What is Security Awareness Training?

Introduction

The biggest vulnerability that most businesses face is the human element. Humans are not machines, and that’s a good thing. We, as a species, are many things that machines are not—compassionate, caring, understanding, and loving. Unfortunately, these are also reasons that cyberattacks are successful at times. However, with security awareness training, these can be circumvented for the most part.

Because the human element is the biggest vulnerability, continuous training is necessary to keep employees aware of all the scams, social engineering, and hacks that are circulating the Internet and networks. Bad actors are trying to take advantage of our emotions and understanding, aiming to get an employee to click on a link, install a file, get account information, and more.

The Human Element

Many cybersecurity incidents happen because a human was involved. It is said that around 70% of these are because someone allowed access to an account or network through some sort of social engineering attack. There are many steps that a bad actor will take in order to get to an employee of a targeted organization, but everything starts with reconnaissance.

These bad actors will scour the Internet for information on the organization, its employees, and many other factors. Because we are a social species, much of our information can be found on the Internet, through social media, forum boards, and even shopping networks. The more information a person puts out on the Internet, the more that a bad actor will be able to find.

This is something we can’t stop, exactly. It’s always a good idea to separate your work life from your personal life, but that’s not always possible. This is especially true for people who do public appearances like interviews or speaking at events. It’s always a good idea to be aware of what we put out for the public to see—including our own organizations. For example, many banks and credit unions put emails and phone numbers to get into contact with employees, but this is easily exploitable by bad actors.

The AI Element

While it may not have been an issue before, artificial intelligence, or AI, has proven to make social engineering even more difficult to distinguish from a real person. It is advancing at a rapid pace, and with the generative AI impersonations popping up, it is a frightening thought to have your likeness stolen by bad actors. They have been able to replicate not only voices, but faces as well.

With these advancements, phishing, vishing, and smishing are all much more dubious. A phishing email or smishing text can be put through genAI to look more professional, with less spelling errors and better grammar. Vishing calls can be done with an AI voice, impersonating a customer or even a high-ranking employee, especially if they do interviews and public appearances.

However, with proper security awareness training, the vulnerabilities of the human element and the AI element can be avoided. It should be included in every organization’s cybersecurity roadmap, and it should be done multiple times a year. It’s never a bad idea to put time and effort in to make sure that employees are aware of the latest threats and vulnerabilities.

Effective Security Awareness Training

When it comes to Security Awareness Training programs, there are quite a few options to employ. Most of the items in these roadmaps should include simulations, real-world tactics, and even lectures. Some examples are:

Simulated Phishing

While phishing emails are relatively easy to compose, it’s a real tactic that many bad actors use that results in many successful attacks. All it takes is a plea or call to action for someone to click a link. At that point, it may be too late. Phishing emails are some of the most common methods of social engineering attacks—they’re easy to create, fast to send, and can sometimes get through spam filters.

A simulated phishing attack is done by a third-party cybersecurity firm who sends out many messages to employee emails. These emails may or may not have research attached to them, considering the depth of the service, but it will likely contain some sort of enticing information about income processing, gift cards, or some other benefits. If an employee clicks on one of these links, they will likely be informed that it was a simulated phishing email, leading to possible training.

Simulated Vishing

Everyone is familiar with the calls about your car’s extended warranty. That sort of call is almost always a vishing call, trying to take your information. Simulated vishing is done by the third-party security firm, attempting to do the same. However, some of these firms use pre-recorded messages or artificial intelligence calls, making it a bit obvious when it happens. A proper experience would have real, live people on the other end.

While AI calls are becoming more advanced, it is still somewhat obvious whenever it is used. However, it can still be effective, especially if it’s used in combination with a real person. A person can call in and impersonate anyone, including a customer, an employee, or some sort of contractor like building maintenance or electricians.

These, used in part with gathering public-facing information, can be a dangerous combination. It’s important to lower your attack surface, meaning that you should take away as many points as you can so a bad actor can’t use it against you. Either way, you should always get detailed information on who is calling or contacting you over the phone, never assuming they are who they say they are.

Lectures

While it may seem like something specifically for the classroom, it is important to have company-wide training sessions that include a speaker and examples. Think of a webinar or something similar—it is an informational seminar where a designated speaker can go over the latest methods that bad actors are using. Some effective subjects to remind employees about are:

• Social engineering—this is one of the most-used methods used by bad actors, as stated above, with phishing, smishing, and vishing. However, it can go deeper, like on-site social engineering like physical visits from people who are trying to get into your establishment.
• Password strength—an important factor for any employee, passwords are used by many parts of a network. It’s easy for people to forget how a varied password can prevent many issues.
• Insider threats—external attacks are important to consider, but there is also the threat of bad actors who are already inside of the organization. Rogue employees are a growing trend through many businesses and can cause more damage than an external attack.
• Device security—almost everyone uses a mobile phone, laptop, or tablet in their daily lives, so it’s important to remember that these devices can also be hacked or taken over by bad actors.
• Incident response and recovery—going hand-in-hand with tabletop testing, response and recovery to disasters, be it natural or man-made. Malware and ransomware can cause a lot of problems, so it’s a good idea to have a procedure in place for these situations.
• Physical security—another subject that employees often overlook is their workplace. Bad actors often try to get to places they aren’t supposed to be where they can take pictures and documents that could have sensitive information on it.
• Desk cleanliness—in tandem with physical security, it’s important to keep a clean workspace, especially if the organization uses webcam and video meetings. Any small sticky note in the background can leak sensitive information if an employee isn’t careful.

On-Site Social Engineering

While it is more expensive than most other services, on-site social engineering is a great way to see how employees might react to a potential impersonator who is trying to get into the organization. It’s a good way to see who is following visitor policies and who may need more training. Some third-party cybersecurity firms will dress up as a contractor or some external employee to get into employee-only areas.

With this method, it is easy to find out who might be lax in allowing unknown parties go through the company’s physical building. If they get in, they will try to separate from their potential escort, where they can easily take pictures or collect documents. Nonetheless, it’s always important to establish escort policies through the organization.

Conclusion

Security awareness training is a necessary part of any organization’s cybersecurity posture. It can help lower the risk of the most vulnerable aspect of any company: the human element. Every company should have human employees, but they are the easiest aspect to get a cyberattack through. Social engineering can be very effective against an unaware employee.

This is why security awareness training is crucial. With constant simulated attacks from an information security firm, it can keep employees on their toes to make sure they don’t click on strange links or keep unknown persons from entering their establishment. The more security aware the employees are, the less likely an organization will fall to an attack.