The risk panorama strikes quick. As new assault strategies and social engineering strategies seem, organizations want to keep up security consciousness packages which can be related, agile and targeted. Analysis from Proofpoint for the 2024 State of the Phish report discovered that the majority companies used real-world risk intelligence to form their security consciousness packages in 2023. That makes us glad!
At Proofpoint, we all know it’s important to make use of threats and tendencies from the wild to show your workers about assaults they could encounter. It’s equally essential to make sure that your program isn’t instructing them about security subjects which can be not related.
On this article, we focus on 4 important greatest practices to assist maintain your security consciousness and coaching content material each recent and threat-driven:
- Analyze actual risk tendencies to remain present and related
- Use real-world threats to tell your testing and coaching
- Refresh your coaching plan in order that it’s related and correct
- Be sure that security practitioners keep on high of content material modifications
The human-centric danger of not preserving it recent
Let’s first speak about what occurs whenever you use outdated risk content material to coach your workers. The outcomes can create important human-centric danger for your corporation as a result of your workers may strategy security with unsafe habits resembling:
- Having a false sense of security about their information. Individuals may consider they’re nicely ready to determine and reply to threats, resulting in actions primarily based on incorrect assumptions.
- Not responding successfully to focused threats. Individuals may make choices primarily based on incorrect assumptions, rising the opportunity of profitable assaults particular to their function or business.
- Incorrectly reporting a security incident. Outdated coaching content material could give incorrect procedures for reporting and responding to security incidents.
- Being noncompliant with business laws. Outdated content material may not match the required compliance coaching, exposing your organization to potential authorized and monetary penalties.
- Being unengaged in your security tradition. If workers understand security training as outdated or irrelevant, they could see security duty as a waste of their time.
Now, let’s speak about our 4 greatest practices to assist be sure that none of this occurs.
1: Analyze actual risk tendencies to remain present and related
Informing your program with risk intelligence is a should. Actual-world insights will assist your workers perceive the scope and impression of the threats they could face. It’s going to additionally allow your security groups to tailor their coaching and messaging accordingly.
To make use of risk intelligence successfully, security consciousness practitioners should work collaboratively throughout their organizations. You need to perceive the assault tendencies that the security practitioners who monitor, analyze and examine cyber threats see in actual time. These practitioners may be your incident response group or your security operations heart (SOC) group.
At Proofpoint, we’re dedicated to staying on high of the newest threats and passing this info to prospects. The Proofpoint Safety Consciousness resolution is constructed on insights that we collect from analyzing over 2.6 billion emails each day, monitoring 430+ million domains and monitoring tons of of risk teams to remain forward of attackers. We do that by collaborating with our in-house Risk Intelligence Companies group and utilizing their insights in our built-in risk platform, which ties e-mail monitoring and remediation to human danger detection and training.
Latest insights from real-world tendencies embody:
- Phone-oriented assault supply (TOAD). Within the 2024 State of the Phish, we reported that TOAD assaults stay prevalent. Proofpoint researchers noticed a median of 10 million TOAD messages despatched each month in 2023, and over 13 million TOAD assaults at their peak in August 2023.
- QR code phishing. In latest months, our analysis group has seen a rise in attackers utilizing malicious QR codes as a substitute for hyperlinks and attachments. This method is especially harmful as a result of it presents a well-recognized format in an unfamiliar phishing context.
- Generative synthetic intelligence (GenAI) scams. We see GenAI strategies resembling deepfakes and conversational scams on the rise. Attackers can use AI fashions to create extremely convincing message-based assaults, resembling personalizing for particular person recipients and translating fluently into many languages.
2: Use real-world threats to tell your testing and coaching
As folks change into extra subtle at detecting phishing (and all its variations), attackers discover new methods to embed malicious content material. That’s the reason it’s crucial for security practitioners to remodel real-world threats into related coaching and consciousness initiatives.
By coaching workers on methods to detect and reply to the newest threats, you possibly can strengthen your general security defenses. Contemplate strategies resembling real-world testing with risk simulation, participating bite-sized coaching about trending subjects and well timed communication to workers a couple of latest assault. As an example, you may:
- Run QR code phishing simulations for payroll and finance groups to elucidate the real-world pattern of malicious QR codes
- Present coaching movies to warehouse workers on the much less widespread however nonetheless evergreen malicious USB drop
- Ship company-wide emails and distribute screensavers about being vigilant with telephone calls, each at residence and work, because of AI-generated conversational scams
Proofpoint Safety Consciousness strengthens the essential connection between training and threats by repeatedly releasing new threat-driven content material. This contains Risk Alerts, that are weekly information bulletins targeted on a selected assault recognized by our risk analysts or collected by means of open-source analysis. We additionally launch month-to-month Attack Spotlights, which forged a wider lens on a selected risk assault that’s international in nature and rising in prevalence or anticipated to pattern quickly.
3: Refresh your coaching plan in order that it’s related and correct
Thus far on this submit, we have now targeted on the significance of incorporating related risk tendencies and real-world threats into security coaching. However including extra content material to handle rising threats is just one a part of an efficient plan. Contemporary content material and common updates additionally maintain cybersecurity high of thoughts together with your customers and assist to advertise a proactive security tradition.
When refreshing your coaching plan, get again to the fundamentals and contemplate these 5 facets:
- Who must be educated? For instance, are assist desk workers educated on the newest techniques used to entry accounts? Is your finance group conscious of how attackers use GenAI to enhance messaging in enterprise e-mail compromise (BEC) scams?
- What do it is advisable practice on? As an example, are there business laws that sure roles have to be educated on? Has there been a security incident or risk pattern that individuals ought to pay attention to? Is the aim of the coaching related for all or a few of your learners?
- The place are you working your initiatives? Are you at all times working coaching on-line or in individual? In that case, are you able to inform if that has been efficient? What channels do you utilize to ship the messaging to your workers? Do your customers discover?
- When are you working your initiatives? Do you solely run coaching every year? In that case, you may contemplate extra frequent coaching to assist be sure that you ship well timed info on the newest in threats.
- How are you updating the content material? Are your learners watching the identical content material annually? Does your phishing coaching require a refresh in recommendation and steerage? A earlier customary was to level out pink flags resembling poor grammar and spelling. Nonetheless, emails written with GenAI can now simply keep away from these errors.
In Proofpoint Safety Consciousness, we recurrently assessment, replace and take away content material as wanted. As an example, we just lately eliminated COVID-19 materials because of its decreased relevance. We additionally up to date our GDPR content material to mirror latest modifications.
Once we assessment our content material, we pay shut consideration to range, fairness and inclusion in the way in which that subjects are formed and characters are designed. We take a look at our content material for accessibility to make sure it may be utilized by federal, state and native governments.
We take a look at this refresh as assist for our continued improvement to streamline the work of security practitioners. And that leads us to our closing greatest follow!
4: Guarantee security practitioners keep on high of content material modifications
We hear you: Safety practitioners juggle a number of guide work for content material administration. It’s essential to attenuate the time and assets required to construct and develop your consciousness program. Usually, this implies utilizing instruments that streamline your content material workflow with built-in processes and automation.
In Proofpoint Safety Consciousness, we repeatedly streamline our Content material Library and enhance its options. Latest updates embody:
- Integrating a central content material repository. Our phishing templates, coaching modules and consciousness materials share a single pane of glass, so you possibly can shortly develop and deploy a phishing simulation marketing campaign and follow-up coaching.
- Increasing the filters for a streamlined expertise. Now, you possibly can extra simply discover, view and entry content material, like looking throughout standards like domains, assignments, simulations, materials and languages.
- Offering a go-to place for viewing content material updates. The revamped Useful resource Heart has a piece devoted to what’s new in Content material & Risk Alerts, resembling threats detected by our analysis group and newly launched content material items.
- Making it simpler to see content material modifications. For instance, new visibility buttons present whether or not Proofpoint content material will likely be retired or will attain finish of assist (EOS).
Reduce your human security danger with Proofpoint
- For security training to drive steady enchancment, you should maintain your content material related and reflective of present security risk tendencies. It’s simply as essential to maintain a recent and versatile strategy to the way you produce and ship that content material to your customers.
- Publicity to related threat-driven content material helps domesticate a security-conscious tradition in your group. Within the occasion of a security incident, workers educated on the newest threats will likely be higher ready to reply—and achieve this shortly. Coaching plans and content material can present the information, abilities and procedures for folks to deal with potential dangers and their very own vulnerabilities extra successfully.
- At Proofpoint, our objective is to at all times assist workers view cybersecurity as a shared duty and to assist security practitioners decrease the human danger to their group.
- You may view samples of our security consciousness content material right here.
