Skip to main content

The need for security awareness training

9 of 10 security breaches are caused by human error. Our own mistakes. Even so, most companies have not developed an adequate security awareness training program to teach their team to avoid common pitfalls that lead to breaches. The fact is, people often cut corners and skip key security steps simply because they prioritise efficiency and speed over security. And they may develop poor security habits in general because they do not fully grasp the potential consequences of their carelessness. This blog is about how you can conduct awareness training in order to avoid data breaches.

Security awareness training works

A little training can help. Research by Cyberpilot found that after continuous security awareness training and phishing testing, users had a 50% reduction in mistakes made during a simulated phishing attack.

It’s clear that when people are aware of privacy risks and the dangers that cybercriminals pose, they are more careful. Security awareness training works, and your company needs it.

But what should your security awareness training consist of? What topics should you cover, and how often? Let’s take a look at some security awareness training basics.

Did you know that rapid response to data breaches can minimise long-term damages and costs associated with customer churn and lost trust?

What is security awareness training?

A good security awareness program should help you develop a privacy and security-first culture. It should motivate your people to protect your company’s systems, your customers, each other —and everyone’s data. In practice, it should train your team to:

  1. Care about people’s privacy
  2. Recognise security threats
  3. Understand the stakes involved
  4. Take action to minimise risk

It should include your whole organisation from top to bottom, be continuous and engaging, and make use of a variety of topics and quality educational materials. Here are some examples of clever security awareness posters from Cyberpilot:

Required data protection training

Under Article 43, the GDPR requires you to provide “the appropriate data protection training to personnel having permanent or regular access to personal data.”

It does not give specifics on how you should train personnel, how often, or list the topics that you should cover. Each company should choose or set up an “appropriate” training program.

Notice that training is required for personnel having “permanent or regular access to personal data”. The broad definition of personal data under GDPR makes this apply to most of your staff. But not everyone’s access to personal data is or should be the same. Doing a data inventory can help you figure out who has access to what and tailor your training program appropriately.

Start your GDPR cleanup where it is needed the most

Sensitive data can tends to accumulate in the employees' e-mails. With a GDPR Risk Scan from DataMapper, you get a report that shows any potential GDPR risks in the company's e-mails.

Topics for security awareness training

Here are some of the topics we suggest you cover in your security and awareness training program:

  1. Password selection and management
  2. Recognising personal data
  3. Phishing variations and how to spot them
  4. Understanding Privacy Rights
  5. GDPR principles and compliance
  6. Caring for sensitive data
  7. How to practice data minimisation
  8. Email security mistakes
  9. Using shared wifi and VPNs
  10. Software updates and security
  11. Keeping work devices safe
  12. Remote workplace security

If you were to focus on just one of these topics each month, this would be enough information to keep your privacy and security awareness training going for a whole year! Some companies schedule a security awareness day and try to hit as many of these topics if possible. This can become quite a grueling day. If you cover too much information at once, it will be difficult for people to concentrate and remember what they’ve learned. And it will be almost impossible for you to track and measure improvements.

Security awareness program

How to set up your security awareness program

Each of the topics mentioned above is too important to cram them all together into one long, dull seminar. Rather, we suggest a program that schedules very brief, but regular sessions based on each of these topics. The emphasis should be on helping people see their importance, the stakes involved, and then how to improve their practices.

Let’s look at some simple outlines for a few topics to get you started.

Get our Newsletter!

In our newsletter you get tips and tricks for dealing with privacy management from our founder Sebastian Allerelli.

When you sign up for our newsletter you get a license for one user to ShareSimple, which will give you a secure email in Outlook. This special offer is for new customers only, with a limit of one freebie per company.

Security awareness training for GDPR compliance

Make sure you set up clear GDPR policies your team can follow and stick with them. Tell who they can reach out to if they have questions about GDPR rules and personal information.

GDPR awareness training should let your people know:

  1. Who to go to with GDPR questions
  2. What your process is for DSARs
  3. Who to report to in case of a data breach
  4. What we can learn from GDPR principles
  5. How GDPR fines are calculated and how to reduce risk and liability

Password management training

An awareness training session on password management can include information on:

  1. Common and weak passwords and password patterns to avoid
  2. How hackers exploit weak passwords
  3. How to create strong, unique passwords and remember them
  4. When to change passwords

Phishing awareness training

An awareness training session on password management can include:

  1. Phishing examples and variations
  2. How to recognise a phishing email
  3. Phishing simulations

Personal data awareness training

Personal data awareness training sessions can include:

  1. How to spot personal data
  2. How to spot sensitive data
  3. How to view people’s personal data
  4. How long to keep personal data

Outsourcing security awareness training

For most of us, using our own time to plan, design and implement an engaging security awareness program isn’t practical. Not only would it be too time-consuming to create your own educational materials and resources, but you would also have to do a ton of research to update your information regularly, as security threats are constantly changing.

For this reason, some companies choose to send a few of their employees to a security awareness seminar, hoping they will absorb the information and educate the rest of the team.

This isn’t very effective, for a couple of reasons.

  1. As mentioned above, regular continuous education has been shown to be superior to trying to pack everything into one day.
  2. Getting everyone involved gets better results than counting on just a few people to pass on what they manage to remember from a quick, intensive seminar.

The goal should be to create a company-wide culture of security and privacy. This means everyone should participate. The frequency and style of your security awareness training should make security and privacy the default for your organisation.

The benefits of online security awareness training

Signing your company up for an online security awareness course can be the best and most cost-effective way to make continuous security awareness training a reality. Cyberpilot has created a complete series of e-learning courses + phishing simulations that make security awareness training simple. The courses are filled with videos and infographics to help people understand and remember the material. Users see their progress as they move through each course, and get a test at the end. When organising an awareness course, Cyberpilot recommends 3 things:

  1. Make it personal
  2. Make it brief and clear
  3. Make it easy to remember

If the content of your awareness training program meets these three requirements, it will stick with your team and truly shape the way they handle security and privacy. Simple, right But making your training program truly continuous and consistent is still more of a challenge.

Need some help? Try Cyberpilot →

Sebastian Allerelli
Founder & COO at Safe Online
Governance, Risk & Compliance Specialist
Follow me on LinkedIn to get tips on GDPR →

GUIDE

How to handle sensitive personal data

GUIDE

How to find personal data with datamapping tool

GUIDE

How to prepare for a data audit