Cybersecurity Awareness Month Is Over. Cybersecurity Awareness Is Not.
What Is Cybersecurity Awareness Month?
October just wrapped up, and with it another Cybersecurity Awareness Month. It’s been around for more than 20 years now, and I’d say in the last 12 or so it has become something every corporation in the world seems to do. Well, everyone I’ve worked for, even the small organizations. Come October, you get the email: time to take your cybersecurity awareness test or update or refresher. Whatever you want to call it.
You get it when you start a new job too. Welcome aboard, here’s your laptop, here’s your badge, and here’s your cybersecurity awareness training.
What Does Cybersecurity Awareness Training Usually Cover?
So, you go through it. You watch a couple of 20- to 30-minute videos. Sometimes there are genuinely interesting scenarios. Sometimes there are fun little icons or anime-style animated characters that walk you through what to do. And honestly, the scenarios are useful:
- Have you gotten a phishing email? Oh, here are all the criteria that make it look like a phishing email.
- Have you picked up a rogue USB drive and plugged it into your computer?
- Have you been sitting in a public place reading sensitive material from your organization where anyone could see it?
- Have you been socially engineered? Manipulated by someone into handing over information or access you shouldn’t have?
I’ve even seen the scenario where people go to a conference, pick up a free USB drive, plug it into their computers, and now there’s malware sitting on the machine. These things happen. They’re real, and that’s exactly why the training talks about them.
Is Cybersecurity Awareness Training a Compliance Requirement?
I wondered about this, so I looked it up. Short answer: for a lot of organizations, yes, it is.
- PCI DSS (anyone handling credit card data): Requirement 12.6 calls for a formal security awareness program, training at hire and at least every 12 months, and multiple methods of communication.
- HIPAA (healthcare and their business associates): 45 CFR § 164.308(a)(5) requires a security awareness and training program for the whole workforce, including management, and lists periodic security reminders as part of it.
- NIST SP 800-53 (federal agencies and contractors): control AT-2 covers literacy training and awareness, with an enhancement specifically for social engineering.
Is Annual Training Enough to Meet the Standards?
So that explains the annual click-through. But here’s the thing: even the standards don’t say “once a year and done.” PCI guidance talks about emails, newsletters, posters in break rooms, and memos. HIPAA says periodic reminders. The checkbox is the floor, not the ceiling.
Why Should Cybersecurity Awareness Continue After October?
Cybersecurity awareness is the responsibility of every user and every person within an organization. It’s an everyday event! The simple fact that we’ve created a month, and everyone does their cybersecurity awareness in that month, is inadequate.
How Can Organizations Build Cybersecurity Awareness Year-Round?
So, let’s do something that gives people awareness all year long:
- Run phishing campaigns all year. Not once in October. All year, so people become very aware that if they click on a link, they may be downloading malware or responding to a phishing attack.
- Put it on the walls. Break rooms already must display all the required HR information. Why not put a cybersecurity poster right next to it? “Hey, don’t click on that link unless you know who it’s from.” “Hey, don’t plug in a USB device if you don’t know where it came from.”
- Put signs where people talk. If I’m sitting in a public area, there should be a big sign on the wall: don’t talk about sensitive data here. This is a public space.
How Can You Avoid USB Risks When Presenting at Conferences?
I’ve personally gone to conferences where I plugged my laptop into the projector via HDMI, and there on the table was always a USB connection to plug into your laptop so you can control your mouse and, more importantly, move forward and back through your presentation.
As a cybersecurity guy, I never use it. I don’t know what that USB device is. Could it have been swapped out? I don’t know. So, I carry my own USB presentation pointer that connects to my laptop. When I go into those environments, I am not plugging in a random USB device.
That’s not paranoia; it’s awareness. And it’s the kind of habit you build by being reminded every week, every day, not by a video once a year.
Why Are Users the Front Line of Cybersecurity?
Let’s be very clear: in my opinion, users are the front line of any organization. If they’re simply clicking on a video, watching it, and clicking a few answers to, quote unquote, “be aware of cybersecurity,” then I have not done my job. I’m doing them a disservice, and I’m doing my organization a disservice.
Cybersecurity Awareness Month may be over, but cybersecurity awareness is not!
Book the Author
Want to bring these ideas to your audience? Jerry Chapman speaks at conferences, webinars, podcasts and corporate events. He shares practical, vendor-neutral guidance on building Zero Trust programs, from getting started to securing the AI era. Send an e-mail to info@numberlinesecurity.com.