The battle for cyber resilience seems like a tech war – hackers and their programs are on one side with cybersecurity arsenals on the other. But the human element is central to the romp cybercrooks are taking through the defenses of enterprises, small and medium businesses (SMBs), government institutions and all organizations in-between. And with remote work becoming the “new normal,” that risk is at an all-time high.
All this underscores the need for education; from entry-level employees to c-suite executives, workers are woefully unprepared for the cyberthreats they encounter. You can help your MSP clients tackle the problem by coaching them to embrace a two-pronged approach. They can increase their security by implementing both a clear-cut cybersecurity policies and ongoing security awareness training.
Cybersecurity Policies Don’t Just Define Ground Rules—They Also Educate
A well-developed cybersecurity policy can help your clients establish a foothold in employee cybersecurity education – especially when the policy explains why a rule exists. Instead of simply telling employees they must use a virtual private network (VPN) while traveling, you should explain that the Wi-Fi service at locations like coffee shops, hotels and airports aren’t secure. But by using the company VPN, they can encrypt their activity. This protects their data as well as company and customer data,
What should be covered in a cybersecurity policy? Several government agencies provide sound advice your clients can adopt. The Australian government, for example, suggests that policies should cover:
- Password requirements
- Email security measures
- Handling of sensitive data
- Rules for technology use
- Internet and social media standards
- Preparing in advance for an incident (that’s what cyber resilience is all about!)
- Keeping your policy current
Security Awareness Training Is Essential To Achieving Cyber Resilience
Security awareness training isn’t something your clients can—or even should—manage on their own. Security awareness training needs to cover a broad scope and, when delivered by market-leading vendors, is far more affordable and effective than an internal option. This is especially true for SMBs. A thorough program will cover:
- Cybersecurity fundamentals
- Malware
- Phishing and social engineering
- Best practices for working securely
- Safe social media use
- Hardware and physical access risks
- Website and software risks
- Email safety
- Password management
- More—the scope of cyberthreats changes regularly, and so do security awareness training programs
Final Considerations
At Cyber Resilience Zone, we recommend that you pick a provider partner that can deliver the entire spectrum of cyber resilience protection, including security awareness training. And when you’re evaluating training vendors, make sure the provider you choose also can help your clients with compliance courses, such as PCI DSS, U.S. HIPAA regulations, E.U.’s GDPR, the U.K.’s entire compliance slate and others.
Partnering with a leading provider that can deliver all your clients’ security training needs makes you look good, makes your job easier and provides meaningful protection for your clients in all the ways that matter.