{"id":1690,"date":"2017-01-16T11:53:58","date_gmt":"2017-01-16T16:53:58","guid":{"rendered":"http:\/\/blog.cedsolutions.com\/?p=1689"},"modified":"2017-01-16T11:53:58","modified_gmt":"2017-01-16T16:53:58","slug":"sorry-state-cybersecurity-awareness-training","status":"publish","type":"post","link":"https:\/\/blog.cedsolutions.com\/1690\/sorry-state-cybersecurity-awareness-training\/","title":{"rendered":"The Sorry State Of Cybersecurity Awareness Training"},"content":{"rendered":"

\"\"Rules aren’t really rules if breaking them has no consequences.<\/span><\/strong><\/p>\n

\u00a0In today’s dangerous cyberworld, corporations often say that cybersecurity is now a top priority for them, especially after all the massive data breaches we’ve been hearing about on a day-to-day basis. But one has to wonder, if that’s case, why are so few companies doing cybersecurity training properly?<\/div>\n

Sadly, the most common and detrimental thing that many companies are doing wrong when it comes to training employees on cybersecurity is a big one: they aren’t doing it all.<\/p>\n

Regardless of industry or company size, I’ve seen way too many companies that aren’t implementing any sort of cybersecurity training, not even at employee orientation. It’s also important to note that the companies that do implement security training, but only conduct it at new-hire orientation and then never mention it again, are not much better. Many companies fall into this category.<\/p>\n

While employees are getting some sense of what to look out for when they receive training, the threat landscape changes so quickly that the information becomes obsolete within weeks or months and, without regular reminders, it’s out of employees’ minds quickly. In other words, the information is no longer top of mind.<\/p>\n

\u00a0Finally, very few companies are having regular cybersecurity training programs and refresher courses. I recommend companies do training updates once a month throughout the entire year, and I only know of a handful of companies that are actually doing this.<\/div>\n

The next step after implementing a regular cybersecurity training program is to put in place policies and procedures to enforce what’s learned. Again, I’m seeing almost no companies doing this, so employees aren’t being held accountable for skirting proper procedures that would normally protect their company from different cyberthreats.<\/p>\n

Results in the Real World<\/strong>
\nThe longest it has ever taken for me to hack into a company’s system remotely through tactics such as phishing emails is minutes. Usually, I’m already in the system 10 minutes after the phishing email has been sent. When doing on-site tests, if we properly cased the company (which a good hacker will), we are in within an hour. This is a clear illustration of the need for better cybersecurity training.<\/p>\n

For example, at one social engineering engagement I performed at a large oil and gas company, I was able to get into the organization and gain full run of the computer network in under an hour, and no one stopped or questioned me. While they did have an information security training program in place, no one was enforcing the practices being taught. Because I could penetrate their network so quickly, the CIO had to be in the exit interview with me, though that was not the initial plan.<\/p>\n

Another example is from a very large retailer. During the company’s cybersecurity training process, I came in to do a social engineering test on the employees. The training should have been top of mind because the employees were currently going through it \u2014 the person who let me into the office even said that she was doing training at the moment and knew she was not supposed to let people in \u2014 but then she let me in anyway. I quickly gained access to the computer network once I was in the building, and there were no repercussions to the employees. This is a key example why there is much less likelihood that employees will be mindful of security practices that the company expects them to adhere to if there is no enforcement of the rules.<\/p>\n

\n
\n
\u00a0In this white paper, we present the increasingly growing problem of organized cybercrime. As cyber hacking and breaches rose it started costing organizations millions in the form of lost business and lost or breached data, not to mention the loss of credibility and reputation in the market.<\/div>\n
\u00a0Simply put, there must be some sort of policy and enforcement in place for not adhering to security policies, such as a counseling session, but I see no companies doing this. Without enforcement, employees see the training as onerous. They simply ignore what they have learned, or don’t take the training at all, claiming that they’re too busy.<\/div>\n<\/div>\n<\/div>\n

To be effective, companies need to stop treating cybersecurity training like a box to check off for compliance purposes and take it seriously. Once that happens, employees will take it seriously as well.<\/p>\n

http:\/\/www.darkreading.com\/vulnerabilities—threats\/the-sorry-state-of-cybersecurity-awareness-training\/a\/d-id\/1327862<\/p>\n

The best way to protect your Networks is to have properly training IT Security Pros on your team.\u00a0 Learn how to protect your LAN and WAN and important corporate information with\u00a0Certified Ethical Hacking<\/a>\u00a0(CEH),\u00a0Computer Forensics<\/a>\u00a0(CHFI),\u00a0Security Analyst<\/a>\u00a0(ECSA),\u00a0CISSP<\/a>, and\u00a0Cisco Security<\/a>\u00a0courses.<\/div>\n
\n

CED Solutions is a Cisco Learning Partner, Microsoft Gold Learning Partner and the #1 location for Microsoft Certifications in North America for the last 6 years combined.\u00a0 CED Solutions is a\u00a0CompTIA Partner<\/a>, EC Council Partner, and many others\u00a0and is one of the largest providers of training in North America.\u00a0 The\u00a0Atlanta facility provides IT training<\/a>\u00a0for up to 300 students per day, with\u00a0separate buildings dedicated to training. CED Solutions provides training thousands of students per year and students take hundreds of certification exams every two weeks.<\/p>\n

\n
\n

CED Solutions<\/a>\u00a0provides training and certification for\u00a0MCSD: SharePoint 2013 Applications Developer<\/a>;\u00a0MCSE: SharePoint 2013<\/a>;\u00a0Cisco CCNA<\/a>;\u00a0Cisco CCNP<\/a>; Cisco CCNA Security;\u00a0Cisco CCNP Security<\/a>;\u00a0 Cisco CCNA Voice;\u00a0Cisco CCNP Voice<\/a>; Microsoft\u00a0MCSA: Windows 2012 Server<\/a>;\u00a0MCSA: Windows 2008 Server<\/a>;\u00a0MCSA: SQL 2012 Server<\/a>;\u00a0MCSE: Business Intelligence SQL 2012 Server<\/a>;\u00a0MCSE: Data Platform SQL 2012 Server<\/a>;\u00a0MCSE: Desktop Infrastructure Windows 2012 Server<\/a>;\u00a0MCSE: Server Infrastructure Windows 2012 Server<\/a>;\u00a0MCPD: 6 Cert Visual Studio Developer<\/a>;\u00a0MCSD: Windows Store Apps C#<\/a>;\u00a0MCSD: Windows Store Apps HTML5<\/a>;\u00a0IT Healthcare Technician<\/a>\u00a0and many more.<\/p>\n

CED Solutions, LLC,\u00a0www.cedsolutions.com<\/a>,\u00a0info@cedsolutions.com<\/a>, (800) 611-1840<\/p>\n<\/div>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

Rules aren’t really rules if breaking them has no consequences. \u00a0In today’s dangerous cyberworld, corporations often say that cybersecurity is now a top priority for them, especially after all the massive data breaches we’ve been hearing about on a day-to-day basis. But one has to wonder, if that’s case, why are so few companies doing […]<\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":"","wds_primary_category":0},"categories":[4,5,7,10],"tags":[],"_links":{"self":[{"href":"https:\/\/blog.cedsolutions.com\/wp-json\/wp\/v2\/posts\/1690"}],"collection":[{"href":"https:\/\/blog.cedsolutions.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.cedsolutions.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.cedsolutions.com\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.cedsolutions.com\/wp-json\/wp\/v2\/comments?post=1690"}],"version-history":[{"count":0,"href":"https:\/\/blog.cedsolutions.com\/wp-json\/wp\/v2\/posts\/1690\/revisions"}],"wp:attachment":[{"href":"https:\/\/blog.cedsolutions.com\/wp-json\/wp\/v2\/media?parent=1690"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.cedsolutions.com\/wp-json\/wp\/v2\/categories?post=1690"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.cedsolutions.com\/wp-json\/wp\/v2\/tags?post=1690"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}