How can you ensure new hires are security aware?

The security culture of an organization should form part of the general on onboarding Programme for new hires. It is important to have an early introduction to how the organization is protecting employees, information and other assets and to understand which functional units are responsible for protection. Reporting processes should be simple and easily accessible as the convenience of available channels is directly linked to the willingness of reporting. Once the basics are established, it is advisable to develop further and more advanced training for specific and sensitive roles. Eventually, new hires will adopt the existing culture within an organization and more specifically within their teams, closer environment and management.

Most organisations do not measure the cyber awareness of new hires. Instead, they push a load of awareness training covering all of the main topics, and that’s it. A more impactful approach is to have new hires complete an awareness questionnaire. This will provide a measure of the topic areas that are strongest and weakest. From there, you can focus on the weak areas, providing impactful training that will change weak knowledge into strong awareness. New hires have a lot of new information to absorb. Save time, make it effective, and genuinely move the needle. After that? Little and often. A small amount of awareness monthly is more impactful that a large amount every year. Fun + engaging + impactful = strong human firewall

In this case, I advise you to have an internal training course that makes it clear, points out the responsibilities of all employees, and their "duties" and contribution to maintaining information security in the corporate environment. The level has to be assessed constantly, whether it's for new employees or not. But, with the inclusion of Information Security growing more and more in companies every day, it's very likely that new employees already have a small awareness, even if it's just a pattern of using strong passwords: - Numbers -Upper and lower case letters -Characters

I conducted initial assessments using a combination of surveys and simulated phishing attacks. These methods provided valuable insights into the new hires' understanding of basic security concepts like phishing, social engineering, and password management. For instance, during a simulation, we discovered that a significant portion of new hires fell for a phishing email. This highlighted the need for immediate and targeted training on identifying and avoiding phishing attempts. By tailoring the training based on the assessment results, we were able to significantly reduce the vulnerability of our organization to such attacks.

They should be tested, and trained initially by a corporate supervisor. Then trained again at the site/task level. This should plant the seeds, then you start out with semiannual training and drop it to annual after successful completion of previous levels. If a company is not willing to make this level of commitment, there will be gaps in both knowledge/performance. This ultimately is dictated by client "wants" versus client "needs" (which need to be fully explained AND understood by both parties ahead of starting).

Map out the security touchpoints for a new hire and don’t rely on only one touch for security topics. Employee orientation is a great start, but the engagement can’t stop there. Consider how you guide new hires to online content, via LMS, intranet, webinars etc, and continue to reinforce key security messaging early and often. Most people need to hear the same message several times in different ways, for it to soak in. Be creative with how you send that message.

Invest in creating dynamic training sessions, with short explanatory videos of no more than 25 minutes (as we know that maintaining concentration above this level is difficult for many people, especially those with ADHD). Then use a quiz game with prizes for the winners. Fortnightly newsletters covering safety issues and some training topics. Always remind people of their role and responsibility for organizational safety. Always encouraging and making it clear how important their role is in this ongoing process.

The only way to ensure that your employees (new hires or not) get security aware is to constantly think of new way of stimulating their security awarance. Bring up new ideas the bad guys could use to penetrate the defences, specially towards social engineering. There is no ultimate solution, but despite of that continue towards possible such solution. Last but not least (or should it be at the top of the list) apply the rule: "Everything is forbidden that is not specially allowed." That will most likely cut down the number of touching points employees have with possible threats. When employees then request more permissions, they can be informed about what threats are most likely associated with each permission granted.

Providing engaging and relevant training is essential to ensure that new hires retain the information and apply it in their daily tasks. In my experience, a mix of e-learning modules, interactive webinars, and gamified challenges has proven to be highly effective. For example, at a previous company, we developed a series of short, scenario-based videos that depicted common security threats specific to our industry. These videos were followed by quizzes to reinforce learning. We also introduced a gamified platform where employees could earn points and badges for completing security training modules and participating in security challenges.

The best way is to repeat repeat and repeat. One of the way of doing it is simulating certain security scenario and see how the employees behave or apply the training knowledge. This whole process of security awareness is more of forming habit and if you remember habits are formed by repeating the same thing again and again.

Identifying your key desired behaviours is a must. Use primary training top address all desired behaviours then use secondary training opportunities throughout the year to reinforce the most important behaviours that key. Recommend only addressing 3-4 maximum key behaviours each year. We only have so much space in our brains as humans and need the focus to be clear!

Communicate the security culture obligations and expectations on day 1. Otherwise, can you really expect to have a culture of security awareness if it isn't even mentioned during orientation?

Reinforcing desired behaviors is key to embedding security awareness into the organizational culture. In one successful initiative, we implemented a recognition program where employees who demonstrated exemplary security practices were rewarded. For instance, an employee who reported a potential security threat was publicly acknowledged and awarded a certificate of appreciation. Additionally, we incorporated security reminders into everyday work tools, such as regular prompts to update passwords or reminders to verify email senders. These nudges helped maintain a high level of security consciousness among new hires, making secure behavior a part of their routine.

There has been a lot of talk lately about gamification aspects, which often help reinforce learning and functional behaviors. Several organizations also provide incentives with swagger kits, which, if done in limited editions, some friends who work in multinationals tell me are highly coveted, not only to show them on social but also and especially as internal recognition.

Hard disagree with the guidelines on this. While I agree positive reinforcement is a strong culture building tool, the over emphasis on only recognition for positive behaviors allows the 7% causing 70% of incidents to continue without remediation.

A very important aspect, particularly when it comes to new hire and security awareness, and monitoring how things are going and not victimizing people if they don't recognize a phishing email or report it. But Security Awareness is not just phishing, there are also a number of important OPSEC practices to adhere to on information sharing and other practices that contribute to overall security.

Ensure access to and analysis of data from: DLP Insider Threat IAM Cyber Threat Intel EDR Your program should be cutting alerts and incidents. If it isn't, or if you're unsure, work with these trams to understand the behaviors responsible for the highest risk past incidents and alerts.

To improve security awareness among employees, a combination of training methods incorporating judicial philosophy, economic rationality, and psychological insight is most effective. This approach acknowledges that employee performance in security is influenced by organisational culture and incentive structures. Continuous training and assessment, such as security workshops, enhance security acumen. Participatory feedback mechanisms and psychological assessments also foster a culture of security understanding and practice. Thus, enhancing security awareness in the workplace is a holistic endeavour.

Onboarding, early training, and general conversation are all places that security should have a place. Teach new employees to value and listen to their spider sense and report what's off.

To ensure new hires are security aware, creating a Security Champions Program where interested employees act as security representatives in their respective teams by promoting security best practices and resolving minor security issues. By being a part of a Security Champions Program, new employees will help to directly contribute to a security-first culture within an organization.

Fostering a workplace culture of security awareness, organisations should combine philosophical, economic, and psychological principles. This involves empowering staff to take ownership of security. Participating in security inductions and workshops, involving employees sharing experiences, fostering a sense of collective responsibility. Integrating security awareness into the reward systems, like recognition programs, also encourages proactive behaviour. Regular psychological support, such as stress management and situational awareness training, can enhance an individual's ability to remain vigilant. Also, time off, just as important as time on is recreational time away.

True rewards for difficult to achieve success goes a long way ?? (bonus for 100% phishing reporting rate) Fluff recognition for all who simply don't cause a breach shows leadership doesn't take security awareness as seriously as they say.

I recommend shift left philosophy for security awareness. Earlier you educate people, they better protect your information. 1. Once the offer is rolled out, have new joiners complete security training, assessment that provide insights into company policies, security responsibilities etc. 2. Have another session during Induction program to ensure security responsibilities are clear and well understood. 3. For new employees, one of the KPIs should be to comply with all security policies of the organization.

Um exemplo prático é trazer a pauta de seguran?a da informa??o no onboarding de novos colaboradores! Tenha empatia! Entenda que a pessoa que está entrando, está recebendo uma quantidade considerável de informa??o e precisará de tempo pra processar tudo! Portanto, seja simples! Foque em contar mais sobre a cultura de seguran?a da organiza??o ao invés de compartilhar dezenas de links de políticas e normas! Um kit de boas vindas composto por um brinde (ex: um chaveiro) com dicas de seguran?a da informa??o para o trabalho e para vida mais uma cartilha com um resumo dos principais tópicos que a pessoa precisa estar por dentro na empresa além de causar uma ótima impress?o, ajuda a refor?ar a cultura em seguran?a da organiza??o.

Digamos que você já tem um programa rodando na organiza??o há um ano. Como conseguir que o novo contratado esteja no mesmo nível dos demais? Acredito que o momento do onboarding, ou integra??o, do novo contratado é crucial. Este é o momento em que você terá a oportunidade de igualar o nível de conscientiza??o dele com o dos demais colaboradores. Tente abordar todo o assunto que envolve seguran?a em uma única apresenta??o e aproveite para apresentá-lo às ferramentas da empresa, inclusive onde ele pode/deve aprender mais sobre seguran?a. Eu sei, é um desafio e tanto, mas esse pode ser um caminho.