Despite the major budgets companies invest in security training, phishing remains one of the top cyber threats modern enterprises face. While increasing attack sophistication is one reason for this phenomenon, a lack of relevance in security training models is also to blame.
Typically, cybersecurity training programs are a mix of seminars hosted by security teams and tedious workshops that employees view as necessary hurdles.
Clearly, the situation calls for a fresh approach to phishing training, as too many older programs are simply not effective at helping people realize the magnitude of the threat their organizations face.
Here are some proven ways to revamp your company’s phishing training program and give it a second wind.
1. Build Security Awareness Check-ins
Repetition is one of the best ways to re-enforce new behavior. While changing employee behavior in suspicious situations is many a program’s stated goal, few achieve it. The reason is a lack of habit.
Whether it’s refreshing knowledge or performing the necessary tasks repeatedly, cybersecurity training that fails to reinforce proper behavior ultimately leads to phishing’s sustained presence as a top threat.
Weekly newsletters are an easy way to remind employees of the importance of security awareness and the threats they face in their inboxes. While a newsletter will not change employee behavior, its mere presence will serve as a reminder to employees to remain vigilant.
Incorporating automated quizzes and skill scoring every week or quarter is another way security teams can ensure employees exercise their skills.
For instance, training teams can send quizzes on a predetermined schedule to employees and monitor skill progression. If a team or employee struggles to make progress, training teams can zero in on specific issues and customize lessons.
Offering analysis after major security events is also a great way to build employee awareness regarding current threats. These reports can spotlight external or internal events, giving employees a quick summary of the latest attack trends and how they can secure themselves.
Lastly, offering a wiki of external security resources is a great way to build a security-oriented culture in an organization. For instance, employees can use websites such as haveibeenpwned to check if any of their accounts are compromised.
2. Simulate Threats
Most enterprise employees first encounter phishing attacks once an email lands in their inbox. Allowing employees to exercise their skills through simulated attacks is a great way to build their confidence in dealing with stressful security situations.
In essence, it’s too common that employees receive a few lessons and are immediately thrust into action. They never get the chance to put their lessons into practice in a controlled environment.
Simulated security training platforms that replicate common phishing and malware attacks are the solution.
These platforms can even introduce an element of gamification in training, boosting engagement and reorienting how employees view these programs.
For instance, companies can craft engaging threat scenarios on a platform instead of delivering the same information via a boring seminar slideshow.
People learn through doing, for the most part, and a simulated environment helps employees walk through realistic security scenarios, at times when they might not expect them – just like the real thing. Add automated feedback loops that correct errors, scorecards, and prizes, and you have a full-fledged gamified platform.
Not only will your employees exercise their skills, but they’ll also have fun achieving and competing. The result is a renewed focus on security instead of viewing it as a tedious organizational appendage.
3. Customize Lessons
Customization is everywhere in our world. Consumer apps gather data to deliver highly personalized experiences. Yet, security training is stuck in a one-size-fits-all world that fails to engage employees.
Modern companies have complex workforce arrangements, from fully remote to international employees. A single boilerplate training program cannot hope to account for varying technical skill sets and job situations.
For instance, a part-time employee in a division’s IT team is unlikely to engage with a security presentation, beyond the bare minimum.
Gamification, as discussed in the previous section of this article, solves this issue significantly. Another benefit gamification brings is giving security trainers data.
These metrics provide security teams with insights into organization-wide skill levels and allow them to customize and segment learning paths.
For example, a developer might need a different training path compared to a sales representative. The systems each employee uses and the scenarios they face are extremely different.
By hosting security training on a centralized platform, companies can use data to create responsive learning paths.
The sales executive can receive basic lessons on cybersecurity terms and the ways malicious actors target employee credentials.
The developer can receive more technically-heavy lessons regarding secret sprawl and the importance of following a Zero Trust security philosophy.
Companies can further customize these programs by viewing employee performance within simulated tasks and giving them feedback regarding what subjects to focus on.
The result is a security training program that adapts itself to deliver effective results. Complete it with other types of training programmes, like anti corruption training and anti bribery training.
Phishing Training Needs a Revamp
Phishing is one of the oldest ways of compromising a company’s security. Despite its significant history and several awareness programs dedicated to eradicating it, phishing remains a significant threat.
Revamping security training programs offers a great solution to this problem, giving companies the robust security posture they seek.
