Many organizations, especially large organizations, use various software and programs to protect against phishing attacks, malware, ransomware , and other threats. However, even the best software is not able to protect systems if employees are not properly informed and trained to recognize threats and deal with them.
Proofpoint conducted a study and published a report called “Beyond the Phish.” According to the report, employees knew some things about security, but not enough.
The survey was conducted between January and February 2019. The sample consisted of employees from 16 different companies. Participants had to answer a series of questions that showed how much employees knew about phishing attacks, ransomware, mobile security, implementing effective passwords, social media, and many other security- related topics .
On average, users answered 22% of the questions incorrectly. Last year, the rate was 19%. The topics that employees struggled with were identifying phishing attacks, data protection, mobile device protection and safe Internet use.
Some of the categories of questions that participants answered incorrectly are as follows:
- Mobile device encryption
- Protection of personal information
- The role of technical safeguards in preventing social engineering attacks
- Distinction between private and public data
- Actions to be taken in the event of a security breach
The topics that were most familiar to employees and to which they answered correctly were the following:
- How to identify potentially dangerous communication channels
- Effective safety measures during travel
- Identify threats, such as ransomware and malicious pop-ups
- Risks associated with Bluetooth
Users' knowledge of security issues varied depending on the sector the employees belonged to. Employees in education, transportation, energy, healthcare and construction gave the most incorrect answers. Employees in finance, telecommunications, technology, insurance and government gave the most correct answers.
The level of knowledge of employees (regarding security issues) varied depending on the category of questions. Workers in the transportation sector, for example, had more knowledge about Passwords and account verification, mobile device protection, and working safely outside the office. However, they were not as good at detecting phishing attacks. Workers in education could detect online threats, but could not recognize social engineering and other similar attacks.
Proofpoint said employee training is vital to business security.
“Not all security issues stem from attacks. Many stem from poor employee security practices and lack of knowledge.” There are several tools that can help you educate employees, according to the researchers.
