Most of us don’t think about security at all. We want to get our jobs done, and we want to do them well and quickly. Security often gets in the way, putting up barriers to productivity and efficiency that are a constant cause of frustration. If you’ve had security training, at least you know why these inconveniences exist, why you can’t download your company’s private data to a thumb drive even though it makes it super convenient to work from home. If you haven’t had security training, the frustration is just frustration why not take data home?
Almost everyone who works in IT knows that the inconveniences of security are a necessary part of a company’s life. They have the training and the knowledge to put information security risks into context. But too many companies think that security stops at the data center door: that secretaries, executives, salespeople, and others who use IT rather than manage it don’t need the training to understand the data security context in which they work.
That’s a mistake. Every employee who has access to sensitive data should be given at least a basic understanding of the implications and potential causes of data loss, so that the security precautions they are asked to take do not seem like pointless burdens imposed from on high.
We are entering an era of increased advanced persistent threats, where the hackers’ main goal is to quietly breach IT systems and suck up as much information as possible. Through social engineering and other indirect attacks, hackers are seeking access to customer data, credit card data, and even SSL certificates. Every machine on the network is a potential breach point, and that means that every employee needs to know how to protect the company’s data.
We live in a world with no clear boundaries between IT and non-IT. Today, a significant proportion of workers are information workers, and they are constantly engaged with networks and computer systems both in their personal and professional lives. Their work depends on their ability to access data and that means they need the training to deal with information securely.
The smartest cybercriminals do not attack the center, they attack at the periphery where they know defenses will be at their weakest. Phishing attacks against ordinary employees and brute force attacks against their poorly protected email and SaaS accounts are becoming the norm. Those employees need to know not to click the link in a phishing email, they need to be able to identify the emails that should be suspect. They need to know why they shouldn’t drop data onto a USB drive and take it home. And they need to know how and why they should use secure passwords.
Businesses that fail to implement company-wide information security training are in for a rough time in the coming years.
