National Cyber Security Training Academy

If your company is like most, you’re spending an awful lot of your  information technology budget on security: security products to protect  your organization, security consultants to help you understand where  your weaknesses lie, and lawyers to sort out the inevitable mess when  something goes wrong. That approach can work, but it fails to consider  the weakest link in your security fence: your employees (FORTUNE, June 2016).

The most basic thing that every organization needs is security awareness training. Security awareness training is all about teaching your colleagues and employees to understand the risks and threats around the ever evolving cyber world. The main purpose is to ensure that these people realize that hackers within organized gangs of cyber criminals will try to deliberately attack, steal, damage or misuse your organizations systems and information, and that therefore everyone within the organization needs to be aware of the associated risk, and thus work to adequately protect the organization against these risks.

Protecting your organization begins with ensuring your employees are prepared to assist in keeping your computers and networks safe. The strongest security asset is already inside the company: the employees.

What types of risks do your employees pose to your organization?

• A network is more vulnerable to attacks if the passwords are weak
• Failing to update important security patches allows criminals to infiltrate the system and steal valuable data
• Download unreliable files from the internet or from spam emails can allow hackers to install silent malware on your network
• Falling prey to a social engineering attack

Social Engineering is one of the most sophisticated, nontechnical ways of stealing valuable data. It involves finding the weak link within an organization and exploiting that vulnerability. Once the target is identified, data and information about the person in question are gathered from various sources such as social media and a phishing attack will be initiated with the intent of tricking that person into conducting a certain action such as downloading a file or opening a malicious website. The level of sophistication and design of the phishing attack will vary depending on the abilities and effort of said attacker but the outcome can be catastrophic and an easy entry point for cyber-criminals.

This can be avoided with smart security training to cover methods of detecting these attacks and reducing the risk of this happening to your organization.