Wie fördern Sie das Sicherheitsbewusstsein Ihrer IT-Mitarbeiter und Benutzer? (2024)

Whilst awareness is very important all awareness programs need to account for:a- there will always be somebody trying(on purpose or not) to fool the systemb- there will be a certain percentage of people (and not rarely the more executive ones) who will not follow all trainings because of their rang or position.c- maximum limit of awareness maturity will be around 95%...so 5% of troubles anywayd- when is it likely traffic lights are installed? When there are casualties.So whats the point here? a- Assume your awareness program will have a failure rate of minimum 5%. b- An attacker will exploit those 5%c- technical people are the most difficult and dangerous ones => zero trust, layered security, privileged acces management

Übersetzt

(bearbeitet)

Audits can be conducted internally, but it's wise to have an unbiased third party audit conducted by a penetration tester. These testers will use a wide range of techniques to test the security of the network and software; sociological tests to see how easily they can obtain credentials and information; and physical security checks to ensure malicious actors are detected quickly and removed.All of these tests will provide a baseline, from which the organization can improve.

Übersetzt

In our organisation, we take the security aspects very seriously with employees therefore we keep exploring new ways to keep them updated and aware. We do the following: Provide regular security awareness training that is fun and engaging, and keep it up-to-date. Measure the effectiveness of your training and reward good behavior.Send regular security updates and reminders, and encourage employees to report suspicious activity.Organize fun and interactive sessions to raise awareness of security threats and best practices.Organize quizzes on security topics and reward employees who score well.Use gamification techniques to make security training more engaging and interactive.

Übersetzt

Successful employee cyber security awareness comes from successful personal cyber security awareness. Make cyber security relevant, understandable and easy to engage with and employees will become your security champions. Cybercrime aimed at consumers and people exceeds cybercrime aimed at businesses by several orders of magnitude. By enabling and educating your employees in personal cyber security, you strengthen not only your businesses defences but those of society as well.

Übersetzt

Take the training outside the "annual certification box and into the real world". I'd point to reinforced learning using mock exercises as one example; even better if these exercises can be woven into the day-to-day, non-training activities. We're familiar with user awareness training stressing the risk that email can pose as we go about our daily business/work, yet phishing remains a significant challenge.Conducting live phishing [and vishing] tests/simulations is one example of reinforcement learning that e.g. sending carefully crafted emails or calls to staff with realistic, current scenarios that staff should flag using appropriate channels. Staff failing simulations could receive additional training and feedback into the program.

Übersetzt

Integrate Security Awareness into Daily OperationsSecurity awareness shouldn't be a one-time event or isolated initiative; it must be integrated into the daily operations of the organization. Regular reminders, updates, and real-world examples can keep security at the forefront of everyone's mind. Utilize tools like newsletters, intranet posts, or periodic briefings to share relevant security news and updates. Encourage IT staff and users to apply security best practices in their daily tasks and decision-making processes. By making security awareness a part of the organizational culture, you foster a proactive approach to security, where everyone feels responsible and empowered to protect the organization's assets and reputation.

Übersetzt

Totally right! Involving stakeholders and partners and asking for their ideas would help in increasing of the awareness of the security program.

Übersetzt

Buy-in, from all users, not just administration and stakeholders, is paramount to a successful ITSA program. If employees are simply "clicking through" their training they will not gain the knowledge they need to recognize a potential threat. They need to know how important they are and the role they play in the company's cybersecurity strategy.In my experience, a simple acknowledgment of a job well done can go a long way in helping to foster an 'engaged and aware' staff.

Übersetzt

Having a healthy competition and a rewarding system is absolutely a correct and necessary in an organization and it will not just boost the motivation to have progbut also will add knowledge within the team and organization.

Übersetzt

I sometimes see very little of this in corporate. IT tend to complain about users sending in phising alerts / MFA'ing without proper checks ect.It is crucial to award those who do raise a security concern as it bolsters a good secure environment when it comes to digital assets and management.

Übersetzt

As a highly experienced security awareness training program manager, it is imperative to ensure you not only understand the motivations and culture of the environment, but to also keep up to date with feedback and suggestions. A successful security awareness program is dependent upon connecting to everyone in their own way. Security can be boring but there are ways to humanise yourself and let other employees know just how important they are and how important their opinions and perspectives are. Just like any business model, engagement can only occur if we as creative professionals listen.

Übersetzt

Having a feedback system internally is an essential for each organization. It can be integrated within chat, email etc. application for all of the users so gathering all those feedbacks will eventually help in security increase.

Übersetzt

Establishing a security feedback loop through surveys, interviews, and data analysis is essential for continuously improving your security awareness program. This iterative process helps identify program strengths and weaknesses, while also aligning it with the specific needs and preferences of IT staff and users, ultimately enhancing engagement and satisfaction.

Übersetzt

I think one great way to improve is with education and Training. Provide regular cybersecurity training sessions for both IT staff and end-users. Cover topics such as phishing awareness, password best practices, and recognizing social engineering tactics.Offer ongoing training to keep everyone informed about the latest threats and defenses.

Übersetzt

Never assume that the bigger or apparently better qualified people automatically know the correct or best answer. Don't be arrogant about it but if you know strongly that your solution is better that the proposed one propose it, If it fails you need to be big enough to do some self evaluation and resolve the issues that made it fail. Same as life.

Übersetzt