Cybersecurity Awareness Month: The Importance of Internal Training and Testing

October is Cybersecurity Awareness Month. It's not just a time to talk about why cybersecurity is important with your staff. It’s a time to train and test your staff on cybersecurity concepts. At DNSFilter, that’s something that we’re always striving to do.

As a cybersecurity company that categorizes and blocks malicious websites, it’s important to us that our staff are adept at identifying suspicious and malicious activity. We want them to question things with a zero-trust attitude, even when the possible threats seem to be coming from inside our network.

There are a few ways we promote cybersecurity awareness internally:

  • A cybersecurity policy—this is something every employee needs to read and sign. It details how we handle passwords, how we expect employees to treat our cybersecurity requirements, and how to report suspicious activity.
  • A dedicated team to handle reports of suspicious activity—and everyone knows who is on that team, too! We even have a dedicated Slack channel for it.
  • Testing our employees to help educate them—more on that in a bit.
  • Eating our own dogfood—DNSFilter is an important part of our cybersecurity stack.

For this Cybersecurity Awareness Month, we focused on testing our team’s cybersecurity awareness with help from our friends at HacWare. Here’s how we conducted the test and what we learned from it.

Note: We run tests like this every several weeks, and recommend everyone do the same. It’s incredibly important to maintain awareness, especially as teams grow. It’s easy for a new employee in particular, who’s not yet familiar with communication styles and is maybe new to cybersecurity, to fall for these sorts of emails.

Launching a Phishing Test

The campaign we ran with HacWare was to test phishing knowledge in particular. We have a procedure in place at DNSFilter to report possible phishing emails, and running this test enabled us to reinforce this procedure. Newer employees who had less interaction with this policy in the past were reminded of it, and employees who have been around for a while got a nudge of what is expected.

The tests went well, with many employees alerting others in Slack about the possibility of a phishing campaign against us across different Slack channels. Everyone was prompted to report these possible phishing emails in our usual way, meaning across the organization everyone was putting our cybersecurity policy into practice.

This is a valuable reminder that regular conversations around cybersecurity, prompted by actual internal testing, are the best ones to have. 

When faced with the possibility of a phishing attempt, how do you want your employees to react? Creating a policy and enforcing it is step 1. Testing that policy to make sure everyone understands it, however, is even more important. If your policy is convoluted or not comprehensive enough, you’ll learn it in testing.

And it’s much better to learn that you need to rework your policy in testing as opposed to in the face of a real spear phishing campaign against your company.

This test didn’t reveal anything major that we need to change about our security policy, but it did validate the continued need for regular testing—especially as the DNSFilter team grows.

Do Your Part. #BeCyberSmart.
Search
  • There are no suggestions because the search field is empty.
Latest posts
What is Secure Web Gateway: What It Does, Benefits, and More What is Secure Web Gateway: What It Does, Benefits, and More

In today's world of ever-increasing cyber threats, organizations need strong defenses to protect their networks and data and in this complex digital ecosystem, we need more than just one line of defense.

Revving Up the Fun: DNSFilter's IndyCar Experience Recap — St. Pete Edition Revving Up the Fun: DNSFilter's IndyCar Experience Recap — St. Pete Edition

What a weekend at the track! DNSFilter was thrilled to host 10 guests alongside Pax8 this weekend for an unforgettable IndyCar experience in sunny St. Petersburg. Those who joined us came from Thrive, MVP Network Consulting LLC, Myrtle Beach Academy of Aviation, Entech, NetGain Technologies,Warren Averett Technology Group, LLC, and ECMSI—we were lucky to be in such great company for our very first race of the season.

Man-in-the-Middle Attacks: What Are They? Man-in-the-Middle Attacks: What Are They?

A man-in-the-middle (MITM) attack is a form of cyber threat where a bad actor inserts themselves into a conversation between two parties, intercepts traffic, and gains access to information that the two parties were trying to send to each other. It allows attackers to eavesdrop, collect data, and even alter communications between victims. Understanding the mechanics, implications, and defense mechanisms against MITM attacks is essential for prote...

Explore More Content

Ready to brush up on something new? We've got even more for you to discover.