While many companies realize they should provide IT security training, they often do not know where to begin. If your business is one of them, here are some suggestions to get you started.
The actions of careless and uninformed employees are a leading cause of serious IT security breaches, second only to malware attacks, according to a study by Kaspersky Lab and B2B International. Even when a security incident is caused by malware, employees’ actions are often a contributing factor.
These study findings point to the need for IT security training. This training can mean the difference between employees being a security liability or a security asset. While many businesses know they should be training their employees, they often do not know how often to provide the training, what to cover, and how to make it effective.
How Often
When it comes to IT security training, taking a “one and done” approach is not advisable. Instead, companies need to provide ongoing training because cybercriminals are constantly changing their tactics and devising new cyberthreats. The organization that oversees the United States’ Health Insurance Portability and Accountability Act (HIPAA) recommends monthly security updates in addition to bi-annual training. Yet, only a quarter of employees receive cybersecurity training at least once a month, according to a Finn Partners survey.
Although there are expenses associated with providing ongoing training, the costs incurred from a serious IT security incident would be much higher. In 2017 alone, phishing and business email compromise (BEC) scams set US companies back $705 million.
What to Include
Your training program should be tailored to meet your company’s needs. It should cover the specific types of IT security risks that your employees might face on the job. The program also needs to address the security requirements employees are expected to meet. This is particularly important if your business must comply with any industry or government regulations such as HIPAA or the European Union’s General Data Protection Regulation (GDPR).
Topics commonly covered in IT security training include:
- The need for strong, unique passwords and how to create them
- The different types of malware (e.g., ransomware, spyware) and how they are spread
- Email security, including how to spot phishing emails and BEC scams
- What employees should do if they receive a suspicious email or encounter another type of IT security problem
- How to safely use the Internet
- Social engineering threats
- How to use mobile devices securely
- Physical IT security measures being used
- Your company’s IT security policies
All employees — including managers and executives — should receive basic security training. Some employees might need additional instruction that is specific to their particular jobs.
How to Make the Training More Effective
The IT security training will be pointless if your employees do not remember any of it. Fortunately, there are several ways to help make your IT security training more memorable and effective. For starters, you should hold short training sessions rather than marathon meetings. Bombarding employees with information for many hours will result in information overload, which means they will likely forget most of it. Providing ongoing training in small chunks is a more effective way to get employees to retain information. Plus, it will be easier for them to fit shorter training sessions into their work schedules.
Including hands-on activities in the training sessions will also help employees remember the information presented. For example, in addition to discussing on how to spot phishing scams, you could place the employees into small groups, give them copies of emails, and have them pick out the ones they think are phishing scams.
Another way to increase the effectiveness of your training is to make the information relevant to employees on a personal level. For example, a good way to get employees interested how to use company-owned mobile devices securely is to start by discussing how they can protect their personal smartphones (e.g., only use hotspots known to be safe and reliable). Once they learn good security habits in their personal lives, they will be more likely to practice them at work.
Finally, after employees have completed their training on a particular topic, you might consider testing what they have learned. For instance, after covering how to spot phishing emails, you could send out a fake phishing email with a suspicious link. If clicked, the link could lead to a safe web page that states the phishing email was an IT security training exercise. This type of testing can reinforce what employees have learned. It can also help determine the effectiveness of the training.
It is important to follow up with employees after the test, especially with the individuals who clicked the suspicious link. However, you should never embarrass or scold these employees during this discussion. Instead, you should offer them additional training and resources.
Your Employees Are an Important Part of Your Line of Defense
Educating employees about IT security is important. With training, they can bolster your line of defense against cyberattacks rather than be a weak link in it. To make this happen, you need to develop an effective IT training program that will teach your employees what they need to know to help keep your business secure. If you are uncertain of what to include, contact us. We can suggest topics based on your business’s IT environment.