Cybersecurity Awareness Training to Fight Ransomware
Advanced technologies allow organizations to discover, assess and mitigate cyber threats like ransomware. But truly strong cybersecurity also requires a threat-aware workforce—prompting more and more enterprises to focus on cybersecurity awareness training and testing.
Save to Folio
Organizations need advanced security tools to defend against cyber threats like ransomware, but technology can’t address every vulnerability on its own. Where human factors increase risk, regular, reinforced cybersecurity awareness training can help build a vigilant workforce. Backed by well-tested cybersecurity plans, cyber-aware employees can become an extra—and vitally important—layer of defense for any enterprise.
For a well-rounded security posture, organizations need not only advanced technological solutions but also effective employee cybersecurity awareness training and regular testing of cybersecurity plans. Discover practical tips in our latest ransomware blog.
Advanced cybersecurity tools vastly expand the ability of an enterprises to defend against ransomware and other threats. They can monitor for anomalous behavior, detect suspicious patterns, automate response actions, and continually strengthen the overall security posture with artificial intelligence (AI) and machine learning.
Yet not all vulnerabilities are addressable with technology, especially not those introduced by human beings and the decisions they make. And these can have a significant impact on cybersecurity effectiveness.
A 2021 research paper on the Impact of Human Vulnerabilities on Cybersecurity found that “...more than 39% of security risks are related to the human factor, and 95% of successful cyber-attacks are caused by human error.... The major human factor issue in cybersecurity is a lack of user awareness of cyber threats.”
Many organizations that recognize the importance of human factors are creating cybersecurity awareness training programs for employees. But even with a cyber-vigilant workforce, one further piece of the puzzle needs to be in place for a well-rounded defense: regular and rigorous testing of cybersecurity measures to be sure they’ll deliver the right results when required.
Cybersecurity awareness training is the foundation
There are many different ways to cultivate employee cybersecurity awareness. Organizations can issue periodic prompts and reminders to keep workers’ attention on cyber risks. Others may go further and build formal cybersecurity awareness training programs that incorporate explainer-type documents, videos and other content formats to shed light on how threats work, what they target and how to identify them.
Special events such as Cybersecurity Awareness Month, which occurs each October, provide occasions to spotlight cybersecurity, though limiting focus on the issue to once a year may not be frequent enough to produce deep, lasting results. As a general practice, regular reinforcement and updates help keep training fresh and top-of-mind.
Organizations can also augment training with practical exercises to test employee learning. Trend Micro’s Phish Insight, for instance, allows enterprises to construct and execute automated phishing simulations, complemented by customized cybersecurity awareness training. Simulations like these can be excellent tools for bolstering security awareness, especially when carried out repeatedly and fairly often—once a quarter or so.
Specialized cybersecurity training is also critical
When all employees have a basic knowledge of cybersecurity, the organization as a whole is better protected against the risk of threats like ransomware. But some groups may need customized or tailored sessions based on the risks they face. Every organization will likely have its own particular pockets of risk that require this kind of additional attention.
Workers involved in financial transactions, for example, may need more in-depth instruction on how to watch for potentially fraudulent activity such as business email compromise schemes, which use official corporate email accounts to initiate illegitimate wire transfers.
Human resources staff may need specialized training to protect private and personal information about employees—including health insurance information, social security numbers, home addresses, and more—which can be lucrative for cyber criminals.
Certain technical personnel will also need deeper training to protect the enterprise. Since cloud misconfigurations are a significant source of security risks, cloud administrators should be trained on new technologies and proper configurations, and cloud architects should receive additional security training so that they understand not only the infrastructure they’re responsible for but also the security ramifications of decisions they make.
Software developers are another key employee group that benefits from specific, targeted cybersecurity training—so they can develop code that remains secure throughout its entire lifecycle and build security into their full, end-to-end process from development to deployment.
Organizations don’t necessarily need to develop this kind of training themselves: cloud providers should be able to offer training specific to their cloud platforms, and most security solution and software vendors will have training offerings too.
Put your cybersecurity plans to the test
Cybersecurity awareness training helps proactively secure the network against threats such as ransomware. But when breaches occur—and they will—organizations also need to be confident in their ability to respond and defend their data and systems. As mentioned in our previous blog, having a well-defined incident response plan with business continuity measures is central to that. And the only way to know for sure that the plan will provide the intended protections is by testing it on a regular basis, at least once a year.
NIST has published guidance on how to plan testing and training programs in its Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities. Putting security protocols through their paces also often requires the specialized expertise of a penetration testing group, called a ‘red team’, that can try to infiltrate the network and simulate what attackers would do.
Larger organizations might maintain red team skills in-house, while others may choose to outsource the function to a managed security service provider or other experienced third party. Some unified security platforms have third-party attack simulation capabilities and vulnerability scans built in, making it easy for an organization to manage test events, collect data on the exercise and generate actionable results.
Match cybersecurity awareness training to your level of risk
Deploying cybersecurity technologies and administering training and testing all come at a cost. While there is no hard figure, Statista reports that, “On average, companies worldwide allocate at least 12 percent of their IT budget to information security.”
Organizations can control their training and testing expenditures by ensuring they align with their actual risk profile. That requires a clear understanding of the enterprise attack surface, where vulnerabilities reside, and which pose the most urgent and relevant risks—since not all parts of the business, types of data, or devices are equally vulnerable or high-value. An attack surface risk management solution can help shine a light on what matters most.
Cybersecurity awareness training can also be focused by prioritizing employees who present the greatest risk to the organization, such as anyone who has clicked on a phishing link. These can be identified by tracking security incidents with a unified cybersecurity platform, and by evaluating the results of regular simulation exercises.
Targeted, well-reinforced cybersecurity training complemented by regular testing of security plans and systems will round out any organization’s overall security posture and provide further capabilities to detect, assess, and mitigate ransomware and other cyber threats.
Next steps
For more Trend Micro thought leadership on cybersecurity awareness training and attack surface risk management, check out our other ransomware blogs.