Security policies can be voluntarily created by an organization or sometimes required by law dependent on the industry your business operates in. These security policies are the communicated procedures and recommendations that all employees should follow within your company operations to eliminate risk and the chance of a cyber-attack.
Cybersecurity awareness training is all the actions taken by your organization to teach employees a particular action or behavior. Cybersecurity awareness training is education used to make a person aware of a particular type of threat that they may face so that it is less likely to be successful. Some number of threats will find their way through your defenses, for that reason, your employees need to have the proper training to see the signs and avoid putting your organizational security at risk.
Table of Contents
The Importance of Cybersecurity Awareness Training
The main reason that cyber-attacks are successful is due to an organization’s lack of training and security training for their employees. One employee’s failure to recognize the signs of a suspicious email when it presents itself (email being the number one avenue cybercriminals use) can open the whole organization in jeopardy.
The overwhelming majority of successful cyberattacks are made possible due to human error and often involve someone clicking a link, opening, or downloading a file, (or even sharing) something they shouldn’t have. Therefore, when it comes to cybersecurity, having your staff properly trained and aware of the dangers that exist will greatly reduce the chance that a breach will ever take place.
With the need for cybersecurity awareness training clearly established, let’s get into the two most common types of attacks that you may encounter so that you can be better prepared. Social engineering and phishing are responsible for 70-90% of all malicious cyber-attacks.
What is Social Engineering?
Social engineering is understood as an act of deception that uses the method of manipulating employees into performing actions such as sharing their company login credentials or other confidential information that threatens the integrity of the organization that they work for. This is usually done through impersonation and feigning a sense of immediate urgency.
Social engineering can be done through fraudulent mail, over the phone, through email, text messages, or online. However, most of the social engineering takes place in your email inbox in the form of a phishing email.
What is Phishing?
An email phishing attack is the weapon of choice for cybercriminals due to its high success rate. Even with the utilization of the most sophisticated cybersecurity technology, all it takes is one employee to fall for a phishing attack and share their company login credentials for a data breach to take place. For these reasons, phishing training must be a priority and an essential part of your cybersecurity plan.
Common Forms of Social Engineering and Phishing
Let’s review three examples of social engineering and phishing scams to understand them better.
- Fake Web Pages: Cybercriminals create fake web pages that can trick your employees into filling in their organizational account details (or other sensitive information) on the fraudulent webpage. As an example, one of your employees could receive a phishing email that contains a link to log into their LinkedIn account. Since the email seems legitimate, your employee may be tempted to click the link and enter their login credentials. Once they’ve entered their login credentials, the cybercriminal can log in to their LinkedIn account, view their personal information, and change their password so that they can no longer access their account. Worse, if their LinkedIn password is used for any other account, the cybercriminal now has the ability to access those accounts too.
- Impersonation: Cybercriminals impersonate someone your employees know (most likely a fellow coworker) to trick them into clicking an unsafe link, downloading a malicious attachment, or sharing company payment information. Impersonation attacks occur over the phone, through email, text message, or even on social media websites. As an example, one of your employees could receive a phone call from a cybercriminal posing as your company’s internet service provider. The cybercriminal could tell your employee that your monthly payment is overdue and because the call seems legitimate, your employee may be tempted to provide your company’s payment information.
- Malicious Links: Cybercriminals can use malicious links to trick your employees into downloading a piece of software or opening an unsafe webpage that puts your organization at risk. Your employees probably use URLs every day to access websites pertaining to their daily tasks. Unfortunately, cybercriminals can use URLs to direct your employees to malicious websites, steal personal information, or to initiate downloads of malware onto your company devices. It’s important that your employees always think before they click to prevent cyber-attacks.
How to Prevent Social Engineering and Phishing
- Notify your employees that before sharing their sensitive information such as their birth date or company credit card numbers, they need to verify that the source they’re sharing the information with is indeed legitimate and who they say they are.
- Train your employees to know that if someone they know (like a current or former coworker) messages them asking for company information or sends a suspicious link, to call or text the person directly to make sure the request is legitimate. If a message looks suspicious like it doesn’t match the way that coworker sounds or there is obvious grammar and spelling mistakes, it likely not the person, but an imposter.
- Train Your Staff to Follow the Following External Link Best Practices:
- Before clicking a link, you should hover your mouse over the link to make sure that the link is secure and matches the correct website.
- Instead of clicking on a link or a button in an email, navigate to the website directly by entering the URL into the address bar.
- If you receive an email linking to a special deal or promotion, first navigate to the organization’s website in your browser. Do not click the link in your email until you can ensure that the deal or promotion is indeed legitimate.
If you familiarize your staff with common social engineering and phishing methods, they can recognize the signs of an attack and keep themselves and the organization safe from a cyber breach.
