Businesses look to their managed service providers to protect them from cyber threats such as phishing, and while many are able to deliver advanced spam filters and web filters, MSPs should also provide another layer of protection: one that addresses the human element of these attacks.
Phishing attacks target employees, and while it is important to implement technical measures to block those messages, it is not possible to prevent every phishing message from reaching inboxes. Given the volume of phishing messages now being sent, and the constantly changing tactics, techniques, and procedures of cyber threat actors, it is inevitable that some messages will land in inboxes. The bottom line is employees need to be trained how to recognize phishing attempts – they are the last line of defense.
One of the greatest benefits to come from security awareness training is getting employees to stop and think, and not blindly believe that every email or SMS message is genuine because it appears to be from an official source and provides a reasonable reason for taking a certain action. Training employees to be curious and to question is a vital part of developing a security culture.
Data from customers of TitanHQ who have started using the SafeTitan security awareness training and phishing simulation platform show clear benefits of the training. Over time, susceptibility to phishing attempts reduces as evidenced by the number of individuals who fall for simulated phishing emails. This has also been confirmed by MSPs that have started providing security awareness training and phishing simulations to their clients.
It is important, however, for MSPs to carefully consider the training platform they use. Providing training is one thing. Getting end users to engage with it and take it seriously is another. The training content needs to be informative, but it must also be enjoyable. Gamification is a key element to keep users engaged and quizzes are great for confirming the lessons have been understood. The training content also needs to be delivered in easily assimilated chunks. Training modules of no more than 10 minutes are best, as this is ideal for ensuring maximum knowledge retention and fitting the training into workflows.
Phishing simulations are an important part of the training process, not just for identifying individuals who require further training, but also for identifying the specific types of phishing emails that are working and are fooling employees. Training can then be tailored to address those security gaps. Phishing simulations need to be realistic, and since these emails will be sent over a long period of time, there needs to be considerable variation. Many different templates are needed to test different phishing tactics and the training platform needs to have constantly updated phishing templates, as real-world attacks are rapidly evolving too.
Phishing simulation failures need to trigger on-the-spot training. The training needs to be automated, so it will be delivered instantly when it is likely to have the most effect. The platform should also notify end users when they successfully reported a simulated phishing email or correctly identified a phishing attempt, to encourage them and praise them for being attentive.
Ultimately, security awareness training is vital for all businesses and a critical component of any cybersecurity strategy. MSPs that can offer this service to their customers can gain a significant competitive advantage, help their customers better defend against attacks, reduce the support time by preventing successful attacks, and ultimately save their clients money. However, there are important features of training products that MSPs need to look out for.
They need a solution that has the maximum impact for the minimum effort, as MSPs have a great deal of work to perform for many customers. The solution must be able to be used efficiently and allow much of the setup and training to be automated, and for reports to be automated and scheduled to send to clients to show them how effective the training is.
TitanHQ has developed the SafeTitan platform to meet the needs of MSPs, with recent updates making it even easier for MSPs to provide this service. These include direct injection of emails to inboxes to make sure they are not filtered out by email security solutions, easy segmentation of customers into groups to allow bulk configuration and changes to campaigns, and – as is the case with all TitanHQ solutions – making sure there is an excellent user experience, which means easy administration and low maintenance.
Security awareness training is a big opportunity for MSPs and can greatly improve the security posture of their clients. Talk to TitanHQ today about getting started and to find out how easy it is to add this important layer of protection to your service stack.
In this article, we explain the importance of security awareness training and the benefits for MSPs of adding security awareness training and phishing simulations to their managed services.
Security Awareness Training Works!
Security awareness training and phishing simulations have been proven to reduce the susceptibility of employees to phishing attacks. Through an ongoing program of training and testing, the average response rate to phishing attempts falls from the pan-industry average of 37.9% to less than 3%. Some employees are prone to click on links in emails and open attachments despite being given training, so getting the response rate lower may not be possible, but such a massive reduction in responses to phishing emails will save several times more money than the cost of providing training to the workforce.
Despite the high ROI of providing training, 57% of SMBs provide no security awareness training to their workforce whatsoever. When training is provided, it is often provided to new employees during the onboarding process, or as a once-a-year training session. The threat landscape is constantly changing and new phishing and malspam campaigns are constantly being developed to fool employees, so for training to be effective it must be an ongoing process.
Phishing is one of the main ways that ransomware actors gain initial access to networks, and according to the Verizon Data Breach Investigations Report, 82% of security breaches involve a human element. Given the extent to which employees are targeted, the rapidly changing threat landscape, and the high percentage of data breaches that are caused by human error, training is vital.
SMBs are Requesting Security Awareness Training from Their MSPs
The problem for many SMBs is they lack the in-house staff and the resources to create effective training campaigns. Training content needs to be constantly updated to teach employees about the emerging techniques used by threat actors. For this reason, many SMBs turn to third-party companies and use their solutions to train their workforce, and it is becoming increasingly common for SMBs to ask their managed service providers to assist with training and conducting phishing simulations.
Phishing simulations are a vital part of the training process as it gives employees practice at identifying phishing attempts outside of a training setting; however, there is potential for things to go wrong when these simulations are conducted by SMBs on their own staff. Having a managed service provider conduct the campaigns can be highly beneficial for SMBs. That extra degree of separation can help to prevent bad feeling amongst employees that management is trying to catch them out.
Interestingly, despite the benefits of security awareness training and phishing simulations and the demand from SMBs, only 60% of MSPs currently offer security awareness training and phishing simulations to their clients as part of their managed security services. The security awareness training market is now estimated to be worth $1 billion annually and is growing at a rate of 13% a year, and MSPs that provide security awareness training and phishing simulations as part of their managed services are reaping the rewards. They profit from providing the training, reduce the susceptibility of their client organizations to phishing attacks, and reduce the time they need to spend helping clients recover from successful attacks. MSPs may be surprised to hear that 69% of SMBs said they would hold their MSP accountable at some level for a successful phishing attack.
One of the problems that MSPs face when they consider offering security awareness training as a managed service is finding a suitable platform that allows them to easily provide training and automate the training and conduct phishing simulations. TitanHQ is now happy to announce that its award-winning security awareness training and phishing simulation platform – SafeTitan – has now been upgraded and has a host of new features to meet the needs of MSPs.
SafeTitan for MSPs – An MSP-Friendly Security Awareness Training and Phishing Simulation Platform
TitanHQ has conducted extensive research to find out exactly what MSPs need from a security awareness training platform. The company asked its MSP advisory council and extensive MSP customer base about aspects of the SafeTitan platform that could be improved to make it even better for MSPs. After extensive research and further development, TitanHQ is happy to announce that SafeTitan for MSPs has been launched.
MSPs already familiar with the security awareness training and phishing simulation platform may notice several new features that have now been added, which make it much easier to conduct mass training campaigns and phishing simulations. The MSP dashboard has been improved to make it easy for quick actions to be performed and to access live analytics and schedule client reports to demonstrate the ROI, either weekly, bi-weekly, quarterly, bi-annually, or annually.
The solution can be provided as a white label, that can take the MSP’s branding or be branded for their clients. Clients benefit from 80+ videos, training sessions & webinars, the training content is provided as modules of 8-10 minutes max to make it easy to be conducted without impacting productivity, and the phishing simulation platform has over 1,800 phishing templates based on real-world phishing and smishing attacks.
MSPs can easily set up and automate training and phishing simulations so that this managed service requires little in the way of actual management by the MSP. The solution is SSO-ready to avoid the annoying entry of login credentials, and now has direct email injection to ensure that phishing emails are delivered without having to configure allow lists and firewalls and if campaigns need to be modified, it is easy to make tweaks such as adding additional users. When phishing simulations are failed, the solution will automatically trigger targeted training in real-time in response to the specific failure.
We genuinely believe that we have created the ideal security awareness training and phishing simulation platform for MSPs and invite you to book a free product demonstration to see the product in action and to explain all the features.
For the first time in almost a decade, changes have been made to the ISO 27001 standard and the code of practices (ISO 27002). Details of the changes were first released on February 15, 2022, and came into effect this October.
ISO 27001 (or ISO/IEC 27001:2005 to be precise) is a specification for an information security management system (ISMS), which is a framework of policies, procedures, and controls to support an organization’s information risk management processes. All ISO 27001 accredited businesses, and those that plan to become ISO 27001 accredited, are required to comply with the updated standard. Businesses that fail to do so will lose their accreditation, but they are given time to make the necessary changes. Any business that fails to make the necessary changes will lose its accreditation after 3 years. It is strongly recommended not to wait and to make the changes as soon as possible, as implementing the controls will help your business better manage and mitigate risk.
ISO 27002, which used to be known as a code of practice, is no longer referred to as such and is more accurately referred to as a set of information security controls. There have been some amendments and reorganization of the security controls, which now list 93 controls as opposed to the 114 in the 2013 version. These controls have also been grouped into 4 themes (people, organizational, technological, and physical) rather than the 14 clauses in the previous version.
Importantly for accredited businesses, 11 new controls have been added to the ISO 27002 information security controls:
Threat intelligence
Information security for use of cloud services
ICT readiness for business continuity
Physical security monitoring
Configuration management
Information deletion
Data masking
Data leakage prevention
Monitoring activities
Web filtering
Secure coding
Some of these controls are very similar to previous controls; however, they have been categorized as new, so organizations should ensure that they are compliant with these controls, even if they seem similar. It should be noted that these controls are not mandatory, as it is possible to exclude a control provided no related risks have been identified and the organization is not required to implement the controls to meet its contractual, regulatory, or legal requirements.
The ISO 27001/27002 Web Filtering Control
The web filtering requirement requires accredited businesses to implement a web filtering solution that allows them to exercise control over the web content that can be accessed to protect against web-borne threats such as malware, ransomware, and phishing. Web filters typically block malicious IP addresses, such as those known to be used for phishing or malware distribution, through blacklists that are constantly updated based on the latest threat intelligence. They also allow businesses to carefully control the web content that can be accessed by users of their network to enforce their acceptable internet usage policies.
Web filtering is important as many threats are delivered via the Internet. Any employee with access to the Internet could easily navigate to a malicious site unless a web filter is in place to block that access, and phishing attempts delivered via email often have a web-based component. Should an attempt be made to visit a blocked site, the user is directed to a local block page that explains why the request has been denied.
WebTitan Cloud – Web Filtering Made Simple
As a provider of a DNS-based web filtering software-as-a-service (SaaS) solution – WebTitan Cloud – we would like to take this opportunity to introduce the solution and explain how it will help organizations comply with the web filtering controls of the revised standard.
WebTitan Cloud is a DNS-based web filtering solution that is delivered as a 100% cloud-based service. The solution uses the Domain Name System for web filtering, which makes it lightning fast with no latency. All web content is checked, with web filtering controls implemented in a fraction of a second, with no content downloaded unless the filtering checks are passed.
WebTitan Cloud is fed threat intelligence from more than 500 million endpoints worldwide, which automatically update the blacklists of known malicious content. Users can filter the Internet via 53 preset categories and 10 customizable categories to broadly block specific types of web content (anonymizers, pornography, gaming, gambling, dating, hacking, etc.). Content controls can also be applied based on the presence of user-defined keywords, with the content blocked if a certain threshold is reached. WebTitan can also be configured to block specific file types from the Internet such as executable files to further reduce risk, and the solution can detect and block malware communications via the DNS.
All controls can be accessed through an intuitive web-based interface, which also provides access to an extensive suite of reports that give administrators full visibility into the online activities of users, including real-time views down to the individual level. Controls can be implemented organization-wide, for locations, user groups, and individuals, with the solution integrating with directory services to make this as simple as possible.
One of the most important aspects of WebTitan Cloud that make it so popular is how easy the solution is to set up and use. Businesses can start blocking malicious content in a couple of minutes by pointing their DNS to WebTitan Cloud, and content control settings can usually be configured in about 20-30 minutes.
For more information on meeting your new web filtering obligations under ISO 27001/2 and details of WebTitan Cloud pricing, contact TitanHQ today. Also, feel free to sign up for a free trial of the solution to see for yourself how easy it is to start web filtering.
