An important layer of cybersecurity that many companies don’t pay enough attention to is employee security awareness. Phishing is by far the biggest threat to IT security and can cause days of expensive downtime, theft of sensitive information, and account takeovers through credential theft.
When employees are well trained on cybersecurity awareness, an organization’s risk of falling victim to a cyberattack can decrease by as much as 70%. But understanding what “well-trained” means, can be complicated.
Is holding a 2-hour training once per year enough? What about a virtual refresher training every 6-months?
There was a recent study that was done and presented at a large security conference. It showed that both annual and twice-per-year training is not enough. People can quickly forget what they’ve learned in as little as 6-months if the message of cybersecurity is not reinforced.
What’s the Ideal Training Frequency for IT Security Awareness?
In the study, employees were trained on phishing awareness and how to identify scam emails. They were tested at varying time intervals post-training. These included 4-months, 6-months, 8-months, 10-months, and 12-months.
The study found that after four months, employees performed well on phishing simulation tests and accurately identified scam emails. However, during the 6-month training, performance was worse. It continued to degrade each test after that, through to the 12-month mark.
This study illustrated the need to reinforce cybersecurity awareness training at least every four months to build a team with strong cyber hygiene.
How Important is Good Cyber Hygiene?
Besides significantly decreasing the risk of a cyberattack, having good cyber hygiene is important in other ways. This simply means that employees are following best practices for IT security and have the skills necessary to detect phishing and other threats they may run into on their devices or online.
According to the Sophos Threat Report, not following IT security best practices is one of the biggest causes of companies falling victim to cyberattacks, like ransomware, data breach, and others.
The report states, “A lack of attention to one or more aspects of basic security hygiene has been found to be at the root cause of many of the most damaging attacks we’ve investigated.”
Tips to Keep Cybersecurity Training Fresh & Effective
Make Cybersecurity Part of Your Culture
“Training” on cybersecurity doesn’t have to mean a half-day class on things like phishing awareness and password security. It can mean receiving a tip of the week on cybersecurity via email. It can also mean receiving a monthly video on a certain aspect of IT security that can be watched on-demand.
By making cybersecurity something that is infused in your company culture, you build a team that thinks of security first, reducing your risk of human-error-caused cybersecurity incidents.
A Stanford University study found that 88% of all data breaches are caused by employee mistakes.
Mix Up Your Training Methods
Create an employee training strategy that mixes up the methods used. This keeps employees engaged and the message fresh.
Here are some different ways to teach employees about cybersecurity that you can include in your strategy:
- Formal training with an IT-Pro
- Round-table discussions in small groups
- Virtual training on one specific topic
- Short two to four-minute on-demand videos
- Posters and banners on cybersecurity
- Tips of the week in company communications
- Unannounced phishing simulation testing
Conduct Phishing Simulations
How do you know if your employees are being armed with the information that they need to avoid a phishing email? The best way to do this is to have periodic and unannounced phishing simulation tests.
In these drills, an IT professional or simulation service will send safe, but convincing emails designed to look just like real phishing emails. Your team is then scored in aggregate as to how many interacted with a phishing message in a way that would compromise cybersecurity.
Find Ways to Make Cybersecurity Fun
Cybersecurity is a serious topic, but that doesn’t mean you can’t infuse some fun into the learning process. Reward your team for improved scores on a phishing simulation test by bringing in pizza or taking them out for lunch.
You can also have friendly competitions between departments on the best cybersecurity ideas to improve IT security for the organization.
Another way you can keep your team engaged is to create one or more team events during October, which is Cybersecurity Awareness Month. Use the free resources on the official site and have some creative events to celebrate.
Need Help With an Engaging Employee Cybersecurity Training Plan?
Arm your employees with the information they need to avoid falling for a cyberattack. Quantum PC Services can help your Sturgeon Bay area business put together and implement an informative and engaging cybersecurity awareness plan.
Contact us today to learn more! Call 920-256-1214 or reach us online.
