Top 10 security awareness training topics for your employees

An organization’s employees are one of the biggest cybersecurity risks. In fact, human error is considered the main cause of data breaches.

However, an organization’s employees can also be a huge asset to an organization’s cybersecurity. When employees are given the knowledge they need to identify cyber threats—through an effective and engaging security training program—they can act as another line of defense for an organization.

When designing a cybersecurity training program, it is important to ensure that it covers the cyberthreats an organization is most likely to face. This article outlines the top ten security awareness topics to include in a security awareness program.

1. Email Scams

Phishing attacks are the most common method cybercriminals use to gain access to an organization’s network. They use human nature to trick their target into falling for the scam by offering an incentive (free stuff, a business opportunity and so on) or creating a sense of urgency.

Phishing awareness should be a part of any organization’s security training program. This should include examples of common and relevant phishing emails and tips for identifying attempted attacks, including:

• Don’t trust unsolicited emails
• Do not send money to people who request it by email, especially before contacting management
• Always filter spam
• Configure your email client correctly
• Install antivirus and firewall programs and keep them up to date
• Don’t click on unfamiliar links in email messages
• Beware of email attachments. Check any unsolicited attachments with the alleged sender (via phone or other medium) before opening
• Remember that phishing attacks can take place through any medium (including email, SMS, business collaboration platforms and so on)

2. Malware

Malware is malicious software that cyber criminals use to steal sensitive data (user data, financial information, etc.) or damage an organization’s systems (for example, ransomware and wiper malware). It can be delivered to an organization in a variety of ways, including phishing emails, drive-by downloads, and malicious removable media.

Security awareness training for employees about malware should cover common delivery methods, threats and organizational impact. Important tips include:

• Be suspicious of files in emails, websites and other places
• Do not install unauthorized software
• Keep antivirus active and up to date
• If you may have a malware infection, please contact the IT/security team

3. Password protection

Passwords are the most common and easiest to use authentication system in existence. Most employees have dozens of online accounts that can be accessed by providing a username (often their email address) and a password.

Poor password protection is one of the biggest threats to modern business security. Some important password protection tips to include in training content:

• Always use a unique password for each online account
• Passwords must be generated randomly
• Passwords must contain a mix of letters, numbers and symbols
• Use a password manager to generate and store strong passwords for any account
• Use multi-factor authentication (MFA) when available to reduce the impact of a compromised password

4. Removable Media

Removable media (such as USBs, CDs, and so on) are a useful tool for cybercriminals because they allow malware to evade an organization’s network-based security. Malware can be installed on the media and configured to run automatically with Autorun or have a tempting filename to trick employees into clicking. Malicious removable media can steal data, install ransomware, or even destroy the computer in which they are placed.

Harmful removable media can be spread by being dropped in parking lots and common areas or handed out at conferences and other public events. Employees must be trained to properly manage unreliable removable media:

• Never connect untrusted removable media to a computer
• Take any unreliable removable media to IT/security for scanning
• Disable Autorun on all computers

5. Safe Internet Habits

Almost every employee, especially in technology, has access to the Internet. For this reason, safe use of the Internet is of utmost importance to businesses.

Security training programs should include secure Internet practices that prevent attackers from entering your corporate network. Some important content to include in the training:

• Ability to recognize suspicious and spoofed domains (such as yahooo.com instead of yahoo.com)
• The differences between HTTP and HTTPS and identifying an insecure connection
• The Dangers of Downloading Untrustworthy or Suspicious Software from the Internet
• The risks of entering credentials or credentials on untrustworthy or risky websites (including fake and phishing pages)
• Watering hole attacks, drive-by downloads and other threats from browsing suspicious sites

6. Dangers of Social Networks

Businesses use social networks as a powerful tool to build a brand (locally or globally) and generate online sales. Unfortunately, cyber criminals also use social media for attacks that endanger an organization’s systems and reputation.

To prevent the loss of critical data, the enterprise must have a viable social network training program that should limit social network use and educate employees about the threats posed by social media:

• Phishing attacks can occur on both social media and email
• Cyber criminals posing as trusted brands can steal data or push malware
• Information published on social media can be used to create spearphishing emails

7. Physical Security and Environmental Controls

Security awareness isn’t just about what’s inside your company’s computers or handheld devices. Employees should be aware of potential security risks in physical aspects of the workplace, such as:

• Visitors or new hires watching employees type passwords (known as “shoulder surfing”)
• Letting in visitors who claim to be inspectors, exterminators, or other unusual guests who may be looking to get into the system (called “impersonation”)
• Allowing someone to follow you through a door into a restricted area (called tailgating)
• Leaving passwords on pieces of paper on someone’s desk
• Leaving the computer on and not password protected when leaving work for the night
• Leaving an office-issued phone or device in plain sight
• Physical security controls (doors, locks, etc.) not working properly

8. Clean desk policy

Sensitive information on a desk, such as sticky notes, papers and prints, can easily be taken by thieving hands and seen by prying eyes. A clean desk policy should state that information that is visible on a desk should be limited to what is currently needed. Before leaving the workspace for any reason, all sensitive and confidential information must be stored securely.

9. Data management and privacy

Most organizations collect, store and process a lot of sensitive information. This includes customer data, employee records, business strategies, and other data important to the smooth running of the business. If any of this data is made public or accessible to a competitor or cybercriminal, the organization could face significant legal penalties, damage to consumer relationships and a loss of competitive advantage.

Employees within an organization must be trained in how to properly manage the company’s sensitive data to protect data security and customer privacy. Important training content includes:

• The company’s data classification strategy and how to identify and protect data at every level
• Legal requirements that may affect an employee’s day-to-day activities
• Approved storage locations for sensitive data on the corporate network
• Use a strong password and MFA for accounts with access to sensitive data

10. Bring-your-own-device (BYOD) policy

Byod policies allow employees to use their personal devices in the workplace. While this can improve efficiency — by allowing employees to use the devices they’re most comfortable with — it also creates potential security risks.

BYOD policies and security awareness training for employees should include the following tips:

• All devices used in the workplace must be secured with a strong password to protect against theft
• Enable full disk encryption for BYOD devices
• Using a VPN on devices when working from untrusted Wi-Fi
• BYOD-approved devices must use a company-approved antivirus
• Only download applications from major app stores or directly from the manufacturer’s website

Conclusion

Employees play a vital role in running a successful business. An untrained and negligent workforce can put your business at risk from multiple data breaches. Therefore, organizations must adopt a viable security training program that should include the essential guidelines needed to prevent imminent cyber incidents.

Your organization should also set up monthly training meetings, provide frequent reminders, train all new staff on new policies as they arrive, provide training materials, and implement creative incentives to reward employees for being proactive in ensuring organizational security.

Source: infosecinstitute