Which of Your Employees Should Do Regular Security Training & Why?

Employees have a love/hate relationship with cybersecurity training. They love to get away from the tedium of their daily work, but cybersecurity best practices aren’t necessarily #1 on their “fun things to learn about” list, right?

The truth is that employee cybersecurity training is critical. Human error is a big factor in cyber intrusions. In fact, a 2019 report by the UK Information Commissioner’s Office (ICO) reported that 90% of that country’s data breaches were a result of human error. Unfortunately, the USA doesn’t fall far behind in the “human error” department.

Cybersecurity’s Impact on Employee Training – Then and Now

There was a time when email scams like the “Nigerian Prince” con and hackers that directly targeted your network were the main internet security concerns.

Things have changed dramatically.

Today, the threats include insider threats and outside invasive attempts at all levels of your IT infrastructure.

Cybersecurity professionals, like those at PTG, must now help protect everything from the work apps you use on your smartphone to your mission-critical data that’s backed up in the cloud.

Each element of your IT environment presents a potential entry point for cybercriminals, and they most often use mistakes made by your staff to gain that access.

The workflow changes that came about as a result of the COVID pandemic of 2020 have increased the potential vulnerability that an employee without cybersecurity training poses to your company.

 What Employees Need Cybersecurity Training?

The simplest answer to the question of “who needs IT security training” is EVERYONE – and that’s true. However, the simplicity of that statement does not tell the whole story. There are some employees that need training more often (and at a higher level) than others.

Why?

While you may like to think of all your employees as a “family,” there are some members of your employee family that have the proverbial “keys to the kingdom.” Because of the responsibilities of their work, they have more access to various parts of your IT system and are therefore a higher risk – and a bigger target for cybercriminals.

What Does Employee Cybersecurity Training Do For Your Business?

Many business leaders have to be convinced of the necessity – and the advantage – of spending the money and making an effort to conduct regular employee IT security training. But when compared with the massive inconvenience – and expense – of a data breach, the effort and money spent on cybersecurity education for employees is attractive.

Here is the business-benefit side of the employee cybersecurity training equation.

• Lower risk of IT downtime
• Increased productivity potential
• Protection of brand reputation
• Protection of data and workflow
• Fortification against ransomware, malware, spyware, and phishing attempts
• IT policy adherence for legislative compliance

What Employees Need a Higher Level and Regularity of Cybersecurity Training?

As we have previously mentioned, some employees have a greater need for regular – or more in-depth – cybersecurity training. Here are a few examples.

When you have organization-wide cybersecurity training, there is always a certain percentage of employees that don’t entirely “get it.” It’s important to identify these individuals and support their understanding with additional, supplementary training. The preferred way to identify those that need the added support is to utilize online testing and real-world tests designed by your cybersecurity team to evaluate how well each employee is grasping IT security best practices.

Once you have identified the individuals that struggle with the material, your IT security specialist can then suggest additional online or group training to “bring them up to speed with the rest of the class.”

No matter how small your company, you should never allow admin access for all your employees. Admin access is the “combination to the safe.” Everything of digital value in your organization can be accessed by someone with admin access. Because these individuals have access to such a trove of data, they are often the target of social engineering schemes designed to gain access through their credentials.

Anyone with admin access within your organization should go through more regular and more in-depth IT security training. PTG IT security specialists can suggest the right cybersecurity topics to cover and specific training that will help your admin holders not to become conduits for cybercriminal entry into your network.

While there is a strong argument to be made for “cybersecurity training for everyone in the organization,” there are those that pose a far lower risk to your business than others.

For example, if you run a construction firm, the carpenter that swings a hammer all day isn’t likely to be a big threat to your IT security posture. However, the project manager that sends and receives emails constantly from the office, vendors, and clients is a person that needs more cybersecurity training. The same scenario plays out in a manufacturing firm. Someone that is working eight hours a day on a die stamping out parts from sheet metal isn’t as likely to become a “cybersecurity human error story” than an administrative assistant in the office would be.

Employees that Work Away from the Office via the Internet

The work-from-anywhere culture has hit its peak due to the pandemic. While many employees enjoy the freedom of working from home or the local coffee shop, the cybercriminals are just as enthusiastic about this development.

Why?

Because work-from-home scenarios open up an entirely new array of options for the hacker that wants to get into your IT environment, causing damage and stealing confidential data.

Employees that work away from the office and access company IT assets such as databases and applications must be made aware of expanded best practices for their unique situation. Those individuals have to become hyper-vigilant about the security of their home network, not using public WiFi, and leveraging encrypted VPN access.

The other thing that remote employees must be cautioned against is “shadow IT.” Shadow IT, in this context, is unsanctioned applications that employees download and use to do their work more easily. The short story is that easier is not always secure. In fact, “free” downloadable software that makes the employee’s job “easier” is often a cybercriminal ploy.

Summary

Cybersecurity awareness training is a must-do for every employee in your organization if you want to lock down the avenue of attack most often used by cybercriminals. However, not every employee requires the same amount of or level of cybersecurity training.

To assess the cybersecurity risk of your employees, it’s important to have an IT security team on your side. The PTG cybersecurity specialists would be happy to assist you in building the best strategy for your employee IT security training. Just send an email or give us a call for a no-obligation initial conversation.