Five tips for creating a meaningful security awareness training program

There's a big difference between having a cybersecurity awareness training program, and having one that actually makes a difference to the security positioning of an organisation. So how can you ensure that security awareness in the workplace becomes a reality for your end users? The answer that gets thrown around all too often – by those who don't actually have to get hands-on with implementation – is to “make security awareness part of the DNA of the business.” Truth be told, that isn't a methodology but rather a destination; what you need to be doing as a managed service provider (MSP) is not only build the road that leads there, but also ensure it is adequately sign posted.

With that in mind, here are five things to remember when crafting a cybersecurity awareness training course:

Make it personal
Sorry to burst your bubble, but employees tend to care less about the business (at a technical level) than you might think. This is one of the reasons that cybersecurity awareness in the workplace isn't, on average, as good as it should be. The really simple way to combat this is to make your awareness training personal. By which I mean that it should provide the kind of advice that an employee can take home with them, and apply out of the workplace to help secure their personal data.

In doing so, you will find that it quickly becomes second nature to apply the same skills in the workplace. The worst thing that you can do is make security awareness training a boring and non-personal lecture. I'm not saying it has to be fun, fun, fun all the way but it does have to be relevant to the individual as well as to the business they work at.

Get up close and … personal
One of the ways of making awareness training more personal is to make it less remote and clinical. Online learning tools should obviously play their part in any security awareness training program that includes 'cyber' in the remit, but 'part' is not the same as 'whole' and you need to remember this.

The best security training, the sort that leaves a lasting impression and actually instills the kind of security awareness in the workplace that you’re aiming for, comes from face-to-face sessions. Only by asking questions, and getting considered answers from someone who has done their homework and understands the issues, will employees actually become properly 'aware' of risk and how to mitigate it rather than the much less useful (about as useful as a chocolate teapot, in fact) act of just being 'notified' about risk.

So, for sure, include interactive phishing simulations to teach employees about how to spot the signs of social engineering in action; but follow this up with one-to-one (or group) sessions where their questions can be answered and mitigating procedures discussed.

Make it clear
Clarity is everything, so don't beat about the bush when creating a cybersecurity awareness training program. Only by ensuring that the employees taking the course fully understand why policies and procedures are in place, what the consequences to the business and to them personally are of not following those procedures, and clearly communicating the joint responsibility nature of security will your client’s security positioning be strengthened.

In order to get this clarity within the course itself, you have to understand exactly what is being taught in the first place. That may sound obvious, but you'd be surprised how many security awareness training programs are templated and ill-researched. The best ones rely upon you knowing the client, the client's business and the security threats that can impact upon them the most.

This isn't to say that you can't have a basic template structure, but you do need to flesh this out with relevant and researched content rather than cut and paste stuff from a customer service-like script. It's all about engagement, and that starts with you engaging with the subject matter.

Make it dynamic
The security landscape is constantly changing, which means that security awareness training needs to be dynamic in order to keep up. This doesn't mean that the whole thing needs to be rewritten every six months, but it does mean that the 'researched and relevant' point from the previous tip needs to be carried forward within regular updates.

It doesn't need to be extensive, nor does it need to reinvent the wheel in terms of getting everyone back in the classroom; email is your friend here, and those updates can take the form of scheduled mailouts. In order to ensure they are read it's a good idea to mandate a 'seen by, on, any questions' type response. At the end of the day you have to bear in mind that the most successful security awareness training methodology will be the one that understands there is no completion date, and no structured timeline, but instead looks at it as an ongoing development of a culture of security within your client's organisation.

Make it positive
Perhaps the single most important thing to bear in mind when tasked with creating a program to improve security awareness in the workplace is the power of positivity. By which I mean that it's way better to lay off the 'Thou Shalt Not' statements and focus instead on getting things done in a secure manner that benefits everyone. Of course, there are going to be a few 'policy dictates you must not' rules in there but they should be in the minority and only used when absolutely necessary.

By way of an example, think of the Bring Your Own Device (BYOD) debate. The temptation may be to dictate within such an awareness course that personal devices must not be used for work purposes, but it's much more effective to illustrate the risks of doing so and then explain how such devices can be used in a secure fashion that mitigates the risk.

Although these are obviously just a starting point. Where you end up is, ultimately, down to you. The main thing is to understand that common knowledge is the key to instilling common sense in the workforce; without that knowledge they cannot act safely upon it. Much as I hate to say so, it really is all about aiming at the endpoint of changing the security culture at an organisation for the better, to make security part of the DNA… dammit!