A New Approach to Security Awareness
By: Angy Shavit
Tags: Infosec, Security, Remote Working

It’s your first day at your new job. You have a week to get settled in and they’ve given you a long list of tasks. You start by ticking off boxes on a checklist, submit a bunch of paperwork to the HR team, and weed through a ton of emails. At some point during the week, you might be asked to complete security awareness training. You’ll probably spend between 45 minutes to an hour watching videos about security awareness, completing a few quizzes, and — tada — you have a certificate!

The next time you’ll have to worry about security awareness will be a year from now when you’ll be required to do the same training all over again. But how much of that will you actually remember throughout the year?

It’s important to provide security awareness training to employees when they first join the company. You want to make sure that the same people, who now have access to your environment and possibly sensitive information, know how to protect themselves and your assets. But should they only think about security once a year for a long, dreadful hour?

At LaterPay, we’ve taken a new approach to security awareness. We want everyone to think about security all-year-round and we try to tackle the issue from a different perspective. A new employee will have a short security awareness training that is mandatory to complete in their first week. It covers the basics and, most importantly, all new hires come out of it knowing that security is something we take very seriously as a company. The next time they aren’t sure about something when it comes to security, they know there is a team dedicated to helping them. This is possibly one of the most important aspects of security awareness.

What’s equally important, however, is that security awareness training doesn’t end there. A few times a year employees are enrolled in short modules that train them on various security related topics. That way, the information is fresh in their minds all year long. Did you read an interesting article about a new vulnerability that you think your colleagues might be interested in? Awesome, share it!

It’s also important to get employees involved! A phishing simulation can help get employees into the habit of thinking before clicking and asking questions. Once you launch your first phishing campaigns, you’ll hopefully start to hear from your employees about ‘phishy’ emails they received. That may not seem like much, but for a security team that’s a huge win! It indicates that employees care, that they are asking questions because they feel involved, and that’s the goal. Make sure you start out with simple phishing campaigns and work your way up to difficult ones over time.

Finally, end-user trial groups are an excellent way to get your colleagues involved. Before you roll out a new solution, gather a group of end-users that would be interested in testing before it’s rolled out to the rest of the organization. Take feedback from them to make the tool better and help yourself by learning how to properly roll it out to a larger group.

End users are often the weakest link, used by malicious actors to compromise your environment. Security is a team effort. It starts with the security specialists in your company, but it certainly doesn’t end there.