95% of All Data Breaches List “Human Error” as a Primary Cause

Though ransomware attacks on major multinational corporations often make the headlines, the most frequent targets of cyberattacks are small and medium-sized businesses, government agencies, schools and healthcare practices.

Ransomware attacks – incidents where hackers introduce malware that locks an organization’s servers and then demand a financial payment to unlock it – have nearly doubled since 2020, according to an industry survey, and newer businesses are particularly vulnerable.

Cybersecurity is a critical business strategy for all organizations today and can’t be seen as simply one activity that the IT department performs. All members of an organization – whether employees of a business or the staff of a school district or government agency – should be considered key players in protecting the organization from a cyber intrusion.

Components of a Well-rounded Cybersecurity Approach:

  • Documented and followed processes, procedures and strategies
  • Network and endpoint security
  • Email security
  • Zero-trust framework with MFA
  • Vulnerability scanning and penetration testing
  • Cybersecurity awareness training

Security-related risks decrease by 70% when businesses invest in cybersecurity awareness training.

Case Study: 20% of Employees Clicked a Simulated Attack Email

Cybersecurity Awareness Training

Companies should invest in effective cybersecurity awareness training as part of a well-rounded approach to defending the organization’s data. Here are several key factors to help improve the effectiveness of a cybersecurity awareness training program:

  • Everyone in the organization who has access to email or computers should be required to participate in the training, from C-level executives to the mailroom. Cyber attackers don’t care what someone’s rank is in an organization; if they can find a vulnerable target, they will exploit it.
  • The best training programs present information in small doses with high frequency. A well-conceived weekly 5-minute training session will be more effective than a monthly half-hour session. Short regular training experiences help reinforce the message that cybersecurity needs to be top of mind at all times.
  • Training sessions should include a quiz presented either at the end or during brief intervals during the training. Some outsourced providers utilize quizzes that give users a score that shows how they performed compared to others in their organizations or the broader public. This helps build a culture of friendly competition and engages employees in training more effectively.
  • Incentivizing participation with gamification and rewards for “most improved scores” can help boost participation and reinforce its importance to the organization.
  • Accountability must apply to everyone and there should be consequences for not participating in cybersecurity training.
  • During cybersecurity education sessions, presenting information on the potential harm a cyberattack could do to the organization highlights why it’s important to take 10 minutes of a busy schedule to participate in the training. It may seem like an inconvenience, but when compared with the potential for millions of dollars in damage, or a possible shut down of the business, it doesn’t seem so bad.
  • The best training tools start with a survey to see where employees are weak and which staff is at higher risk. Knowing this helps target training more effectively. For example, the accounting department is weak in protecting personal identifiable information, so they need more training on that topic, while the sales department needs training in social engineering scams, which use deception to manipulate individuals into divulging confidential information.
  • Targeting the training to where it’s needed can help accelerate the level of protection in an organization and engage staff in the process. Including walk-through scenarios in the training that demonstrate what would happen financially and reputationally to your organization if a cyberattack happened further drives home the point.

Some businesses are adding cybersecurity protection to their business insurance policies as cyberattacks grow. Such coverage can help deal with the significant financial losses that result from cyberattacks. Still, it’s important to note that most insurance carriers offering this coverage require policyholders to take numerous measures to be covered – including implementing cybersecurity awareness training.

Contact an Adams Brown Technology Specialist to start a conversation about how cybersecurity awareness training and other protection measures can help keep your organization safe.