Why Is There a Need for Role-Based Security Training?
According to a 2024 Proofpoint report, 71% of workers admitted to acting in a way that put security at risk, such as clicking links from unknown senders or sharing credentials with an unconfirmed source.
So, why not just tell employees to reduce risky actions? It’s likely that they need to take such risks as part of their job, such as downloading resumes for HR, confirming credentials at the IT help desk or accessing medical data as a researcher.
“They’re not doing anything wrong,” Witt explains. “But these trainings need to support them so that they can fulfill their roles and still have safeguards in place. After all, they’re the ones who are getting the lion’s share of the attacks.”
Their roles may not be well known outside of the organization, but they may work in vulnerable ways or have access to sellable data that makes them desirable as marks.
“If you are a healthcare institution and you have any sort of research component as part of your organization, you are exponentially more attacked,” Witt says. “We’ve seen strong examples where particularly nation-state actors are trying to get access to data that’s valuable that they can monetize.”
READ MORE: Exploitation trends underscore the need forlayered cybersecurity in healthcare.
Organizations should especially have customized training for the help desk, which malicious actors are more likely to target, Witt adds. It’s common for the help desk to receive requests to reset authentication methods because someone purchases a new phone, for example. How can that help desk employee verify that this is a legitimate request coming from within the organization?
“They’re driven to want to help, and it’s an attribute you really want to see as part of your team, but a threat actor can prey upon that,” Witt says.
For example, consider a help desk employee who receives a request to change a password for someone claiming to be an oncologist onsite in a hospital’s emergency department. That help desk employee should be wary because oncologists are not usually in the ED.
“That’s the level of education, at an industry level, at a role level, that we’re trying now to build into our own curriculum,” Witt says. “Someone who has worked at a healthcare organization for a long time may be able to make that connection, but what about someone newer to the help desk and to the hospital? So, that needs to be a part of the training.”
Role-based security training should also include those with public personas or visible profiles, such as a noteworthy orthopedic surgeon or a doctor who makes frequent media appearances.
“The bad actors have figured out that not every email address or every person within an organization is treated equally or has the same level of vulnerability,” Witt adds. “There are certain people within those organizations and certain departments that have exponentially higher vulnerability.”
