The Coronavirus pandemic has led to a renewed focus on cyber awareness training as organisations look at ways to reduce risk and educate staff on evolving threats.
Within the last year, there has been a 715% increase in ransomware attacks, a 600% increase in phishing attacks, and a 200% increase in Business Email Compromise (BEC) scams.
These sobering statistics highlight the ongoing and relentless threats that organisations face, and perhaps more worrying, is that 90% of all cyber attacks are caused by human error.
Going after the ‘human element’ has become the easiest way to target an organisation and gain access to valuable company data. Cybercriminals are continually changing their tactics and using sophisticated social engineering techniques to infiltrate corporate networks.
When it comes to cyber security, your employees really are your first line of defence against cybercrime. Instilling good cyber security habits in your staff is the best way to defend against attacks and avoid becoming the latest company to be splashed across the news.
Top tips to get new hires on board with cyber awareness training
1. Cyber awareness training should start on day 1
To ensure that your staff understand the importance of cyber security in the workplace, it’s vital that cyber awareness training starts on day one. Developing a culture of cyber security takes time, but if the correct behaviour is ingrained in your employees from the get-go, they will act responsibly and gain a better understanding of how their actions contribute to the overall security of the company.
2. Make the training relevant
For cyber awareness training to resonate with staff, it needs to be specific to your organisation. Different organisations face different threats, so awareness training needs to reflect the real-world threats your staff face on a day to day basis. This could be anything from phishing emails to targeted Business Email Compromise (BEC) scams.
3. Get buy-in from senior management
If staff are to take cyber threats seriously, an organisation’s senior management team must take ownership of cyber security and put in place the correct procedures and training that addresses all risks. The tone set from the top will ultimately be the driving force in creating a culture of enhanced cyber security awareness.
4. Educate your employees on the high cost of a data breach
Many employees are simply unaware of the devastating consequences that a data breach could have on their organisation. Whether it’s a drop-in share price, damage to reputation, loss of customers or fines, employees need to understand the real-world impact a security breach could have and how it could directly affect your business. Educating staff on the risks is key in creating a shared sense of responsibility for the sensitive data they work with.
5. Regular cyber awareness training
Training employees once a year on cyber security is simply not enough to equip them to deal with the onslaught of evolving threats. The traditional tick box approach to cyber security no longer cuts it in an era where organisations are continually under attack. Cybercriminals are becoming more devious in their attack methods so employees need to receive regular cyber awareness training to help them recognise and respond appropriately to the latest threats.
6. Test employee awareness
Security awareness can only be achieved through education so to accurately evaluate your employee’s understanding of the training, it’s important to test their knowledge and skills. Phishing simulations help organisations determine just how susceptible their company is to fraudulent phishing emails and identify staff that require additional training. Controlled simulation tests will help employees recognise, avoid, and report potential threats that could threaten the security of your organisation.
7. Promote incident reporting
As your employees become more cyber aware and gain a better understanding of the threat landscape, they should be encouraged to report any potential security incidents to senior management. This could be a phishing email, suspicious online activity, or even an unauthorised person in the workplace.
8. Stress importance of cyber security at work and home
The key to good cyber security in the workplace is teaching employees how to adopt these practices when they’re at home, outside the safe perimeters of the company’s security defences. Most social engineering scams are multi-pronged, and attackers may spend weeks researching their victims on social media before trying to gain access to company networks. If staff can learn the importance of good cyber habits at home, these behaviours will translate into the workplace.
