Importance of Security Awareness Second Nature

7 Ways to make Security Awareness Second Nature

Russell Harris

How do you make security awareness second nature?  To answer this question, we need to consider the weakest link, the human factor.  Based on statistical data, these stats jump out from today’s threat landscape:

  • Human errors cause 23 percent of data breaches1.
  • Over 35 percent of employees do now know about ransomware2.
  • Nearly 25 percent of employees have clicked on malicious links without confirming their legitimacy3.

The aim of developing a security-focused culture is to nurture positive security habits among employees.  For example, the simple habit of locking one’s computer screen when leaving the workstation unattended can prevent data from being accessed by unauthorized users.

Start building cybersecurity awareness through training and educational programs from within your organization.  Before we dive into 7 ways to make security awareness second nature.

Why Security Awareness

The bottom-line a security-focused culture can save your business.  Your employees can stop an incident before it becomes a tragic event.

As I am writing this, the Mann Gulch fire in August of 1949 comes to mind.  The National Forest Services began sending smoke jumpers out to fight forest fires in the early 1940s.  If the fire can be put out while small, it becomes a nonevent.  However, a string of events happened that day and ended up with 13 young men losing their lives.

The National Forest Service realized better training programs were needed so young men as smoke jumpers knew what to do in a split second time.  With a forest fire raging, time does matter and many times you do not have minutes but only seconds.

A cybersecurity incident can be much like a forest fire.  Catch it early and no one even knows about it.  Catch it late and a tragedy will unfold leaving articles written and people wondering what went wrong.

How to make Security Awareness Second Nature

If you intend to develop a security-focused culture, implementing robust security awareness training is crucial.  Here are 7 ways that can help you effectively implement security training:

#1 – Make Training Sessions Interactive

Engagement is the key to helping employees retain the knowledge being taught.  Some helpful advice consists of:

  • Deliver training in high-quality video format to grab attention.
  • Add text content only as a complementary piece to the video.
  • Ensure that the presentation is appealing to your employees so that they do not miss out on important details.
  • Offer face-to-face discussions or virtual conversations with subject matter experts.

#2 – Discuss Emotional Self-awareness

In the year of 2020, I believe we’ve become more aware of our self-awareness.  Stress and anxiety do play a role in day to day activities.  Help employees know:

  • When to slow down and be more aware.
  • How to handle stress.
  • How to handle anxiety.

#3 – Use Smaller Modules

Since the attention span of your employees will almost certainly vary from one to another, breaking training sessions into smaller modules will help them retain information faster as a whole.  Also, smaller modules add the following benefits:

  • You can regularly send training modules to your employees to ensure they are up to speed on the latest security topics.
  • Smaller units have a better chance of retention than lengthy pieces of content.
  • Smaller modules are easier to find and reference when needed.

#4 – Facilitate Self-Paced Learning

  • Give your employees the freedom to learn at their convenience.  This, of course, does not mean deadlines should not be set either.
  • Make sure you give your employees sufficient time to complete each training module based on its complexity.

#5 – Include Relevant Material

Training material needs to be kept current due to the increase in cybersecurity threats.  So a few things to think about:

  • Training content should be reviewed every 6 months and updated as needed.
  • Make the training content more about the business and less technical.
  • Show and tell in an easy-to-understand manner how security threats effect daily work scenarios.

#6 – How to Communication

Do not take communication for granted.  Here are a few tips to include in your training modules:

  • Discuss and teach what should be communicated.
  • Discuss and teach when cybersecurity incidents should be communicated.
  • Then finally discuss where or to who incidents should be communicated.

#7 – Conduct Reviews with Quizzes and Mock Drills

As a business owner, you really want to know the health of employee response.  These tips will help provide some insight:

  • Use short quizzes based on content taught and communicated.
  • Execute mock drills to walk through real world scenarios.
  • Assess the alertness to a simulated scam.
Identify Function - Risk Management
Identify Function – Risk Management

Next Steps

This really does provide a big return on investment.  Creating or building a quality security awareness training course for your business doesn’t cost to much.  The benefits to building a security culture just might save your business.

One final thought, while on this topic, take the time to check out Insider Cybersecurity Defense.  Another topic to integrate into your security awareness training.

 

Article curated and used by permission.

Sources:

  1. IBM 2020 Cost of Data Break Report
  2. Opinion Matters Survey
  3. Help Net Security Magazine