Best Practices for Cybersecurity Training

Image by rawpixel.com on Freepik

With each passing year, the number of cybersecurity cases have been increasing. According to research by PurpleSec, the number of ransomware attacks in 2018 increased by 350%. Additionally, the same research shows that 92% of malware is delivered via email. Another study conducted by IBM, revealed that around 95% of cybersecurity breaches occur due to human error, making it the primary cause of cyber-attacks. These statistics call for training employees in cybersecurity an absolute necessity.

When training employees, organizations should ensure that courses cover the latest intelligence on cybersecurity, as cybercriminals constantly find new ways to attack. However, content alone isn’t enough if training is not delivered in a manner that’s most effective for learning. We’ve put together a few growing cybersecurity threats and best practices for training your employees to avoid them.

Email scams

Email scams are the most common form of cyberattacks. During the pandemic, cybercriminals, using the phishing technique tricked several email users to click a malicious link by posing as the US Center for Disease Control and Prevention. Using similar impersonation techniques, attackers can gain access to, or corrupt files stored on your organization’s network. Cybercriminals use email scams as a base for other attacks including SIM swap, malware, etc.

When training employees on email scams, organizations can provide several different phishing examples, so that employees can identify and differentiate between an authentic and spam email.

Also, include steps to mark or block a spam email, configure an email client, and enable and update antivirus and firewall programs.

SIM swap

In this technique, fraudsters use the individual’s information obtained from email scams to obtain a new SIM (Subscriber Identity Module). After gaining the individual’s personal information such as name, address, bank account number, and cell phone number associated with the bank account, fraudsters contact the individual’s network provider with the objective of gaining a new SIM, which is then used to receive a one-time password (OTP) for unauthorized transactions.  A key goal of cybersecurity learning is to increase employees’ awareness and understanding of cybersecurity risks, as well as their role in preventing security breaches. Employees should be trained to monitor their phone and financial accounts regularly for any suspicious activity and to store sensitive information, such as account numbers and passwords, in a secure location that is separate from their phones.

Malware

Malware is a malicious program that hackers use to spy on or corrupt data on a device or network. Employees can be tricked into installing the malware either through phishing or through free pirated software. When training employees on malware, it is useful to identify the different types of malware, how they enter, and their impact on the organization. Employees must be informed to refrain from installing any software on their workstations, and any request for installing software must be approved and executed by IT personnel.

Password security

A poor password can easily result in an account breach. Often employees use the same password (that is also used in their social media accounts) or set an easy password so it’s convenient to remember. When training employees on password security, ask them to set a unique password for each account, the password should be a combination of alpha-numeric and special characters. Using a password manager to securely store and generate strong passwords can reduce the risk of a security breach. Additionally, demonstrate how multi-factor authentication or two-step verification helps in reducing risks associated with password security. It is important to incorporate real-world examples and scenarios to illustrate the importance of password security and the potential consequences of neglecting it. Simulation and gamification can provide employees with hands-on experience dealing with cybersecurity threats in a safe and controlled environment.

Safe internet habits

Safe internet habits generally include being able to differentiate between authentic (google.com) and spoofed (gooogle.com) domains, secure (https) and unsecured (http) protocols, and understand the risks of downloading files from untrusted websites or connecting to untrusted networks. By following safe internet habits employees can prevent attacks from happening.

Apart from these five threats, there are other practices such as removable media, social engineering, and bring-your-own-device (BYOD) that can be highlighted to provide better coverage in your cybersecurity training.

For effective learning, be sure to incorporate delivery modes that are engaging, interactive, focus-oriented, and flexible. eLearning caters to all of the above.

Through games, interactive videos, and simulations that use the storytelling approach with branching and decision-making, learners can stay focused and remain engaged. The storytelling approach makes learners feel invested by unfolding the story through their decisions. Additionally, with remote or mobile learning, learners can access the courses at their convenience.

Regular assessment of the effectiveness of cybersecurity training and continuous improvement of the training program is important to ensure that employees are equipped to deal with current and emerging cybersecurity risks. Providing employees with resources, such as articles, videos, and podcasts, that they can access on their own time can be used for ongoing training and to reinforce key concepts and best practices.