Ep. 7: Security Awareness Training and Phishing Testing

Cybersecurity is not an IT problem to solve—it's a business risk to manage. In the Managing Cyber Risk podcast series, Mark Sangster, Vice President and Industry Security Strategist with eSentire, and Cybercrime Magazine’s Hillarie McClure lead conversations with cybersecurity experts, using the dollars-and-cents language of the C-suite to expose the issues, challenges and pitfalls which are often obscured by ones and zeroes.

Want to listen to the full episode instead? Click here.

Most of the devastating cyberattacks begin with a phishing email that tricks a user into aiding the threat actor. To increase resilience against this tactic, organizations turn to security awareness training and phishing testing. Often, these testing programs are combined into Phishing and Security Awareness Training (PSAT), typically structured as a set of lessons, tests, and simulations designed to teach employees how to avoid falling prey to phishing attempts and other cybersecurity threats.

PSAT programs recognize that behind all the technology that is often at the center of cybersecurity discussions, there are people—and those people can be manipulated and tricked by clever cybercriminals. But PSAT programs are not created equal, nor are they as simple as many people think, which means many organizations are not getting the results they want (or need).

As Mark Sangster, our VP Industry Security Strategy, put it in a recent Managing Cyber Risk podcast, “PSAT is something every company is likely doing [so the question becomes,] are they doing what’s necessary and moving the needle?”

Moving beyond a compliance mindset

Companies in highly regulated industries (e.g., healthcare and finance) or those that have a large number of professionals licensed by a governing body (e.g., doctors, accountants, engineers) are more likely to have a formal PSAT program as part of their compliance activities.

However, PSAT should be about business outcomes—about reducing risk and the consequences associated with cybersecurity events—and a compliance mindset can create a false sense of security.

Moreover, a risk-based approach to cybersecurity allows business leaders to direct investments in the most effective way with the goal of reducing risk over time. In a world of scarce resources, this approach leads to superior cybersecurity outcomes when compared to maturity-based or compliance-based approaches.

In Mark’s words, “When it comes to a successful program, it’s not about an hour of class time a year or making up a couple of fake phishing emails. You really need an integrated approach that’s manageable and that provides information you can feed up the chain to the C-suite or your board to demonstrate that you are delivering value—that you are reducing risk.”

Why do so many PSAT programs fail to achieve the desired outcomes?

Perhaps the biggest reason why many PSAT initiatives don’t deliver the desired results is because they start with an underlying assumption that users are irresponsible or stupid, and this fundamentally flawed premise shapes ‘training’ that is little more than definitions, jokes, and generic examples that are easy to spot. All that such training achieves is reiterating the stereotype that victims are at fault.

While it’s all-too-common to scapegoat employees for their mistakes, or to act like threats are self-evidently obvious, the reality is that cybercriminals are extremely skilled at disguising their lures. So, the first step in conducting effective Phishing and Security Awareness Training is to recognize and accept that:

• Criminals are extremely skilled and will put great effort into their activities
• Your business is a target–you are not too small, too big, too boring, too well-defended, etc.
• Your employees are not idiots, and they’re not to blame if they get tricked

Look at your employees as an important part of the solution to a problem that has claimed many sophisticated victims and treat your team with the respect that is warranted of such a crucial role. Then, make sure your team is aware of the six common causes of failure that have undermined many PSAT initiatives and ensure you don’t fall victim to them.

What makes a PSAT program effective?

It’s critical that PSAT programs leverage realistic threat scenarios that foster context-relevant (e.g., tailored to your industry and risks) security awareness, rather than using commoditized and easy-to-spot templates that are increasingly relics of the past.

Consider the structure of the program and look for programs that:

• Provide user-specific training to drive security awareness and behavioral change, deconstructing/dissecting what cyber threat actors do—with relevant examples
• Tests user resiliency and their ability to identify and avoid the latest phishing tactics and campaigns
• Identifies and measures improvement, including high-risk users and groups, and reduces risk associated with their privileges and access
• Alleviates resource constraints by reducing the burden on cybersecurity teams to deliver training and to manage security operations—bringing in a vendor should lower your team’s workload, not increase it!
• Meets regulatory requirements, helping you and your employees to comply with state, industry and professional regulations and obligations

Effective PSAT programs deconstruct the tools, techniques, and procedures (TTPs) that cybercriminals employ using relevant examples.

Mark speaks with many business leaders, and he often must remind them that PSAT is more important and more involved than they initially perceive it to be.

“This isn’t a simple thing to do. A lot of people in the security world think it is: buy a tool, choose from some templates, do a presentation once a year. It’s far more than that—it’s about creating a comprehensive program and demonstrating that you’re protecting the business.”

Remember, PSAT is about real business outcomes, not simply checking a box.

Learn more about implementing your own PSAT program

Listen to the full Security Awareness Training and Phishing Testing episode of the Managing Cyber Risk podcast series as Mark Sangster and Hillarie McClure discuss cybersecurity awareness training and phishing testing, how these help improve business resiliency by reducing the risks associated with human-targeted attacks, commonly held misconceptions about these important programs, and much more.