Security Behaviour and Awareness

Security is everyone's responsibility. Building a trust-minded culture, and training reflexive secure behaviours is more than just throwing training at users.

​

A behaviour management architecture, mapping enterprise risks to user behaviours, training, and outcomes, may make all the difference the next time a user is phished, and you want to do everything you can to train detection skills and defensive reflexes.

 

You need to instil personal responsibility in your workforce, and then equip and enable them to be part of your human firewall, and that's a multi-part problem.

​

Firstly you need buy-in. Your employees need to know that they have a role to play in securing the organisation. Not just know it, but feel it. They need to know that wherever they are in your organisation they could be at the front line of your defence, and that you have faith in them.

​

Next, with your bought-in army of defenders, they need to be trained in detection. That means they need to know how social engineering and human-focussed attacks happen, and what to look out for.

​

Then you need them to know what to do. How do you report and handle suspected incidents? Is there positive reinforcement of good user behaviours?

​

Last of all, you can't train reflexes without testing. Phishing tests can be hard to balance well. Too many and you risk disengaging your workforce, not enough and you defeat the purpose. Complexity is a challenge too, you want the right type of testing for the right type of employees. Step it up for high-risk roles and new starters, link it to public-domain news events, especially company-related, because if you won't, your attackers will.

​

TrustCISO can help you build a comprehensive program.