13 Security Awareness

Security Awareness: Building a Human Firewall

Introduction

Most cyber attacks start with human error. Whether it’s a well-crafted phishing email, a malicious USB left in a parking lot, or a fraudulent phone call, attackers often rely on people as the “weakest link.” Security awareness is about turning that weakness into a strength by giving users the knowledge and confidence to spot, avoid, and report suspicious activity. For IT managers, investing in security awareness means fewer incidents, faster response, and a stronger security culture.

---

1. Required Security Training

Baseline security training is the foundation for all employees, regardless of role. Most organizations require users to complete annual or onboarding training modules covering:

• Password best practices
• Phishing and social engineering basics
• Data protection and privacy
• Acceptable use policies
• Incident reporting procedures
• Physical security basics (e.g., badge use, device locking)

Best Practice: Use short, interactive e-learning modules that end with a quiz. Track completion for compliance.

Why it matters: Required training ensures everyone understands the basic threats, their responsibilities, and how to recognize/report risks. It’s often mandated by industry standards, insurance, or regulations.

---

2. Ongoing Awareness: Email Updates, Tips, and Reminders

Security isn’t “one and done.” Regular email updates, intranet articles, or “tip of the week” messages keep security top of mind. Examples include:

• Alerts about new scams (e.g., a current phishing campaign targeting your sector)
• Quick tips (“Never reuse passwords”, “Watch for suspicious attachments”)
• Short reminders before major holidays or travel seasons (when attacks often spike)

Best Practice: Keep messages concise and actionable—one tip per email is more effective than a long newsletter.

Why it matters: Attack techniques evolve. Regular communication helps users stay alert and reinforces positive habits.

---

3. Phishing Drills (Simulated Phishing)

One of the most effective tools for improving user vigilance is phishing simulation. These are safe, simulated phishing emails sent to staff to gauge and build awareness:

• How it works:

  • IT/security sends a fake but realistic phishing email to employees.
  • Those who click, download, or enter credentials are redirected to a friendly training page.
  • Results are tracked (not to shame, but to target future training).

• What to include:

  • Realistic scenarios (package tracking, HR updates, urgent requests)
  • Varying difficulty (obvious vs. subtle attempts)
  • Immediate feedback (“Here’s what you missed—here’s how to spot it next time”)

Best Practice: Run drills quarterly. Celebrate departments that show improvement.

Why it matters: Simulations give users safe, hands-on practice recognizing and reporting phishing—before it happens for real.

---

4. Bait USBs (“Honeytokens”)

Bait USB drives (sometimes called “honeytokens”) test physical security awareness. The IT/security team places USB drives labeled “Payroll,” “Confidential,” or similar in public areas (lobby, parking lot, break room) and monitors if anyone plugs them into work computers.

• How it works:

  • USB contains only a harmless file or link to a security notice.
  • IT tracks who accesses it and follows up with private, positive training.

Best Practice: Pair bait USBs with reminders about the dangers of unknown devices. Never shame—always educate.

Why it matters: Attackers frequently use infected USBs to gain access to networks. Teaching staff not to trust unknown devices is crucial.

---

5. Walkthroughs and Live Training

In-person or virtual walkthroughs—short, interactive sessions—reinforce key security concepts and give users a chance to ask questions.

• Types of walkthroughs:

  • Live phishing “spot the phish” exercises
  • Demonstrations of how attacks work (e.g., a fake phishing call or email)
  • Q&A on security practices
  • Incident reporting walkthrough (showing how to report a suspicious event)

• Who should attend:

  • New hires
  • High-risk departments (finance, HR, IT)
  • All-staff meetings (annually or after major incidents)

Best Practice: Keep sessions practical, brief (15–30 minutes), and focused on real-world scenarios.

Why it matters: Live sessions build engagement, answer real concerns, and foster a security-first mindset.

---

6. Reporting and Positive Reinforcement

Encourage users to report suspicious activity—even if it’s a false alarm. Make the process easy and reward good behavior:

• Quick-report buttons in email clients
• Simple web forms or ticketing options
• Public recognition for staff who report real threats (“Security Star” awards)
• Friendly, prompt responses from IT/security staff

Best Practice: Never penalize someone for reporting, even if it’s a mistake.

Why it matters: Attackers only have to succeed once. Fast, widespread reporting is the best early warning system.

---

7. Measuring Success and Continuous Improvement

Track the impact of your awareness program:

• Training completion rates
• Phishing drill outcomes (click rates, reporting rates)
• Number of incidents reported vs. missed
• Survey feedback (“What topics do you want to learn more about?”)

Use this data to improve training, focus on weak spots, and show value to leadership.

---

Conclusion

Security awareness is every organization’s first line of defense. By providing engaging training, running regular drills, keeping security visible in daily communications, and building a culture of reporting, you empower your people to be vigilant and proactive. For IT managers, a strong awareness program not only reduces incidents but also creates a more resilient, security-conscious workplace.

---

Further Reading

• SANS Security Awareness
• CISA Security Tip Sheets
• KnowBe4 Security Awareness Blog
• StaySafeOnline (NCA)

References