Trustwave SpiderLabs Uncovers Ov3r_Stealer Malware Spread via Phishing and Facebook Advertising. Learn More

Trustwave SpiderLabs Uncovers Ov3r_Stealer Malware Spread via Phishing and Facebook Advertising. Learn More

Services
Capture
Managed Detection & Response

Eliminate active threats with 24/7 threat detection, investigation, and response.

twi-managed-portal-color
Co-Managed SOC (SIEM)

Maximize your SIEM investment, stop alert fatigue, and enhance your team with hybrid security operations support.

twi-briefcase-color-svg
Advisory & Diagnostics

Advance your cybersecurity program and get expert guidance where you need it most.

tw-laptop-data
Penetration Testing

Test your physical locations and IT infrastructure to shore up weaknesses before exploitation.

twi-database-color-svg
Database Security

Prevent unauthorized access and exceed compliance requirements.

twi-email-color-svg
Email Security

Stop email threats others miss and secure your organization against the #1 ransomware attack vector.

tw-officer
Digital Forensics & Incident Response

Prepare for the inevitable with 24/7 global breach response in-region and available on-site.

tw-network
Firewall & Technology Management

Mitigate risk of a cyberattack with 24/7 incident and health monitoring and the latest threat intelligence.

Solutions
BY TOPIC
Microsoft Exchange Server Attacks
Stay protected against emerging threats
Rapidly Secure New Environments
Security for rapid response situations
Securing the Cloud
Safely navigate and stay protected
Securing the IoT Landscape
Test, monitor and secure network objects
Why Trustwave
About Us
Awards and Accolades
Trustwave SpiderLabs Team
Trustwave Fusion Security Operations Platform
Trustwave Security Colony
Partners
Technology Alliance Partners
Key alliances who align and support our ecosystem of security offerings
Trustwave PartnerOne Program
Join forces with Trustwave to protect against the most advance cybersecurity threats

9 Ways to Create a Security Awareness Program People Won’t Hate

It's become one of the great debates within information security: Do information security awareness programs actually work? The naysayers believe training workers to be more security conscious is tantamount to throwing away money because users neither are incentivized enough to care, nor advanced enough to recognize today's sophisticated attacks. Not to mention, it only takes one foolhardy employee to spawn a potential compromise (or none if they surf upon a drive-by-download website).

On the other hand, supporters argue that a majority of security incidents can be traced back to a single employee, thus making workers an organization's weakest link. Awareness training is a reliable way to stymie the insider threat and alter user behaviors. It's not a silver bullet, but it will help reduce organizational risk, which - after all - should always be the goal of security defenses.

No matter which side your allegiance lies with, the reality is that most regulations and requirements mandate that you implement a security education program. Thus, it's in your best interest to make the most of it. That starts with thinking of it less as a compliance checkbox exercise and more as a pathway to improved security and reduced risk.

But creating something that sticks is tough. In honor of National Cybersecurity Awareness Month in the United States, we prepared a list of recommendations to help you erect a program that employees will embrace and lead to improved security outcomes.

Establish advocates and achieve buy-in

You should start by gaining support for your initiative and developing key objectives. That starts with the very top, of course, but it will really materialize when you assemble a steering committee consisting of champions from various departments. Be sure to include your company's marketing and communication professionals, who can help craft clear messaging.

Narrow your focus

There are scores of security topics you can cover in your program, but people can retain only so much knowledge. Instead, identify themes that matter most to your organization and will result in the greatest reduction of risk - keeping in mind that different departments face different risks. Companies like Trustwave can help customize training materials for specific needs.

Connect to real-life attacks

Breaches and other security headlines are an everyday occurrence, so there are certainly enough concrete examples you can use to add legitimacy to your security awareness education efforts. Some companies even show live attacks happening on their networks to further hammer home the message.

Make it about them

Many of the topics you will be addressing will be things employees are also familiar with when they're off the clock, such as using passwords, mobile devices and social media sites. If they feel they can apply what they learn at the office to their personal life, they'll be less likely to tune the message out.

Execute mock attacks to establish effectiveness

A generally perceived strike against awareness programs is that organizations struggle to quantify how successful they are. One way to overcome this is by staging simulated social engineering attacks (penetration tests) to assess whether the number of employees falling for them is dropping. If you go this route, communicate your plans prior - but far enough out that it's still a surprise - or risk an employee base that feels violated.

Raise their emotional commitment

In general, workers want to do what is right for the company, yet often don't consider the problems that can result from their security transgressions. Demonstrate for employees how poor security practices can lead to harm to the company and clearly articulate the level of risk their actions carry.

Be flexible

Certain audiences, such as senior executives and help-desk staffers, may not feel they are in need of training, so it's important to customize your message for different groups.

Reward the top dogs

Incentives help encourage behavior changes, and some companies have turned to using gamification to make security awareness education more compelling. For example, you may award points (and prizes) to employees who flag a phishing message, while developers may compete over who can locate the most security vulnerabilities. On the flip side, employees who regularly engage in unsafe computing behavior need to hear about it too.

Reinforce the message

Most experts agree than training courses won't have much effect if they are only conducted once a year. It's important not to overdo it, but reinforcement of key points is important and that can be accomplished through refresher sessions, as well as through mediums like blogs, posters and newsletters.

Dan Kaplan is manager of online content at Trustwave and a former IT security reporter and editor.

Latest Trustwave Blogs

How to Ensure Proper Managed Detection and Response Coverage, Even with Rapid Onboarding

Managed detection and response (MDR) providers often tout how quickly they can onboard new clients, and rapid onboarding can indeed be essential in many instances, but speed is not always paramount....

Read More

Trustwave Named a Representative Vendor in 2024 Gartner® Market Guide for Co-Managed Security Monitoring Services

Trustwave has been named a Representative Vendor in Gartner just released the 2024 Market Guide for Co-Managed Security Monitoring Services. Gartner estimates that there are more than 500 vendors who...

Read More

Navigating Security Risks and Innovations in the Hospitality Industry

As technology has become available, the hospitality industry has focused on making the most out of innovations such as contactless services and eco-friendly practices.

Read More