7 Tips for an Effective Employee Security Awareness Program

Employee security awareness training programs have become a necessity for organizations in recent years because of the high percentage of data breaches caused by careless and negligent workers.

Phishing, in particular, continues to be a top attack vector because of the success threat actors have in tricking employees into downloading malware on their systems or following links to malicious sites. Many data breaches are also the result of poor employee password security habits and the failure to follow enterprise policies for data access, use, sharing, and storage.

In fact, negligent employees are one of the highest security risks for organizations in the US and elsewhere, according to a 2018 study by Shred-It. Eighty-four percent of C-suites and 51% of small-business owners described such employees as their biggest security problem. Ninety-six percent of Americans hold negligent employees as least partly to blame for data breaches at major US companies.

"While data breaches that grab headlines are often perpetrated by external threats, at least half of all security breaches are carried out by insiders," says Chris Olson, CEO of The Media Trust. This can include malicious insiders, negligent employees, and third parties with access to the enterprise network.

But breaches are not the only reason for employee training. Many regulations, including PCI and HIPAA, mandate regular employee security awareness training. While requirements for such training can vary, the goal is to ensure companies take measures to address risks posed by employees and other insiders with trusted access to enterprise networks and assets.

Here, experts share some of the key attributes that make up an effective employee security awareness training program.