IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more
Sponsored

Four tips for educating users on security

IT professionals can implement as many layers of software as they want, but information security starts with the user

A padlock laid on top of a circuit board.

When you hear an IT administrator talking about a "picnic" they're probably not talking about gingham blankets, wicker hampers and sandwiches. Instead, they're likely referring to the acronym "Problem In Chair, Not In Computer", meaning it's not the technology at fault, but the person using it.

This may seem rather a harsh attitude to take, but when it comes to information security, it's a valid one. As much as administrators can toughen external defences, users will remain the most vulnerable and most common vector of attack.

Take ransomware attacks, for example many of them require the user to actively download a malicious program and run it. These users aren't heading off to dodgy websites to download unknown software, instead they are being tricked, frequently by phishing emails.

Indeed, a recent study by the American Medical Association and Accenture showed that in the US healthcare system, doctors are very concerned about cyber security and its potential to disrupt the operation of their facilities. The research found that phishing is the most common form of attack (55%) followed by infection through malware, for example through a download (48%). Network hacks, by contrast, had affected only 12% of respondents.

In light of this, here are four tips for educating users on good security practices.

1. How to spot a phishing attack

One of the best ways to prevent a successful phishing attack is to stop the user from opening attachments, clicking on links or handing over information unless they are sure it's really from the alleged source.

Users should never be afraid to follow up by phone or, if your company uses it, an internal messaging system like Slack or Yammer, even if the email seems to come from trusted internal contacts or known suppliers.

The same goes for so-called vishing attacks, when the attacker tries to get information over the phone. If something seems fishy (or phishy), users shouldn't be afraid to independently verify who is on the phone.

2. Why you use software management

Every IT administrator has had a disgruntled employee on the phone wanting to know why they can't download a piece of software onto their computer.

To the user, it may seem that IT is just being a roadblock to them doing their job, but rather than presenting a brick wall at this point of confrontation, it's much easier and nicer for all involved if there's an open dialogue.

Educate users when onboarding on why you don't allow them to download whatever they want onto corporate devices. While it's important to explain that a given piece of software may be illegitimate and therefore malicious, try not to make it sound like you think non-techies are stupid. Inform them also that, even if it is a legitimate and legal piece of software, there could be vulnerabilities in it that can't be patched if IT doesn't know the application exists, which could put the whole network at risk.

If someone proposes a piece of software they need to do their job, do also take the time to listen to them it may be something that's worth the company investing in, or which you already have approved alternatives for.

3. Educate at the point of onboarding

When it comes to onboarding a new member of staff, there's no room to assume what they may or may not already know.

Perhaps their last place of employment used multi-factor authentication, had regular phishing tests and was always circulating best practice information, or maybe they were allowed to write down and share passwords and leave their devices unlocked when they were away from their desk. It's impossible to tell and even if they fell into the former category rather than the latter, your security protocols and methods may be different to those of the IT administrators at their previous job.

It's important, therefore, that everyone is educated on security at the point they join the business and that there's a set formula for how this is done to ensure consistency and comprehensiveness across the business. It's worth checking in on new recruits once they're more settled in to ensure they've understood the security points as well as other IT matters and resolve any problems up front before bad habits set in.

4. Fire drills and refreshers

A cyber attack is an emergency for any business in the same way a physical threat like fire is. Therefore, it's worth carrying out security "fire drills" once or twice a year, where either the internal IT team or external specialists mount a "phishing" campaign or similar to see where there are weaknesses. This could be incorporated as part of a wider pen-test that also looks at network and software defences, which could help users who fall for the fake phishing email and there will be some feel less like they have been tricked or are being picked on.

Security refreshers based on this or ones that have a more general flavour should be carried out on a regular, although not necessarily frequent (once or twice a year will do unless there are any major changes that need to be announced), basis.

While there's no such thing as an impenetrable system, educating users on the importance of security is one of the best ways to harden your defences. So what are you waiting for?

Find out how HP business devices can keep your workers safe.

Featured Resources

Four strategies for building a hybrid workplace that works

All indications are that the future of work is hybrid, if it's not here already

Free webinar

The digital marketer’s guide to contextual insights and trends

How to use contextual intelligence to uncover new insights and inform strategies

Free Download

Ransomware and Microsoft 365 for business

What you need to know about reducing ransomware risk

Free Download

Building a modern strategy for analytics and machine learning success

Turning into business value

Free Download

Recommended

HP Neverstop Laser 1202nw review: A great small office choice
peripherals

HP Neverstop Laser 1202nw review: A great small office choice

19 May 2022
Powering through to innovation
Whitepaper

Powering through to innovation

11 Apr 2022
Lenovo's record-breaking earnings sets the pace for 2022 laptop market
Laptops

Lenovo's record-breaking earnings sets the pace for 2022 laptop market

24 Feb 2022
HP Elite Folio (3G2N3EA) review: Too much style, not enough substance
Laptops

HP Elite Folio (3G2N3EA) review: Too much style, not enough substance

21 Jan 2022

Most Popular

16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

13 May 2022
Russian hackers declare war on 10 countries after failed Eurovision DDoS attack
hacking

Russian hackers declare war on 10 countries after failed Eurovision DDoS attack

16 May 2022
Microsoft says it's provided over $100 million in tech support to Ukrainian government
cyber attacks

Microsoft says it's provided over $100 million in tech support to Ukrainian government

20 May 2022