SECURITY AWARENESS — THE HUMAN FIREWALL
Current security incidents clearly show that technical measures and security guidelines alone are not sufficient to guarantee the security of information and information-processing IT systems. As the weakest link in the chain, the human factor is increasingly coming into focus and is a popular target of attack.
In practice, it is apparent that employees in companies are very often not adequately prepared for this and the human “firewall” fails.
Awareness and training events
In customer-specific SEC4YOU seminars, the necessary elements of successful security awareness campaigns are taught. Based on psychological aspects and the typical challenges, the necessary measures for sensitization, education and regular training are covered. Live demos integrated in the seminar show how to plan a social engineering attack and which tools are typically used for this purpose (phishing emails, USB sticks, etc.).
Our approach to developing security awareness programs is to increase the maturity level of employee security awareness in stages, optimally implemented in the following order:
- Security Awareness Sensitization — regarding the potential threats.
- Security Awareness Education — training in the required courses of action
- Security Awareness Training — practical training in examples
Our seminar contents can be booked in modules:
- Current threat situation (What do we have to protect ourselves from?)
- Basic concepts of information security
- Psychological aspects
- Changes in the world of work (We work always and everywhere)
- Dangers of mobile devices and data carriers
- The password and its challenges
- Internet use as a potential risk
- Using WLAN securely (VPN)
- Risks of social media (Facebook, XING, LinkeIn, etc.)
- Phishing emails
- Recognizing and fending off social engineering attacks
- Development and implementation of security awareness campaigns
- The superior as role model?
- Sensitization of management
- Training through eLearning / lectures
- Flyers and posters as a means of raising awareness
- Live demo (phishing emails, USB stick (Rubber Ducky), etc.)
- Measurement of success (KPI)
Standardized and individualized online training
Employees can be sensitized and trained cost-effectively in individually retrievable online training courses on security awareness. These online courses are called up by the company for a defined number of employees and can be consumed by employees over any period of time. At the end of a course, questions about the content can document participation in a traceable manner.
Social engineering as an entry point?
In practice, it has been shown that IT audits specifically social engineering should only be placed once preparatory security awareness programs have been offered to employees, since without preparation the target state has not been clearly defined and trained. On this, see also our article Curing Cybercrime Blindness: Regaining Control.
- To verify the effectiveness of security awareness, SEC4YOU offers the following social engineering audits:
- Threat analysis through published information.
- Direct non-physical contact, e.g. through phishing emails and manipulated websites
- Non-face-to-face contact by laying out data carriers with special software
- Direct physical contact to obtain sensitive information
- Training to detect and defend against social engineering attacks
Development of internal security awareness campaigns
Internal campaigns that are accompanied by materials, give-aways and visual measures are suitable for raising awareness. Often these campaigns are implemented with the following tools:
- Newsletter
- Posters
- Sticky notes
- Comics
- Intranet banners
- Display
- Screensaver design
- Mouse pads
YOUR ADVANTAGES
- The best defense method against cybercrime.
- Gradual increase in maturity level through (1) sensitization, (2) education and (3) training.
- The security awareness seminars can be booked as on-site seminars or online seminars.
- Accompanying internal marketing measures are available for the security awareness campaign.
Questions about Security Awareness? Would you like to talk to an expert?
