Security awareness training works

9 of 10 security breaches are caused by human error. Our own mistakes. Even so, most companies have not developed an adequate security awareness training program to teach their team to avoid common pitfalls that lead to breaches. The fact is, people often cut corners and skip key security steps simply because they prioritise efficiency and speed over security. And they may develop poor security habits in general because they do not fully grasp the potential consequences of their carelessness. This blog is about how you can conduct awareness training in order to avoid data breaches.

A little training can help. Research by Cyberpilot found that after continuous security awareness training and phishing testing, users had a 50% reduction in mistakes made during a simulated phishing attack.

It’s clear that when people are aware of privacy risks and the dangers that cybercriminals pose, they are more careful. Security awareness training works, and your company needs it.

But what should your security awareness training consist of? What topics should you cover, and how often? Let’s take a look at some security awareness training basics.

A good security awareness program should help you develop a privacy and security-first culture. It should motivate your people to protect your company’s systems, your customers, each other —and everyone’s data. In practice, it should train your team to:

1. Care about people’s privacy
2. Recognise security threats
3. Understand the stakes involved
4. Take action to minimise risk

It should include your whole organisation from top to bottom, be continuous and engaging, and make use of a variety of topics and quality educational materials. Here are some examples of clever security awareness posters from Cyberpilot:

Here are some of the topics we suggest you cover in your security and awareness training program:

1. Password selection and management
2. Recognising personal data
3. Phishing variations and how to spot them
4. Understanding Privacy Rights
5. GDPR principles and compliance
6. Caring for sensitive data
7. How to practice data minimisation
8. Email security mistakes
9. Using shared wifi and VPNs
10. Software updates and security
11. Keeping work devices safe
12. Remote workplace security

If you were to focus on just one of these topics each month, this would be enough information to keep your privacy and security awareness training going for a whole year! Some companies schedule a security awareness day and try to hit as many of these topics if possible. This can become quite a grueling day. If you cover too much information at once, it will be difficult for people to concentrate and remember what they’ve learned. And it will be almost impossible for you to track and measure improvements.

Each of the topics mentioned above is too important to cram them all together into one long, dull seminar. Rather, we suggest a program that schedules very brief, but regular sessions based on each of these topics. The emphasis should be on helping people see their importance, the stakes involved, and then how to improve their practices.

Let’s look at some simple outlines for a few topics to get you started.

Make sure you set up clear GDPR policies your team can follow and stick with them. Tell who they can reach out to if they have questions about GDPR rules and personal information.

GDPR awareness training should let your people know:

1. Who to go to with GDPR questions
2. What your process is for DSARs
3. Who to report to in case of a data breach
4. What we can learn from GDPR principles
5. How GDPR fines are calculated and how to reduce risk and liability

An awareness training session on password management can include information on:

1. Common and weak passwords and password patterns to avoid
2. How hackers exploit weak passwords
3. How to create strong, unique passwords and remember them
4. When to change passwords

An awareness training session on password management can include:

1. Phishing examples and variations
2. How to recognise a phishing email
3. Phishing simulations

Personal data awareness training sessions can include:

1. How to spot personal data
2. How to spot sensitive data
3. How to view people’s personal data
4. How long to keep personal data

For most of us, using our own time to plan, design and implement an engaging security awareness program isn’t practical. Not only would it be too time-consuming to create your own educational materials and resources, but you would also have to do a ton of research to update your information regularly, as security threats are constantly changing.

For this reason, some companies choose to send a few of their employees to a security awareness seminar, hoping they will absorb the information and educate the rest of the team.

This isn’t very effective, for a couple of reasons.

1. As mentioned above, regular continuous education has been shown to be superior to trying to pack everything into one day.
2. Getting everyone involved gets better results than counting on just a few people to pass on what they manage to remember from a quick, intensive seminar.

The goal should be to create a company-wide culture of security and privacy. This means everyone should participate. The frequency and style of your security awareness training should make security and privacy the default for your organisation.

Signing your company up for an online security awareness course can be the best and most cost-effective way to make continuous security awareness training a reality. Cyberpilot has created a complete series of e-learning courses + phishing simulations that make security awareness training simple. The courses are filled with videos and infographics to help people understand and remember the material. Users see their progress as they move through each course, and get a test at the end. When organising an awareness course, Cyberpilot recommends 3 things:

1. Make it personal
2. Make it brief and clear
3. Make it easy to remember

If the content of your awareness training program meets these three requirements, it will stick with your team and truly shape the way they handle security and privacy. Simple, right But making your training program truly continuous and consistent is still more of a challenge.

Need some help? Try Cyberpilot →