Build a Security Awareness Program That Works

What keeps security professionals up at night isn’t the idea of outsider threats attacking their companies—it’s their employees. Nearly 61 percent of security leaders surveyed said their biggest issue is worrying about negligent or malicious employees, which they claim are responsible for over half of their organization’s data breaches or security incidents.

These employees have:

• Infected a system or computer with malware from an insecure site or device
• Used unapproved cloud or mobile apps while at work
• Accessed company data or applications from an insecure public internet connection
• Been victims of a phishing attack

Your company has a security awareness program. You have trained employees on proper security protocol and make sure to update everyone on any changes to threats or procedures. From the outside, it might look like your company has covered its bases on a security awareness program, but more than likely, you’re not finding the success you would like.

When examining your company’s security protection, you probably have focused on applications and other technologies. Don’t forget to focus on your employees. Most employees generally do not want to be malicious, but a few uneducated ones could pose a serious threat to your organization.

Shore up your security awareness program with these additional tips.

Find and protect your most valuable assets

While general security awareness training is helpful, your company likely has specific assets, such as a proprietary software platform, that could be threatened by a malicious action or employee mistake.

Then, align your training around these assets and provide different training to different employee groups. Your executive team will need different training than your marketing team, or your software developers will need different training than your account executives.

Make training ongoing

It may be tempting to conduct an hour-long training workshop once or twice a year and think your employees will follow policies. Instead, make your training events ongoing, updating employees of new threats, changes in procedure or just providing reminders of how to keep everything operating smoothly and securely.

Use multiple channels

PCI Security Standards Council recommends using the communication channel that best fits your organization’s culture to distribute content about your security program. But using multiple channels can also help. With these additional communication channels, you’re ensured employees are exposed to the information many times in many ways—increasing the likelihood they’ll retain the information. Be sure to make any necessary edits to content so it fits the format you’re using. For example, an employee webinar would feature content in a different format than an email newsletter, even though the message in both channels is the same.

Properly educating and keeping communication channels open among employees can help make your information security awareness program a success.