in late August highlights no fewer than 16 massive data breaches that occurred over the course of the previous year.
Bringing up these cybersecurity incidents and their underlying causes during meetings with team members is a great way to improve cybersecurity awareness throughout an organization. It also helps to highlight why following cybersecurity best practices is a good idea to employees—largely by demonstrating how weak cybersecurity practices could adversely impact the organization as a whole.
If it simply isn’t possible to have team leaders engage in face-to-face meetings with team members to discuss cybersecurity incidents within their industry, it may help to distribute stories about cybersecurity incidents in an internal newsletter or mass email. While not as effective as having a personal conversation with employees, emails highlighting major breaches can help to improve awareness of specific cyber risks that other companies in your industry have fallen for.
Need help bolstering cybersecurity awareness in your organization, or need help implementing solutions to counter specific cyber threats? Contact the experts at Compuquip Cybersecurity for information and advice about improving your cybersecurity posture.
