Trustwave SpiderLabs Uncovers Unique Cybersecurity Risks in Today's Tech Landscape. Learn More

Trustwave SpiderLabs Uncovers Unique Cybersecurity Risks in Today's Tech Landscape. Learn More

Services
Capture
Managed Detection & Response

Eliminate active threats with 24/7 threat detection, investigation, and response.

twi-managed-portal-color
Co-Managed SOC (SIEM)

Maximize your SIEM investment, stop alert fatigue, and enhance your team with hybrid security operations support.

twi-briefcase-color-svg
Advisory & Diagnostics

Advance your cybersecurity program and get expert guidance where you need it most.

tw-laptop-data
Penetration Testing

Test your physical locations and IT infrastructure to shore up weaknesses before exploitation.

twi-database-color-svg
Database Security

Prevent unauthorized access and exceed compliance requirements.

twi-email-color-svg
Email Security

Stop email threats others miss and secure your organization against the #1 ransomware attack vector.

tw-officer
Digital Forensics & Incident Response

Prepare for the inevitable with 24/7 global breach response in-region and available on-site.

tw-network
Firewall & Technology Management

Mitigate risk of a cyberattack with 24/7 incident and health monitoring and the latest threat intelligence.

Solutions
BY TOPIC
Microsoft Exchange Server Attacks
Stay protected against emerging threats
Rapidly Secure New Environments
Security for rapid response situations
Securing the Cloud
Safely navigate and stay protected
Securing the IoT Landscape
Test, monitor and secure network objects
Why Trustwave
About Us
Awards and Accolades
Trustwave SpiderLabs Team
Trustwave Fusion Security Operations Platform
Trustwave Security Colony
Partners
Technology Alliance Partners
Key alliances who align and support our ecosystem of security offerings
Trustwave PartnerOne Program
Join forces with Trustwave to protect against the most advance cybersecurity threats

9 Ways to Create a Security Awareness Program People Won’t Hate

It's become one of the great debates within information security: Do information security awareness programs actually work? The naysayers believe training workers to be more security conscious is tantamount to throwing away money because users neither are incentivized enough to care, nor advanced enough to recognize today's sophisticated attacks. Not to mention, it only takes one foolhardy employee to spawn a potential compromise (or none if they surf upon a drive-by-download website).

On the other hand, supporters argue that a majority of security incidents can be traced back to a single employee, thus making workers an organization's weakest link. Awareness training is a reliable way to stymie the insider threat and alter user behaviors. It's not a silver bullet, but it will help reduce organizational risk, which - after all - should always be the goal of security defenses.

No matter which side your allegiance lies with, the reality is that most regulations and requirements mandate that you implement a security education program. Thus, it's in your best interest to make the most of it. That starts with thinking of it less as a compliance checkbox exercise and more as a pathway to improved security and reduced risk.

But creating something that sticks is tough. In honor of National Cybersecurity Awareness Month in the United States, we prepared a list of recommendations to help you erect a program that employees will embrace and lead to improved security outcomes.

Establish advocates and achieve buy-in

You should start by gaining support for your initiative and developing key objectives. That starts with the very top, of course, but it will really materialize when you assemble a steering committee consisting of champions from various departments. Be sure to include your company's marketing and communication professionals, who can help craft clear messaging.

Narrow your focus

There are scores of security topics you can cover in your program, but people can retain only so much knowledge. Instead, identify themes that matter most to your organization and will result in the greatest reduction of risk - keeping in mind that different departments face different risks. Companies like Trustwave can help customize training materials for specific needs.

Connect to real-life attacks

Breaches and other security headlines are an everyday occurrence, so there are certainly enough concrete examples you can use to add legitimacy to your security awareness education efforts. Some companies even show live attacks happening on their networks to further hammer home the message.

Make it about them

Many of the topics you will be addressing will be things employees are also familiar with when they're off the clock, such as using passwords, mobile devices and social media sites. If they feel they can apply what they learn at the office to their personal life, they'll be less likely to tune the message out.

Execute mock attacks to establish effectiveness

A generally perceived strike against awareness programs is that organizations struggle to quantify how successful they are. One way to overcome this is by staging simulated social engineering attacks (penetration tests) to assess whether the number of employees falling for them is dropping. If you go this route, communicate your plans prior - but far enough out that it's still a surprise - or risk an employee base that feels violated.

Raise their emotional commitment

In general, workers want to do what is right for the company, yet often don't consider the problems that can result from their security transgressions. Demonstrate for employees how poor security practices can lead to harm to the company and clearly articulate the level of risk their actions carry.

Be flexible

Certain audiences, such as senior executives and help-desk staffers, may not feel they are in need of training, so it's important to customize your message for different groups.

Reward the top dogs

Incentives help encourage behavior changes, and some companies have turned to using gamification to make security awareness education more compelling. For example, you may award points (and prizes) to employees who flag a phishing message, while developers may compete over who can locate the most security vulnerabilities. On the flip side, employees who regularly engage in unsafe computing behavior need to hear about it too.

Reinforce the message

Most experts agree than training courses won't have much effect if they are only conducted once a year. It's important not to overdo it, but reinforcement of key points is important and that can be accomplished through refresher sessions, as well as through mediums like blogs, posters and newsletters.

Dan Kaplan is manager of online content at Trustwave and a former IT security reporter and editor.

Latest Trustwave Blogs

Unveiling the Latest Ransomware Threats Targeting the Casino and Entertainment Industry

Anyone who has visited a casino knows these organizations go to a great deal of expense and physical effort to ensure their patrons do not cheat. Still, there is a large group of actors who are...

Read More

Third-Party Risk: How MDR Offers Relief as Security Threats Abound

While third-party products and services are crucial to everyday business operations for almost any company, they also present significant security concerns, as high-profile attacks including...

Read More

Trustwave Takes Home Comparably Best Company Outlook for 2024 Award

Comparably, a leading workplace culture and compensation monitoring employee review platform selected Trustwave to receive its Best Company Outlook for 2024 Award. This award marks the seventh time...

Read More