Yazılım Kulübü

Cybersecurity training is a topic that has been discussed frequently in recent days. One of the reasons for this is that one of the biggest risks to cybersecurity is employee errors. Almost all phishing and ransomware attacks in 2020 were caused by human error. According to the statistics announced, the most known source of data breaches is human error. While unconscious employees cause attacks, conscious employees can be an important resource to ensure cybersecurity. We saw this at companies last year training their employees with effective and engaging cybersecurity programs. Thanks to employees who accessed the information they need to identify cyber threats through training, these companies have significantly reduced the number of phishing attacks. So how did these companies implement programs for their employees? In this article, we will give you information about 9 excellent cybersecurity training topics for companies.

9 Excellent Cybersecurity Topics For Companies: Company Specific Risks

In addition to these issues, companies should consider the most critical risks that concern their own companies and the field they work in when creating their cybersecurity programs. So, make sure that cybersecurity education programs cover the critical threats you may face. After analyzing these threats, support your cybersecurity program with the security awareness issues we encounter most today.

Here are 9 Excellent Cybersecurity Topics For Companies:

1. Secure password usage

Many of us use passwords to verify our identity when logging into websites. Most employees also access their online accounts using a username and password in this way while logging into the company system. Also, usernames are also usually e-mail addresses. If your password is weak, you become vulnerable. Here are some tips for using secure passwords:

• Avoid using the same password in all your accounts; use different passwords in your accounts.
• Avoid randomly generated passwords.
• Include at least one letter, one number, and one symbol in your passwords.
• Use password management apps to keep your unique and hard-to-remember passwords on your accounts.
• Choose to verify your identity with multi-factor authentication (MFA) whenever possible.

2. Safe internet usage

There are very few sectors today where the workforce works without being connected to the Internet. Especially with the coronavirus epidemic, almost all employees started to work on the internet. Therefore, your employees need to be aware of safe internet use. You can teach your employees what to do and what not to do while surfing the internet through cybersecurity training. Here are a few issues related to safe internet use that can be used in cybersecurity training:

• Illegal domain names. For example, facebook.org or faceb00k.com instead of facebook.com.
• Safe and unsafe connections and how to distinguish them. For example, checking for HTTP and HTTPS.
• Unknown source and unlicensed software and the dangers they may face when downloading them.
• Sharing personal information on suspicious websites.
• Unsafe, third-party downloads, watering hole attacks, worm phishing, and other types of attacks related to suspicious sites.

3. Safe Social Media Usage

The use of social media in companies is a tool used to increase brand value. But hackers also do not avoid using social media. They organize attacks through social media that put companies’ systems and reputations at risk. In case of such attacks and possible data breaches, companies should properly determine their social media usage policy and inform their employees about it. Here are a few things you can pay attention to when using social media:

• Remember that phishing attacks can find you not only in your email but also on social media.
• Hackers can deceive you by impersonating famous companies on social media, be wary of these attacks.
• Be careful what you post on social media; hackers can use the information you share against you in spear-phishing attacks.

4. Safe usage of tools such as USB Sticks, CDs, etc.

As we explained above, malware is usually transmitted from removable media such as USB sticks or CDs. Software that infiltrates your system through these tools can bypass the company’s network-based defenses. Especially the vehicles you use with the autorun preference are hazardous. Hackers intriguingly name these files to trick employees. When you run these malicious files, the software can steal your data, install ransomware, and even destroy everything on your computer. It would help if you taught your employees to avoid such attacks by:

• Do not use removable media that you consider unsafe.
• In case of doubt, deliver the removable media tool to the IT team immediately.
• Avoid auto-running removable media on any of your devices.

5. Safe Behavior in the Office or Out of Office

To protect yourself from phishing attacks, you need to be careful while browsing the internet. When using your computer or other devices, pay attention to the people you are with and the environment you are in. Here are some suggestions against potential security threats you may encounter:

• Watch out for people who might be watching you while logging into your account, especially new hires.
• Be wary of anyone who appears to be inspectors, officers, or IT officers.
• Don’t let people follow you into a room and wait for you to enter.
• Do not leave your password in written form in publicly accessible areas. Turn off your computer when you’re done and constantly use password protection.
• Do not leave your phone or device lying around where you run your company business.
• Check for malfunctions regarding door locks.
• Don’t leave sticky notes, papers, and prints containing sensitive information or personal matters on your desk. This is called a clean table policy. The table you use in the company and its surrounding should only have the necessary information. If there are any other types of files, put them in a safe place.

6.Data privacy

Today, the company works with large amounts of data. Big data has become one of the most important issues concerning the private sector. But how knowledgeable are your employees about collecting, storing, and processing sensitive information? Uneducated employees can cause hackers to obtain information about your customers, company plans. Protecting this sensitive information is essential for the proper functioning of the company. Otherwise, your company may face various penalties, or you may lose your customers’ trust. You can train your employees on the following topics:

• Your company’s policy on data storage and processing.
• Cybersecurity laws and regulations concerning employees.
• Storage areas and formats used for my sensitive data storage.
• Use of complex passwords and multi-factor authentication for files containing sensitive data.

7. Bring Your Own Device (BYOD) system

BYOD policies, which gained particular importance during the quarantine period, are essential for employees. Employees of companies that use a bring your own device policy can use their personal devices at the workplace. Sometimes this policy provides comfort and increases employees’ productivity, and increases the dangers they may encounter in places. That’s why companies working with the Bring your own device system should train their employees on:

• Using full disk encryption on personal devices.
• Downloading applications used on personal devices only from approved and licensed sites.
• Using a strong password on devices against theft.
• Approval of antivirus applications used on personal devices by the company.
• Using VPN when connecting to networks of unknown origin.

8. Phishing

According to 2020 statistics, phishing is one of the methods most used by hackers in attacks. In phishing attacks, hackers target employees through various communication tools to infiltrate the cyber company network. By sending messages to employees, they inform them about free gifts, high-paying job opportunities. By emphasizing that these proposals are short-lived, they aim to create a sense of urgency in victims and mobilize them. Panicked users easily believe these offers and fall prey to fraud.

Therefore, phishing should be the main component of cybersecurity awareness training. In particular, examples of phishing e-mails should be included in the training. You should strictly advise your employees to be suspicious of e-mails they receive in the following situations: If,

• the e-mail is from someone you do not know,
• the person sending the e-mail requests money or payment from you,
• your e-mail system is working properly and the suspicious e-mail is in your spam box,
• the email contains an unknown link,
• the email contains a malicious attachment.

In such cases, before clicking on the email, verify whether the person who sent the email is who they claim is by phone or another communication channel. Phishing attacks not only via e-mail but also via SMS, corporate platforms, phone calls, etc. Keep in mind that it can also happen through any communication tool. Use a safe and properly working security or antivirus program, and update the program you use frequently.

9. Malicious Software

Hackers often use malware to infiltrate your systems in cyber attacks. The software infiltrates your computer and captures sensitive data such as your identity information and bank account number without you realizing it. So, using this information, hackers can infiltrate the network of the company you work for. Ransomware is mostly used in attacks against companies. The software can enter your system in many different ways, such as phishing emails, files you download from unsafe sites, or USB sticks.

Employees must be given the necessary training to defend the company against this type of malware. Awareness training should include company policies, the threats it faces, and the effects of this software. Here is some advice you can give to your coworkers:

• Do not download unoriginal or unofficial software.
• Be wary of the emails you receive, the files you encounter on suspicious sites or elsewhere.
• Check if the antivirus program is working properly and update it regularly.
• If you suspect your computer has been infected with malware, notify your IT person quickly.

You Educated Your Employees About 9 Excellent Cybersecurity Topics For Companies. What’s Next?

1. Test their knowledge with Phishing Simulations.
2. Teach your employees how to use Incident Response tools.
3. Increase internal communication using our Threat Sharing tool.

Use these 9 excellent cybersecurity topics for companies and protect yourself using our anti-phishing solutions against phishing attacks!

“This post is originally published at www.phishing.org.uk”