Trustwave Unveils New Offerings to Maximize Value of Microsoft Security Investments. Learn More

Trustwave Unveils New Offerings to Maximize Value of Microsoft Security Investments. Learn More

Managed Detection & Response

Eliminate active threats with 24/7 threat detection, investigation, and response.

Co-Managed SOC (SIEM)

Maximize your SIEM investment, stop alert fatigue, and enhance your team with hybrid security operations support.

Advisory & Diagnostics

Advance your cybersecurity program and get expert guidance where you need it most.

Penetration Testing

Test your physical locations and IT infrastructure to shore up weaknesses before exploitation.

Database Security

Prevent unauthorized access and exceed compliance requirements.

Email Security

Stop email threats others miss and secure your organization against the #1 ransomware attack vector.

Digital Forensics & Incident Response

Prepare for the inevitable with 24/7 global breach response in-region and available on-site.

Firewall & Technology Management

Mitigate risk of a cyberattack with 24/7 incident and health monitoring and the latest threat intelligence.

Offensive Security
Solutions to maximize your security ROI
Microsoft Exchange Server Attacks
Stay protected against emerging threats
Rapidly Secure New Environments
Security for rapid response situations
Securing the Cloud
Safely navigate and stay protected
Securing the IoT Landscape
Test, monitor and secure network objects
Why Trustwave
About Us
Awards and Accolades
Trustwave SpiderLabs Team
Trustwave Fusion Security Operations Platform
Trustwave Security Colony
Technology Alliance Partners
Key alliances who align and support our ecosystem of security offerings
Trustwave PartnerOne Program
Join forces with Trustwave to protect against the most advance cybersecurity threats

9 Ways to Create a Security Awareness Program People Won’t Hate

It's become one of the great debates within information security: Do information security awareness programs actually work? The naysayers believe training workers to be more security conscious is tantamount to throwing away money because users neither are incentivized enough to care, nor advanced enough to recognize today's sophisticated attacks. Not to mention, it only takes one foolhardy employee to spawn a potential compromise (or none if they surf upon a drive-by-download website).

On the other hand, supporters argue that a majority of security incidents can be traced back to a single employee, thus making workers an organization's weakest link. Awareness training is a reliable way to stymie the insider threat and alter user behaviors. It's not a silver bullet, but it will help reduce organizational risk, which - after all - should always be the goal of security defenses.

No matter which side your allegiance lies with, the reality is that most regulations and requirements mandate that you implement a security education program. Thus, it's in your best interest to make the most of it. That starts with thinking of it less as a compliance checkbox exercise and more as a pathway to improved security and reduced risk.

But creating something that sticks is tough. In honor of National Cybersecurity Awareness Month in the United States, we prepared a list of recommendations to help you erect a program that employees will embrace and lead to improved security outcomes.

Establish advocates and achieve buy-in

You should start by gaining support for your initiative and developing key objectives. That starts with the very top, of course, but it will really materialize when you assemble a steering committee consisting of champions from various departments. Be sure to include your company's marketing and communication professionals, who can help craft clear messaging.

Narrow your focus

There are scores of security topics you can cover in your program, but people can retain only so much knowledge. Instead, identify themes that matter most to your organization and will result in the greatest reduction of risk - keeping in mind that different departments face different risks. Companies like Trustwave can help customize training materials for specific needs.

Connect to real-life attacks

Breaches and other security headlines are an everyday occurrence, so there are certainly enough concrete examples you can use to add legitimacy to your security awareness education efforts. Some companies even show live attacks happening on their networks to further hammer home the message.

Make it about them

Many of the topics you will be addressing will be things employees are also familiar with when they're off the clock, such as using passwords, mobile devices and social media sites. If they feel they can apply what they learn at the office to their personal life, they'll be less likely to tune the message out.

Execute mock attacks to establish effectiveness

A generally perceived strike against awareness programs is that organizations struggle to quantify how successful they are. One way to overcome this is by staging simulated social engineering attacks (penetration tests) to assess whether the number of employees falling for them is dropping. If you go this route, communicate your plans prior - but far enough out that it's still a surprise - or risk an employee base that feels violated.

Raise their emotional commitment

In general, workers want to do what is right for the company, yet often don't consider the problems that can result from their security transgressions. Demonstrate for employees how poor security practices can lead to harm to the company and clearly articulate the level of risk their actions carry.

Be flexible

Certain audiences, such as senior executives and help-desk staffers, may not feel they are in need of training, so it's important to customize your message for different groups.

Reward the top dogs

Incentives help encourage behavior changes, and some companies have turned to using gamification to make security awareness education more compelling. For example, you may award points (and prizes) to employees who flag a phishing message, while developers may compete over who can locate the most security vulnerabilities. On the flip side, employees who regularly engage in unsafe computing behavior need to hear about it too.

Reinforce the message

Most experts agree than training courses won't have much effect if they are only conducted once a year. It's important not to overdo it, but reinforcement of key points is important and that can be accomplished through refresher sessions, as well as through mediums like blogs, posters and newsletters.

Dan Kaplan is manager of online content at Trustwave and a former IT security reporter and editor.

Latest Trustwave Blogs

Why Vulnerability Scanning is an Offensive Security Program’s Secret Weapon

Knowing what you don’t know is the key to keeping an organization safe and the best method of doing so is with an offensive security approach that includes vulnerability scanning. By being proactive...

Read More

Upcoming Trustwave Webinar: Maximizing the Value of Microsoft E5

Many organizations license Microsoft 365 E5 to obtain its productivity features, which makes perfect sense because that is what the tool is known for. However, E5 also shines in the security realm...

Read More

Comparably Honors Trustwave with Leadership and Career Growth Awards

Comparably, the leading workplace culture and compensation monitoring employee review platform has recognized Trustwave with two major awards: 2024 Best Companies for Career Growth and 2024 Best...

Read More