Turning a Core Competency into a Campus Culture of Cybersecurity: A Guide for Higher Ed
“Getting that buy-in isn’t just about protecting the institution. Because of the proliferation of technology, ease of internet access, AI, gaming culture, etc., it has now become a necessary level of preparation for employees in the workforce. Educating on this topic aligns directly with the core mission of a university.”
McAlmont said it is possible for an IHE to implement the foundational elements of a CSAT program even without adding expensive resources, if the institution’s IT staff has expertise in the most common and recent breaches and hacking attack vectors, and if the institution has an in-house or student development team to create the learning tools.
In a perfect world, every IHE would prioritize implementing a CSAT program that incorporates the “key parts of a successful educational methodology: something that is engaging, personalized, repetitive, and incorporates different learning styles,” McAlmont said. “A training program with regular touch-points that can reach a diverse set of learners where they are is the first step.”
He added that using brief examples from real-life cyber attacks as learning moments is a great tool for training.
“Learning that is relevant to an issue or experience and that clearly points out risks and benefits to the individual is also important,” McAlmont said. “Keeping the learning focused on creating new habits and positively changing behavior versus sending more punitive messages is also important.”
Finally, every IHE should have a CSAT program in place that is delivered to every member of the campus community, he said.
“That program shouldn’t be an annual training session, but rather structured with best educational practices in mind,” McAlmont explained. “That means campus IT security leaders should be communicating and training regularly, repetitively, and across different learning styles in order to engage learners so they can help protect networks.”
And every CSAT program should be complemented by simulated phishing campaigns, he added.
“Beyond implementing cybersecurity awareness training that works, IT security leaders must work with other campus leaders to convince the community that the training is necessary and valuable for everyone to help boost adoption.”
Learn more about Ninjio’s services at Ninjio.com or download the full guide.
About the Author
Kristal Kuykendall is editor, 1105 Media Education Group. She can
be reached at [email protected].