March 30, 2018 By Mike Elgan 3 min read

The conventional wisdom about security training needs an update — and for reasons that may surprise you.

Cyberattacks are rising in frequency, severity and the damage they cause. Since the weakest link in any networked chain is the user, employee training is a vital part of a comprehensive program that also requires world-class software and savvy policy.

You know all that, but there are other, less obvious reasons to invest in better training that even the most grizzled IT security veteran may not fully appreciate.

Surge of Insider Attacks Suggests Need for Better Security Education

The 2017 IBM X-Force Threat Intelligence Index report showed that a shocking number of incidents come from insiders, employees and other trusted people. Seventy-one percent of attacks against healthcare companies fall into this category, while 58 percent of incidents in financial services, the most-attacked sector, originate from insiders.

The majority of these insiders are inadvertent actors — mostly employees who were tricked into initiating the attacks. These numbers expose the inadequacy of today’s normal training programs. They’re not frequent, memorable or thorough enough. In other words, they’re not working.

The bottom line is that training has not kept up with the evolution of cyberthreats or their remedies. That’s why it’s more important than ever to implement the best possible tools to protect sensitive data. But decision-makers must remember that even the best software cannot stop all threats.

For example, any employee with access to any phone anywhere at any time is potentially vulnerable to social engineering. The reality of bring-your-own-device (BYOD) environments is that employees may be connecting to company resources at all hours and exposing their devices to threats in arbitrary locations and over insecure networks. That’s why great software and solid policies must be accompanied by more frequent and better training.

Five Reasons Why Improved Training Is Vital to Data Security

Of course, training exists to educate employees about threats. Don’t click on that suspicious email link. Don’t insert that thumb drive you found in the parking lot. Don’t keep your password on a note card stuck to your monitor.

But security training should be about far more than just teaching employees to avoid common errors. Below are five surprising reasons why training is vital.

1. Morale

Accelerating threats affect employees most directly by causing unwanted changes in how they work. Security rules implemented without follow-up can feel like an imposed burden. Good training makes employees feel like partners in these policy changes.

2. Speed to Remedy

Better training enables employees to more effectively spot and report suspicious activity. Confusion causes paralysis, but education promotes action. That means faster average resolution times and better institutional learning.

3. Self-Policing

Most threats come from the inside, not the outside. When employees know where threats come from, they’re in a better position help each other avoid unwitting participation in a breach — and to report deliberate participation.

4. Compliance

Rising security threats have ushered in a new era of regulation. That means decisions around security and privacy come with more regulatory and legal ramifications than ever before. It also makes everything more complicated. There’s simply more to learn now, and that demands more and better training. The burden of compliance can also change institutional thinking and lead to a harmful compliance-first mindset. Training helps employees comply with regulations without taking the focus off actual, practical security.

5. Informed Purchase Decision-Making

The most important internal group to train is also the hardest: C-level executives, managers and team leaders. One of the biggest institutional problems around security is the failure to invest in the best solutions. This is often a direct result top decision-makers’ lack of knowledge. Trainings that expose leaders to the risks of today’s increasingly damaging breaches — and the rewards of being ready for them — can be very effective.

It’s Time to Get Creative With Security Training

Cybercrime is being industrialized, automated and optimized using big data analytics and artificial intelligence (AI). Much of that AI is applied to the social engineering of employees. Annual go-through-the-motions training won’t cut it anymore. It’s time to be proactive and get creative.

Don’t think of training as something that happens only at scheduled sessions. It must be constant and continuous. For example, security leaders can create fake malware or phishing attacks. When employees click or open them, serve up a quick training on why they just made a huge error and what to do if this happens again. Security teams might also consider publishing a newsletter or internal podcast to raise security awareness throughout the organization.

As threats evolve and grow more complex and damaging, it’s imperative to rethink how the organization as a whole learns and grows. By educating employees about how cyberthreats affect them, their data and their jobs, IT leaders can make security personal and steer the organizational culture toward security consciousness.

Listen to the podcast series: Take back control of your cybersecurity now

More from CISO

Overheard at RSA Conference 2024: Top trends cybersecurity experts are talking about

4 min read - At a brunch roundtable, one of the many informal events held during the RSA Conference 2024 (RSAC), the conversation turned to the most popular trends and themes at this year’s events. There was no disagreement in what people presenting sessions or companies on the Expo show floor were talking about: RSAC 2024 is all about artificial intelligence (or as one CISO said, “It’s not RSAC; it’s RSAI”). The chatter around AI shouldn’t have been a surprise to anyone who attended…

Why security orchestration, automation and response (SOAR) is fundamental to a security platform

3 min read - Security teams today are facing increased challenges due to the remote and hybrid workforce expansion in the wake of COVID-19. Teams that were already struggling with too many tools and too much data are finding it even more difficult to collaborate and communicate as employees have moved to a virtual security operations center (SOC) model while addressing an increasing number of threats.  Disconnected teams accelerate the need for an open and connected platform approach to security . Adopting this type of…

The evolution of a CISO: How the role has changed

3 min read - In many organizations, the Chief Information Security Officer (CISO) focuses mainly — and sometimes exclusively — on cybersecurity. However, with today’s sophisticated threats and evolving threat landscape, businesses are shifting many roles’ responsibilities, and expanding the CISO’s role is at the forefront of those changes. According to Gartner, regulatory pressure and attack surface expansion will result in 45% of CISOs’ remits expanding beyond cybersecurity by 2027.With the scope of a CISO’s responsibilities changing so quickly, how will the role adapt…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today