Was sind die besten Möglichkeiten, einen Anbieter von Schulungen zum Sicherheitsbewusstsein für Ihr Unternehmen auszuwählen? (2024)

(bearbeitet)

Assess your current situation help to identify what are the weakness of your employees. Then identify what you need to attend your goal.Assessment help to well design your goal and objectives.Make sure you have 2 road maps :1. Road Culture for your non IT employees.2. Road Skills for your IT staff.

Übersetzt

Peter Drucker- culture eats strategy for breakfast. For any successful deployment the user community should endorse it.More than assessing the current scenario the project needs to ensure that the user community is taken into confidence and what benefits the organisation will get and what is the current situation. Else whatever technical control is around the attacker needs just a single vulnerability around.

Übersetzt

When I've been in charge of Security Awareness training, I consider that it has to work for both veterans at the company as well as people on their first day, from Information Security professionals, to people who have zero experience with data protection, compliance, and regulations. I've been surprised at times how even "simple scenarios" are "new information" to veterans in IT. Make sure you include the total scope of what you are trying to address and then work from the base layer up. Adding modules as you move up the knowledge chain is perfectly acceptable, assuming that someone knows what is expected of them, is the start of problems down the road.Better to bore people who are familiar than gloss over what new people need.

Übersetzt

When selecting a security awareness training provider for the organization, we can consider factors such as:Reputation: Look for providers with a solid track record and positive reviews from other organizations.Content Quality: Assess the quality and relevance of the training materials. Ensure they cover a range of topics and are up-to-date with the latest security threats.Customization Options: Choose a provider that allows customization to tailor the training content to your organization's specific needs and industry.Engagement Methods: Check if the training employs diverse and interactive methods, like simulations, to keep participants engaged and enhance learning.

Übersetzt

In today's technology-driven world, staying educated and alert is crucial for personal security. Assess your security awareness to strengthen defenses. CompTIA Security Plus certification provides a solid foundation, and platforms like LinkedIn offer diverse security courses. Regularly invest time in education to stay informed about the latest trends and threats. A proactive approach to security awareness can save you from potential risks and financial losses. Stay educated, stay alert, and adapt to the ever-changing landscape of cybersecurity to fortify your personal security posture...!!

Übersetzt

While this could be boring to many people, build a cross-functional team and define your requirements and weight/force rank them. Make sure to include people from non-technical and non-security teams. Then as you go through the vendors and their products make sure you're actually evaluating the product against your requirements. If you've never done this before, find a product owner / scrum master in a development team to help you document your requirements in a way that is measurable quantitatively and qualitatively so you understand which products measure up to your needs.

Übersetzt

(bearbeitet)

A few things to unpack here... will take each in turn.What do you want to achieve with the training? At a pan-organisation strategic level this typically is 'reduce the risk of data security incidents'.Using the training needs matrix defined in the prior step, you can drill down into the different roles, review their business objectives and work with them to articulate how security contributes to their objectives and from this, extrapolate the more granular training objectives for the team.EDIT: Apparently not allowed to contribute multiple times so will add to my 'articles to write' list instead ✍🏾

Übersetzt

It is better at this point to make sure that your goals are well defined.- Employees in IT Cybersecurity skills- All employees Cybersecurity habits in every area of your company- Cybersecurity culture within the your company. All these 3 goals must be aligned to protect and prevent the company's assets. And to react when an issue happened.

Übersetzt

The individual acknowledges the omnipresence of security threats affecting individuals and organizations. They emphasize the importance of constant vigilance against identity theft and hacking, expressing their commitment to staying educated. They actively seek knowledge from reliable sources such as KnowBe4 and Professor Messer's network security videos on YouTube. The person's proactive approach aligns well with the objectives of security awareness training, contributing to personal and collective cybersecurity. Staying informed and emphasizes the positive impact of your efforts on creating a more secure digital environment...!!

Übersetzt

As well as your immediate outcomes, consider your longer term objectives. Where do you want people to be in terms of security understanding in future as well as now? Do you want to be building specialist security expertise, or embedding a fundamental understanding as widely as possible? Are your objectives and outcomes the same for all areas, or do you need to consider different approaches?

Übersetzt

I would divide this into several major phases:Analysis of Current User Knowledge:Analyze the current situation of user knowledge, which will be accomplished through penetration testing.Penetration Testing and Data Collection:Conduct penetration testing to collect data on users who are more vulnerable. Subsequently, schedule awareness training sessions with them.Onboarding Training for New Employees:Provide onboarding training for each new employee, covering topics such as phishing and other threats.Timely User Reminders:Send timely reminders to users containing bulk information about risks, outcomes of new threats, and tips to stay protected.

Übersetzt

Based on the 3 goals that was clearly defined, you are able to make a benchmark of the providers and point out how the major top of 10 are satisfying your goals.

Übersetzt

Some ways to design an effective Security training, based on my experience in current & previous organisations are:1. Creating a joint team with a member from each team a Security evangelist, to spread awareness and vigilance with the wider audience.2. Plan and execute roadshow events to gain employee attention3. Flash-mobs, specifying the cause and importance of Security4. Weekly quiz with 3-5 questions, specifying security related queries and gift/points/awards for repetitive winners

Übersetzt

When comparing different security awareness providers, you should consider following while choosing:- Previous references to see list of companies and organizations that aleeady workef with such provider and if they are big and well reputable companies.- The awareness training should be simple as mucg as possible especially for non technical users, and contains interactive videos to show real scenarios of different security attacks. - The content of awareness training and if it is containing simulation tools to assess users understanding and how far content s are delivered.

Übersetzt

Choosing a security awareness training provider requires a meticulous approach. Look for a comprehensive solution tailored to your needs, covering relevant topics like phishing and compliance. Assess the delivery methods for flexibility and accessibility and ensure strong support from the provider. Consider the training's value for money, transparency in pricing, and any additional costs. Ultimately, seek a collaborative partner in cybersecurity, crafting a unique defense strategy for your organization...!!

Übersetzt

This assumes some form of awareness platform solution. Before requesting a demo or trial of any solution - be clear on which training need you are addressing and the specific requirements of the roles associated with it.There are developments in this space constantly and I strongly recommend working with an independent partner to assist with the procurement process rather than relying on glossy demos and presentations alone.Also, remember to speak to organisations who have practical experience of the solutions you are considering; they'll be able to share some of those implementation gotchas that providers are less willing to share!

Übersetzt

If phishing simulations are part of the training, the demo or trial should allow you to experience or at least preview these simulations. Evaluate how realistic and effective they are in preparing employees to recognize and respond to phishing attempts.

Übersetzt

The cybersecurity awareness training program offered includes realistic and effective phishing simulations designed to prepare employees for recognizing and responding to phishing attempts. The simulations cover diverse scenarios, provide real-time feedback, and allow progress tracking. A demo/trial period is available for firsthand experience. The program also includes cybersecurity awareness tips such as updating passwords, being cautious of unsolicited emails, and keeping software up-to-date. The goal is to empower organizations with the knowledge and skills to enhance resilience against cyber threats...!!

Übersetzt

You can use this opportunity to ask questions, address any concerns, and offer feedback. It's also beneficial to involve managers, IT staff, and security officers. Their diverse perspectives and insights can be invaluable in assessing the training's suitability for your organization's specific needs.

Übersetzt

For demos it is important that the IT staff or subject matter experts have had a preview demo of the product and raised the relevant questions before the wider company or management have had the demo.

Übersetzt

Risk assessment on the current infra,knowing the business strategy and the provided services and associated risks will tailor the content that will make the users aware of type of expected attacks and how to response . perform a phishing simulation or incident more exercises along to training followed by an assessment,to measure that the objectives are delivered clearly, make sure that the content is up to date with the latest attacks.

Übersetzt

Proposing a comprehensive cybersecurity initiative aligned with our business strategy to strengthen defenses and foster a cyber-resilient culture. The plan encompasses a thorough risk assessment, tailored training on anticipated attacks, including phishing simulations and incident response drills. Continuous assessment and regular updates ensure ongoing effectiveness, empowering staff to actively contribute to our digital asset protection. The initiative aims to fortify cybersecurity measures and instill a proactive approach to safeguarding our organization...!!

Übersetzt

After rolling out the security awareness training, we evaluated its effectiveness personally. We compared the results against our initial goals, looking closely at participation levels, test scores, and team feedback. It was also essential to assess how satisfied we were with the provider and pinpoint areas where we might need to tweak the program to suit our needs better. This hands-on review was essential to ensure the training delivered what we set out to achieve.

Übersetzt

Consequence management to bring the positive changes in the behaviour and to embedded security into the organisation's culture.For example employee taking souvenirs, before leaving the organisation and DLP control is useless if no action is taken.Next, buy-in from the top like the board endorsing the security awareness program and setting examples by leading from the front.

Übersetzt

One size does not fit all across the organisation, and providing the same awareness training to everyone is a good way to disengage people rather than bring them along.Some providers do provide a wider spectrum of adaptive training, but in most cases you will want to look at different solutions to support different skill levels. You may consider live training for development teams needing awareness training not just of basics, but of secure development and threat modelling for example while keeping a standard CBT approach for the wider business.Seriously consider partnering with an expert who understands differing training needs and the providers available if you want to get the most out of building security awareness.

Übersetzt

In many ways corporate needs are similar in regards to basic security awareness training, and many vendors can provide foundation security awareness which will cover these needs. In some ways companies vary widely on their compliance and regulation needs, which also need to be addressed for security awareness training.Be prepared to generate your own training to augment the training you purchase in order to provide the company with specific information across the entirety of the corporate population that addresses specific caveats of those roles. It's kind of like buying business or formal clothing, off the rack will fit most of your needs, but having it tailored will fit a lot better.

Übersetzt

Generic security awareness programs targeting the whole organisation and that will bring the security awareness, it is not the silver bullet and often organizations make that mistake. Like your digital identity and authorisation model each user based on the job role or functions and criticality of that role that they perform the security training program needs to be deployed.Next with advancement of technology with Chatgpts and deepfakes the social engineering attacks are going to drastically increase in future. The guards who hold keys to the kingdom need to be well trained and increased vigilant to secure the organisation from bad actors and nation states.

Übersetzt