While some security awareness programs start without a hitch, others may cause unintentional confusion and require additional support. We've compiled the critical elements an MSP needs to communicate to their client's employees before launching a security awareness program.
Keeping an open line of communication before launching your employee security awareness training can help reduce confusion and enable a quality program that actually works. With the following building blocks, your program can more effectively meet your cybersecurity needs and engage employees.
While user awareness is nothing new when it comes to MSP security, cyberattacks are constantly evolving, escalating and threatening your company's data. Consider these tips for educating and raising awareness in your employees.
One of the first things you should do before launching your security awareness program is communicate why it's important. Discuss your employee's current knowledge and understanding of company security and areas that could use improvement. Define your security goals and objectives for providing phishing assessments, such as to increase incident reporting or reduce data privacy incidents.
At the end of the day, it can be hard to communicate, “We do this because we’re required by cyber insurance policy and popular security framework.” However, what can be communicated are the results you’re looking to create. Here's an example of how you can educate employees on phishing assessments:
“We will periodically send fake phishing emails to test alertness, never to punish. Mistakes will happen and that is perfectly fine! Don’t sweat it! But we should all aim to get a little better every day. Please remember, when you mistakenly fall for a phishing assessment, it’s okay. Take the short training and learn from the mistake! We’ll be here the entire time to help you along the way.”
With Phin, we have created a concept for immediate training you can see here: Phin Demo Blast. Think of it as a personal trainer for your employees instead of at-home workout videos. Educate in 15 seconds on what they missed and help the employee build a habit they can take with them moving forward.
Having your employees dive into training with little preparation may not be an effective way to motivate them. Be sure to communicate several important details, such as:
Security Awareness is a unique space in cybersecurity because it is one of the only pieces of the cybersecurity program that every employee will get to see. It is paramount that you, as the cybersecurity expert, explain to the people who are participating in the program what kind of training they can expect. This will help them manage not only their expectations but also help them understand what expectations their leadership might have of them.
It is beneficial to describe the general content up front, the training format and how often / how long their training will take. A statement as simple as “… some of the training you will take will be general security awareness such as recognizing social engineering and how to store sensitive information properly. It will be no more than 6 minutes long with a few quiz questions after and will be delivered approximately once a month.”
Perhaps the most significant hiccup to an otherwise smooth rollout is when enrollment emails get sent out, and everyone reports them as phishing emails. On the one hand, good on the employees, on the other hand….. a lot of support tickets. We have started educating our partners to communicate precisely what employees can expect, even going so far as to provide the exact email templates into which you can fill in your information.
Here is what works best: Send an email (make sure it comes from a trusted source, ideally a stakeholder or leader of the client) that introduces the training and why it’s crucial for employees to complete it. In this email, include:
Here's an example:
“The emails will look like this (include picture); they will come from xxx@yyy.com or yyy@xxx.com always, and will ask you to click a link that you can see in this image here to log in and complete training. When hovering over the links in these emails, you will always be directed to recognizabledomain.com. We will never send a phishing test from any domain like this, and we will never ask you to visit any website other than recognizabledomain.com. If you ever suspect someone is attempting to phish you like this, please report it.”
Communications as simple as this, when delivered ahead of enrollment notifications and phishing assessments, have always reduced headaches and have allowed for a smooth rollout.
Security awareness training is invaluable for any organization. If your MSP implements a security program correctly, you can prevent a variety of cyberattacks that could affect your company's data and infrastructure. Remember, the most robust security tools in the world won't compensate for a lack of employee awareness. As cybercriminals have evolved to target employees personally, it's critical to foster a culture of effective cybersecurity.
At Phin Security, we take a unique, engaging approach to changing employee behavior through social engineering and phishing simulations. We provide user-friendly, automated training to help keep your employees vigilant. Any additional questions to ask? Anything specific you would like our expert opinion on? Reach out to Phin or start your free trial today.