It’s Friday. In 13 minutes, your employees will be charging into the carpark screaming “freedom” at the top of their voice. The weekend is here. That’s when Dave from Procurement receives an unusual email from a supplier.
At first glance the message appears to legitimate. But something about it doesn’t sit quite right. The supplier is asking for new bank details. There’s a link to a Microsoft 365 login page. Something about the wording doesn’t seem right either.
Dave has recently completed his cybersecurity training, so he recognises that the email might be suspicious. However, recognising the potential threat is only the first step.
Would he know who to report it to? Would he report it immediately, or decide to deal with it on Monday? If he had already clicked a link or entered information, would they know what steps to take next?
The important question is not simply whether your employees have completed a course or understand the basic principles. Businesses need to consider their employees actions when something suspicious happens during an ordinary working day.
Recognising a threat and responding are different things
Most cybersecurity training covers the signs that employees should be looking for. They’ll have seen examples of phishing emails, suspicious links, and requests for sensitive information. And this is important to show staff, yet real incidents are seldom presented this clearly.
A fraudulent request may use information taken from the company's website or social media accounts. A message may arrive from a compromised email account belonging to a real customer or colleague.
And of course, there’s the employee themselves. Can they make the decision whilst they are working, or distracted? They may be pushed for time.
Good cybersecurity training should therefore go beyond teaching employees how to identify threats. It should also provide clear guidance about what they should do when they encounter one.
Why Friday 4:47pm matters
Employees don’t receive cyberattacks under controlled conditions. A request picked up at a quiet period might be spotted easier than if it were received when the employee had 9 tasks to finish before going home.
An employee might receive a message stating that a payment must be made immediately. Their account will be suspended unless they act. A senior colleague urgently needs assistance. All of these require a quick response rather than consideration.
Cybersecurity training needs to reflect these circumstances. Employees should understand that an urgent request is not necessarily a legitimate request and that taking a few minutes to verify something is usually preferable to responding quickly to a fraudulent message.
Staff shouldn’t have to decide if an incident is serious
It is perhaps this uncertainty that means security incidents go unreported. Do they think it’s a genuine problem? Who will they annoy if it isn’t? Should they investigate it themselves?
Employees should understand that they are not expected to diagnose a cyber incident. Their role is to report something that appears suspicious so that the appropriate person can investigate it.
Staff should be encouraged to report concerns without worrying about whether they can prove that an attack has taken place.
Every employee should know what happens next
Different types of incidents will require different responses, but employees should have a clear understanding of the procedures that apply within their organisation.
They should know:
• Who to contact if they receive a suspicious email.
• What to do if they click a malicious link.
• What to do if they have entered credentials into a fraudulent website.
• How to respond to an unexpected MFA request.
• Who to contact if their device begins behaving unusually.
• How to report a lost or stolen device that has access to company systems.
Businesses should also consider whether employees know how to report an incident outside working hours. A potential cyber-attack discovered late on a Friday afternoon may require action before the next Monday.
Cybersecurity training should be regularly reinforced
A single training session will not ensure that employees remember every aspect of the business’ cyber-protocol.
People forget information that they do not use regularly, and the types of threats businesses face also continue to change. An organisation that provides the same training year after year may eventually find that its employees are well prepared for threats that are no longer the most significant risks.
Regular updates are a more effective way to keep cybersecurity procedures fresh in employees' minds. These do not necessarily need to involve lengthy training sessions. Short reminders, practical examples and updates about current scams can help reinforce the information employees need to remember.
The purpose of cybersecurity training
The value of cybersecurity training should not be measured solely by completion rates. It’s the comprehension that matters. How does the training translate to the real world?
Cyber incidents will not necessarily happen when the IT team is available, when senior staff are in the office or when employees have time to carefully analyse every message they receive.
This is why a business should regularly review their cybersecurity training. Employees need up-to-the-minute information and clear instructions.
A cybersecurity course may show that an employee has completed their training. What matters in practice is whether they know what to do when an unexpected situation occurs during a normal working day, whether that happens at 10am on a Tuesday or 4:47pm on a Friday.
If you would like to discuss your cybersecurity with us, please don’t hesitate to contact us on 01327 300 311,
or email [email protected] with your enquiry.
Share this post: