The human firewall is a concept in information security awareness that empowers employees to fight against cyber-attacks in a proactive manner.
While many organizations are now beginning to recognize the importance of investing in a robust security system and technology such as next-gen firewalls, SIEM, IPS etc., the human element of security is often overlooked.
The human firewall is essentially a commitment of employees to follow best practices in order to prevent as well as report any suspicious activity. Just the same way a regular firewall blocks certain types of traffic from entering the network, a team of well-trained employees will also protect your business network from cyber threats. Thus, the more employees you have committed to being a part of the firewall, the stronger it gets.
Several reports indicate that a great number of successful attacks occur due to employee mistakes or negligence. Therefore, the need for organizations to conduct regular security awareness training cannot be over emphasized.
Employees should always be vigilant and trained to spot potential hazards like phishing emails, ransomware attacks, software misconfigurations etc.
In order to build a successful and efficient human firewall, there are a few tips that should be considered;
- Keep it simple
Rather than overwhelming your employees with a lot of information, it is more effective to keep your security awareness training simple, while also focusing on strengthening the weaknesses that has been observed in your organization such as use of weak passwords, password reuse etc.
- Give incentives
Participation should be rewarded such as giving members prizes or special recognition for doing things like catching phishing emails. We encourage use of quizzes & games in order to make the training exciting and also track individual progress.
- Involve every department
All employees should be encouraged to be a part of the human firewall. Employees shouldn’t feel intimidated that they aren’t tech-savvy enough to be participate. As a matter of fact, non-technical departments are usually often the targets of phishing attacks and are more likely to click on a malicious email attachment.
- Monitor Vigilance
Cybersecurity awareness is not a one-time event. This is an ongoing war that requires all defenses to be on high alert at all times. In order to gauge the effectiveness of your company’s security awareness training program, organizations can make use a of a phishing simulation program that can send fake emails to unsuspecting employees to see if any links are clicked.
- Keep education ongoing
A lot of companies conduct security awareness training annually or biannually, but this is simply not enough. Security awareness education should be continuous, and employees should be constantly sent updates and briefs as new security threats arise.
Also, users should be educated whenever they change job roles for example, an employee moving from Admin to Finance department would likely be handling more sensitive information and security awareness training should be provided accordingly.
Your company’s security awareness training program should include key topics such as; spotting phishing attempts, defending against malware, preventing theft/loss etc.
Cybersecurity awareness training, when combined with an exciting learning approach and motivated employees, will empower them with the knowledge needed to detect & protect your company’s information systems even from the most sophisticated cybercrime attempts.
Start building your human firewall today!
By Chinua Katchy
