Term of the Week: Security Awareness

Why does a business professional need to know this?

Every business today needs to combat cybersecurity risks and, as such, must educate their employees and customers about the risks associated with their business.

Employees are primary targets for cybercriminals, and they need to understand how their actions can expose the business to a loss. Whether it is the risk of financial loss, loss of data, loss of privacy, or loss of confidential customer information, security awareness helps employees understand how to protect data.

Because employees are the first line of defense, they need to have a basic understanding of security risks. If employees have a baseline understanding of security issues, the business can be more agile combatting threats.

You can raise employee security awareness through effective training, but your efforts should not stop at training. Security awareness training is just one component of an overall security awareness program. Other components in such a program include newsletters, blogs, posters, teachable moments, computer-based training, security portals, and more.

Together, all of these elements can be the ingredients for a successful security awareness program. Although security specialists can create and deliver some aspects of a security awareness program, all business professionals are responsible for maintaining an awareness of potential vulnerabilities and the steps they can take to mitigate risk.

In addition to being a best practice, security awareness training is required to be in compliance with industry and governmental standards, including the Payment Card Industry Data Security Standard (PCI DSS), which is a global standard, and the Health Insurance Portability and Accountability Act (HIPAA)(HIPAA) in the US.