If you want to succeed with your organization's security awareness training program, here are some of the top "faux-pas" we have seen over the years that you should be sure to avoid:
- Avoid singling out users that click on a phishing link and making a public example of them. Do not punish employees that make mistakes early on.
- Avoid sending phishing campaigns only every 90 days. Quarterly phishing tests really just take a baseline, whereas phishing users at least once a month is an effective method to groove in making smart security decisions.
- Avoid sending the same phishing template instead of randomizing the templates to each user, and running campaigns on predictable times like every Monday afternoon.
- Avoid starting out with 5-star phishing templates that are too difficult to identify.
- Avoid sending only phishing attacks and overlooking stepping users through interactive training.
- Avoid forgetting to emphasize that this program will also help your users to keep their family safe online.
- Avoid forcing the program through your users throats, and bypassing getting C-level air cover for the program. You want as much buy-in from the get-go as possible.
- Avoid neglecting to inform key stakeholders, department managers and tech support before you send the initial baseline test.
- Avoid not reporting the positive results to the stakeholders with graphics that show improvement over time.
- Avoid not having a good procedure / process that allows users to report phishing emails that they found in their inbox, and not having a Social Engineering Incident Response program.
You can also access the infographic here.
Here's how it works:
