What is Security Awareness Training?

Security awareness training (SAT) is an educational process that trains end-users on matters related to cybersecurity, computing best practices, and regulatory compliance. A complete program for security awareness training should teach end-users about an assortment of general IT, cyber-security, or other business-related topics.

These topics may include: avoiding phishing and other types of social engineering cyberattacks, spotting potential malware, reporting potential security concerns, following company best practices and policies, and maintaining any applicable compliance or data privacy regulations (HIPAA, PCI DSS, NIST, etc.)

Does a Business Need Security Awareness Training (SAT)?

“Phishing” email is essentially a form of social engineering whereby an email is sent that is intended to trick an employee into thinking the sender is a legitimate employee or vendor. The unscrupulous people involved in sending these mails are generally: seeking a payoff such as stealing user credentials for an important computer system, access to additional systems (ex. banking by taking credentials out of an email folder), or monetary gain. An example of a well-executed “phishing email attack” might be an email that looks exactly that of a user’s bank or other important online system. The emails (often employing fear related tactics) will try to incite a user to click on the included link (versus a vendor’s actual website) to provide their credentials.

If an end-user does happen to click the included links in one of these bogus emails and provides cyber-criminals with their logon credentials to an email or other important system; it is safe to assume that cyber-criminals will fully use this system, extracting or encrypting the data at a minimum.

Although some may feel their employees would not be fooled by phishing email or social engineering, we see it happen more frequently than would be thought. Not only do we see it in the real-world, but we can also see it in our testing. One aspect of our SAT program is that we can send fake “phishing” email campaigns and also track their effectiveness. We can see who has clicked on the links within a phishing email and assign brief cybersecurity training videos to these end-users to help get them up to speed.

Periodic training for end-users can include:

• Phishing email simulations to help proactively uncover “weak links”.
• Brief videos and other content on cyber-security, protecting business data, compliance training, and IT best practices.

“By taking these proactive steps to heighten employee understanding of modern cyber-security threats, business managers can help their teams: decrease system infections, reduce help desk and outage related costs, and further secure their overall business infrastructure.”