 at it – perhaps still the “Nigerian” 419 fraud (with apologies to Nigeria which is no more responsible for this phenomenon than anywhere else on earth). But good phishing emails succeed; how to identify, check and (crucially) what to do when you find such an email, is a none-negotiable component of good training. Trained staff get phished less often, period.
Social media. This is perhaps a little less predictable (but in my view barely less important). Social media is one of the attackers’ tools of choice. It is effectively their intelligence collection platform. Attackers research their targets and so design attacks which are much more likely to succeed, and they do this by using the information we choose to give them. The safe use of social media is (or should be) a fundamental part of good cyber security awareness training.
Digital footprint. Closely aligned to social media, this is about the information we leave behind. It’s overt – postings, musings, comments on others’ posts but it’s also sometimes much less obvious. For example, location services – where have you been, for how long and with whom? Data sharing, too; of the free Apps on your phone, how many are harvesting your data? Some, for sure – and you allowed it when you accepted (without reading) their terms. If the App is free, you are the commodity.
Safe browsing. The internet is such an integral part of our lives that we use it without a thought. But bad websites exist – by accident or design. Malware can be spread, otherwise safe websites spoofed, credentials (passwords and user names) harvested and used for fraud or sold. Good cyber awareness training should include the safe use of the internet.
Removeable media. This is also an area of weakness where simple training is effective. USBs and all removeable hardware can be an attack vector – and so how they are used either leads to or prevents attacks. The Stuxnet virus, for those still unsure, was delivered to the heart of the Iranian nuclear programme via an infected USB.
These are my core areas for good cyber security awareness training. Ideally the training should be iterative – it’s not a course on day two of induction and the problem is solved. People need on-going engagement and commitment. A basic course should be backed up by refresher sessions (perhaps phishing campaigns where the staff of an organisation are safely phished by their training provider) and on-going reminders of important issues (possibly through poster campaigns or similar).
Good cyber security awareness training doesn’t only teach, it creates a security culture. And, as I’ve said already, companies that invest in training and develop such a culture, suffer fewer and less damaging cyber-attacks.