 may be, it makes the point. The staff of an organisation can be either a part of the problem or a part of the solution; when deciding whether or not to provide this training, an organisation is making this binary choice. It really is that simple.
The decision to provide cyber security awareness training seems straightforward then, and once made it is simply a matter of selecting the training required. There are various delivery methods available, and a number of key components from which to choose. Training methods are largely a matter of compatibility – it would be futile to attempt a classroom-based approach for an organisation of thousands of people dispersed around the globe, for example. Likewise a company of a couple of hundred staff in a single location may not consider an e-learning package a good fit for them. Hybrid solutions are common – perhaps e-learning for many, with tailored face-to-face packages for those deemed in the most at-risk roles such as finance or those who deal with PII or the most sensitive company data.
Perhaps more important than the method of delivery – they can all work well in the right environment – is the selection of areas to be covered. Training budgets are necessarily finite and organisations will always aim for the best return on their investment. To help with the decision-making I’ve detailed the areas I consider core:
Passwords. Call me predictable, but password security is fundamental and remains a key area of weakness. The internet works only through authentication – we have to prove who we are, remotely, every time we log on. The most common means of achieving this is still via a password; every user’s password should be sacrosanct – but very often it is not. All training should cover password security. It should teach how to choose, and crucially remember, secure passwords (for each account).
Phishing. Over 90% of attacks rely on this technique at some point in their lifecycle. Most people have heard of phishing and almost everyone can identify the very worst attempts at it – perhaps still the “Nigerian” 419 fraud (with apologies to Nigeria which is no more responsible for this phenomenon than anywhere else on earth). But good phishing emails succeed; how to identify, check and (crucially) what to do when you find such an email, is a none-negotiable component of good training. Trained staff get phished less often, period.
Social media. This is perhaps a little less predictable (but in my view barely less important). Social media is one of the attackers’ tools of choice. It is effectively their intelligence collection platform. Attackers research their targets and so design attacks which are much more likely to succeed, and they do this by using the information we choose to give them. The safe use of social media is (or should be) a fundamental part of good cyber security awareness training.
Digital footprint. Closely aligned to social media, this is about the information we leave behind. It’s overt – postings, musings, comments on others’ posts but it’s also sometimes much less obvious. For example, location services – where have you been, for how long and with whom? Data sharing, too; of the free Apps on your phone, how many are harvesting your data? Some, for sure – and you allowed it when you accepted (without reading) their terms. If the App is free, you are the commodity.
Safe browsing. The internet is such an integral part of our lives that we use it without a thought. But bad websites exist – by accident or design. Malware can be spread, otherwise safe websites spoofed, credentials (passwords and user names) harvested and used for fraud or sold. Good cyber awareness training should include the safe use of the internet.
Removeable media. This is also an area of weakness where simple training is effective. USBs and all removeable hardware can be an attack vector – and so how they are used either leads to or prevents attacks. The Stuxnet virus, for those still unsure, was delivered to the heart of the Iranian nuclear programme via an infected USB.
These are my core areas 