Security Awareness Training Isn’t Dead, but It Needs a Rethink
All enterprises conduct security awareness training for their employees. But whether this has tangible benefits is debatable.
Empirical evidence suggests that security awareness training isn’t working – successful attacks keep increasing. But opinions on the efficacy of awareness training range from it doesn’t work to it does work, with sometimes, perhaps and depends between the two extremes.
Awareness training focuses on two tasks: to reduce the effect of bad judgment turning an employee into an insider threat; and to harden employees against falling to malicious social engineering. We focus on social engineering.
Compliance theater
The majority opinion is that awareness training is important but not always effectively delivered – and not necessarily at the fault of the company concerned. Stefan Dasic, senior malware research engineer at Malwarebytes, suggests, “Most training programs fail because of how they’re run.” He believes they are repetitive and generic, making them seem pointless.
“Some of...
Copyright of this story solely belongs to www.securityweek.com. To see the full text click HERE
