How to Launch a Cybersecurity Awareness and Training Program

You can have an amazing set of technology tools and policies and procedures, but one of the biggest threat vectors for data loss is your employees. Data loss can be intentional or often unintentional, but one wrong mouse click either way and you could be facing a PR nightmare. The trust you need to give your employees to do their jobs, must come with the accountability to be aware, stay aware, and remain vigilant when it comes to data security.
 
Before you begin creating a cybersecurity awareness program, ask yourself if you have some of the basic policies and procedures in place that deal with handling Personal Identifiable Information (PII), a term used to describe sensitive customer information/data. Here are a just few you should consider dusting off:

• Every firm should have an Acceptable Use Policy. This is a blanket policy that talks about your company's computing resources and data. These are company property and misuse can result in bad outcomes.
• Do you have an Access Control Policy that helps divvy out the right permissions on systems for different job functions and trust levels?
• Do you have a Data Classification Policy? Can you identify across file shares, databases and other places to determine where sensitive data lives and how its managed in the environment. 

Once your policies are in order, it’s time to create the actual program. The operative word is “program.” This is not a new policy you write and save somewhere. This is an active event that requires constant updating. If you want to create security awareness it takes a lot of activity and reminders.

Here are some basic components for a cybersecurity awareness training program:
 

• Executive Sponsorship: This is a key in terms of financial and business support. New investments and tools will be needed and updates on the program should also be made to this team.
• Make it Everyone’s Job: Announce your program and gather support. Make certain that the rollout explains that cybersecrutiyt is everyone’s job and that each individual plays an important part. 
• Regular Cybersecurity Training: There are many online tools to choose from that help sharpen employee awareness and skills.
• Phishing Training: There are a number of solutions that do this, too, along with cybersecurity training.
• When You See Something Say Something: If your company is being targeted by a phishing campaign, take a picture of the email and share it. There’s nothing better than real time awareness.
• Share Your Progress: As your company's metrics improve, share the results and make the ownership of those results enterprise-focused.

Summary

Building cybersecurity awareness isn't easy and takes continuous effort to be successful in creating a the right awareness program. It is doable though!. Ransomware attacks are often launched by just one employee making one wrong mouse click. Help your employee population learn how not to be that person. Make sure your people are reasonably paranoid and always think before they click. Cybersecurity professionals and all employees should ultimately remember what dear old mom used to say “safety first.” The message is the program. Contact us to learn more!