Security Awareness Training

Security awareness training for employees is a critical component of compliance and security in your organization.

The risk of an employee not understanding the potential security threats facing them as a frontline target could be just the opening that an attacker needs to create a security breach.

You are only as strong as your weakest link, so implementing a regular security awareness training program is crucial to ensure that you’re doing your part to inspire and educate your employees to greater levels of security and awareness. The first step in a successful training program is having a culture of security at your organization, including buy-in from upper management. If the employees see management’s focus on creating a secure work environment, that attitude will spread.

Here are five things to think about when training your employees to practice security in the workforce:

1. Physical Security – Are you required to wear badges while on the property? Are there appropriate identification and sign-in procedures at the front desk to monitor individuals who are coming in and out of the facility? Are these processes being followed every time?
2. Password Security – Passwords should be at least 8 characters long and use a variety of upper and lowercase letters, numbers, and special characters. Default passwords should never be used, and passwords should never be shared.
3. Phishing – Train your staff to be wary phishers and to know what to look for. Make sure they know not to open attachments in emails if they do not know the source. Encourage them to not send confidential information in response to an email claiming that “urgent action is required”. Test your employees, train your employees, and make sure you’ve created an environment where if in doubt, someone will ask before engaging in an email that may look suspicious.
4. Social Engineering – Social engineering threats are threats based on human vulnerabilities. It’s a way attackers manipulate people into giving away confidential information, password/ID combinations, or to gain unauthorized access to a facility. Train your employees to operate with a healthy amount of skepticism, and to never give out sensitive information without fully identifying the other person.
5. Malware – Malware, much like phishing, can enter your environment through non-malicious looking threats such as employees opening emails from unknown sources, using a USB drive that is infected, or going to websites that may be unsafe. Be sure employees are trained to be aware of these kinds of attacks, and practice identifying malware threats.

If you’re looking for a cost-effective security awareness training solution for your company, KirkpatrickPrice offers several libraries in our online training solution. For more information about the courses we offer, email me at [email protected].

Sarah Morris is the Managing Editor at KirkpatrickPrice, a valued partner of AIS Network. She is certified in General Information Security Fundamentals (GIAC GISF) and specializes in keeping organizations up to date on information security and regulatory compliance by being a thought leader and developing valuable content that revolves around industry trends and best practices.