-: Now we've already talked about user education
throughout this course,
but in this lesson,
I want to talk about three different terms
that are used for user training and awareness
that you might come across
and each one means a slightly different thing.
They are security awareness training,
security training, and security education.
So the first type of training
is known as security awareness training
and it's used to reinforce the importance of having users
help you secure the organizations valuable resources.
This includes things like educating your end users
on the current threats facing the organization,
phishing campaigns, how to protect their passwords,
as well as what to do in the event of an incident.
Now all of your employees should attend
security awareness training at least annually,
that's once a year.
Studies have shown that this is by far,
the best return on investment a company can make
into their security policies and security of their networks
because users are one of the largest vulnerabilities
in most organizational networks.
This is the type of training I was discussing
when we talked about user training
back in social engineering.
Now security training is our second category
and it's used to teach the organizations personnel
the skills they need to perform their job
in a more secure manner.
So this training is usually going to be focused on IT staff
and administrators as well as other technical employees.
For example, let's say I sat my system administrators
down to get some training to learn in the most secure way
to set up a user account and create passwords
and this training would be a form of security training.
Maybe this was very specific
and it was telling them the procedures
and the techniques they should do to be able to do this
inside of a Windows 2016 Server environment.
That would be the idea of this type of security training.
Now when I get to security education,
this is more general in nature.
This course you're taking
is an example of security education.
It's designed for cybersecurity professionals
to gain more expertise to better manage
the security programs at their organizations
but it's less procedural and it's much more generalized.
So we're not going to be talking specifically
about do steps one, two, three, and four
to set up this user account.
Or, here's exactly how you should configure
your policies in your organization.
This class is a great example of security education
because it is that generalized security focused mindset.
Now, security awareness training should be developed
based on your intended audience
and there's going to be multiple different versions
of the training.
So when I talk about that annual training
that I'm going to give to all of my users,
I might break that up into three or four different levels.
I might have one for my managers, one for the general staff
and one for the information technicians, right?
And the reason is, there's different risks that are faced
by each job role within the organization.
As a manager, their going to face different risks
than somebody who works in accounting.
And that person is going to have different risks
than somebody who works in IT.
So during this training,
you want to make sure that you're focusing it
on those specific groups.
Also, you want to make sure you're covering your organizations
policies and procedures such as all of those
that we've been covering inside this section of the course.
This is going to make sure your users understand
what's expected of them
and what the proper policies are that they need to follow.
Additionally, you can have specialized training
that's developed for your organization
based on the applicable laws, regulations,
or business model that you have as well.
So if you're a healthcare company,
you might want to talk more about HIPAA.
If you're a financial services company,
you might want to talk more about GLBA.
Training for management should also include
discussions of policies, guidelines and standards.
Whereas, your technical staff
may need to be given more training
on how to best identify when an attack is occurring
and what regulations are applicable to them
and when breach reporting is necessary.
Finally, as you're conducting security audits
of the organization,
you want to feed the lessons learned from that
back into the training pipeline.
So let me give you a good example of this.
Let's say you hired me to do a pen test
and I found out that I was able to phish your employees
and get 30% of your employees to click links
in a phishing email.
What should you do?
Well, you should probably be providing them
annual training against clicking on phishing links
inside of your security awareness training, right?
Now, let's say I went and I found a bunch of weak passwords.
Well, then we want to train employees
on how to create a more secure password.
Anything we find that's repetitive issues
inside the networks through our audits,
we want to feed that back into the training
at either the management level, the staff level,
or the administrator level.
(technical music)