Security Awareness Training.

What is security awareness training?

Security awareness training teaches the people in an organization how to spot and handle cyber threats. It is a program that runs over time, not a single event. NIST SP 800-50 Rev. 1 describes a life-cycle approach to building a cybersecurity and privacy learning program. NIST says this guidance is designed to work for organizations of all sizes.

How does a security awareness program work?

NIST says the program should encourage behavior change as part of risk management and lead to a privacy and security culture in the organization. NIST also says it should include suggested metrics and evaluation methods to regularly improve and update the program. The NIST publication covers awareness and training programs for people in different roles, and it lists education as a related topic.

What does it teach? A phishing example

CISA says phishing attacks are frequently preventable when you train employees to recognize and avoid suspicious messages. CISA says to train employees to watch for red flags such as strange or unexpected requests, urgent language or suspicious links.

CISA’s phishing guide lists more warning signs: urgent or emotionally appealing language, requests for personal and financial data, untrusted shortened URLs, and incorrect web addresses. As a simple illustration, a message that demands an immediate reply and asks for personal data matches several of these signs.

How should an organization keep it effective?

CISA says threats evolve constantly, so once-a-year training is not enough. It says to reinforce secure online practices regularly. CISA also says employees should know to whom and how to report suspicious emails or phishing attempts.

For individuals, CISA gives a three-step approach: recognize the warning signs, resist the temptation to click on links or attachments that seem too good to be true, and delete the message. If someone is unsure a message is real, CISA says to contact the organization directly using independently confirmed contact information, not the details in the message. CISA also says a well-trained workforce can stop attacks before they cause harm.

How does it relate to social engineering and phishing?

Social engineering means tricking people into acting, instead of attacking technology directly. Phishing is a well-known example, and it is the topic CISA’s training guidance focuses on. Awareness training addresses the human side of these attacks. Related terms are social engineering and phishing.

Is security awareness training the same as phishing training?

No. Phishing training covers one threat. A security awareness program is wider. NIST describes a cybersecurity and privacy learning program, which goes beyond a single attack type.

Is awareness the same as training?

The two words are often used together. NIST’s publication covers awareness and training programs and also lists education as a topic. When you plan a program, check which of these you mean, so that the goals and the way you measure them are clear.