Phishing simulations are debated in the security industry. Many promote their effectiveness, while others call them controversial. Either way, phishing simulations on their own are not an effective phishing prevention strategy.
Negative reinforcement, such as shaming and punishment, may change risky behavior but at the cost of employee morale. New approaches to security awareness training incorporate positive reinforcement, gamification and social proof to reduce human risks without hurting morale.
Security awareness programs should include a variety of topics, including physical security, social engineering training, security best practices, remote and on-premises security and awareness of types of malware.
Please select 2 correct answers
Passphrases are considered stronger than passwords. Passphrases are generally easier to remember than long, complex passwords, which are often written down or saved to a user's desktop.
Security awareness training is essential for executives due to their privileged access, knowledge of trade secrets and increased exposure to risk during travel, making hem high-value targets for attackers.
Traditional security awareness training metrics, such as completion rates, quiz performance and engagement metrics, are fundamentally flawed, according to Forrester. Human risk scores are the most important metric and should be used to adjust and improve training programs.
Alerts about password changes, pop-ups demanding ransoms and device performance degradation are all signs of a potential ransomware attack. While unpatched, out-of-date software is not a sign of an infection, it is important to patch or update the software to prevent it from becoming a ransomware attack vector.
Typos, grammatical errors and suspicious links are all indications of a phishing email.
Humans are still weakest link because, if cybersecurity or human cybercrime is not their job description , security can become a minor concern relative to other work responsibilities.
Deepfakes introduce a number of security risks. Security awareness training programs should include information on how to detect and report digital impersonations and encourage employees to think critically about potentially altered content.
