The basics of any cybersecurity awareness training will include the dangers of the phishing attack. Whether via email or text message, more users are becoming familiar with these attempts to trick them into clicking, downloading, or logging in to hack them. However, one aspect to improving security is teaching employees the importance of reporting any identified attempts or accidental clicks.
Reporting a suspicious link - even if uncertain - contributes to better informed security teams who can adjust defenses as needed. Plus, tracking reporting trends in an organization also provides good insights for the security awareness team to assess the impact of their programs.
Wizer's latest video can help jumpstart that awareness:
Through communicating the value an employee provides when they report suspicious activity can create ownership for security across the organization. Increased reporting provides better insights for security teams and strengthens its ability to respond quicker to minimize risk.
In sharing insights from their own successes in building a strong security culture, Dennis Legori and Paula West shared the importance of helping employees understand the stages of reporting. Even if an employee accidentally clicks on a phishing link, there are still remediations that can be implemented to reduce impact as long as the employee communicates as soon as possible.
"There's all these points where you can act to stop things from happening...looking at business email compromise, there are 10 steps from someone researching [a target] to someone actually compromising a system, Steps 2-10 there's a spot along the way at every one of those steps for a human to say "wait, somethings off" and report it at that point and make a huge difference. I think it's important knowing that it's not just 'an event', it's multiple places that you can interject and turn things around." - Paula West, Carrier
In the past, the trend was to 'motivate' employees to adopt safe practice through penalizing the individual in some fashion. However, it's rarely effective and cultivates resentment as opposed to adoption. For employees to feel confident in reporting an incident, they must not only understand the importance, but also feel comfortable doing so. It's crucial to ensure employees know their actions are contributing positively to a security incident, regardless if they made a mistake by clicking or engaging.
While it should go without saying, part of ensuring confidence in reporting simply lies in the communication of what the steps are for your employees to report. Is there a phishing button they should use? Send an email to the security team or a particular individual? Being clear on the where and how will reduce barriers for reporting and give confidence.
Whether through internal reporting or reporting to public entities, building a habit of reporting is beneficial to everyone.