Whether from disgruntled, frustrated or lazy employees abusing privileges or from cyber-attackers targeting employees’ system access, the risks to corporate information and systems due to human vulnerabilities are steadily increasing. We therefore help our clients understand two key areas:

As part of a corporate security program, employers are often responsible for proving they have educated staff on their responsibilities for complying with security policies and best practices to protect corporate information assets. More frequently, business managers are also concerned with the real impacts from a variety of potential security incidents that can cost thousands of dollars.

So whether it is from a single click on a malicious email attachment, or accidental mishandling of sensitive information, employees need to understand their responsibilities. Our approach leverages years of experience in analyzing corporate risks, regulatory compliance and organizational culture to produce effective and efficient employee security awareness training and assessment programs. The result is a workforce that is engaged and able to collaborate on strengthening its workflows.

Attackers know that humans are increasingly the weakest link in an organization’s defences. With this knowledge, attackers can patiently gather benign information that allows them trick employees into giving them what they want.  

Simulated social engineering attacks provide real-life scenarios that attackers may use to target an organization’s staff. For clearly sensitive business processes and repositories, specialized social engineering security assessments are invaluable in proving due-diligence. These exercises can also demonstrate for management and employees how a determined attacker might find a way to exploit weaknesses in staff behaviour. This may involve telephone inquiries or in-person attempts to infiltrate the business and access sensitive information and systems.

TRM's Employee Social Engineering and Security Awareness solutions provide a cost-effective and practical approach to meet any organization's non-technical security objectives.

Before an engagement, a TRM social engineering and security awareness specialist will consult with client managers to help define the scope of a project to meet compliance, risk and budget requirements.

Often, a general security awareness program can be deployed quickly to meet any compliance requirements, or to catch the “low-hanging fruit” of information security risks due to employee vulnerabilities. Once deployed, a security awareness program can be customized in phases to meet more stringent requirements.

For best results, formally defined, ongoing phishing assessments are also recommended to identify potential vulnerabilities in employee awareness and attack resistance. These assessments can be tailored to provide simulated attacks that resemble those that an attacker is likely to try to launch against targets within the organization’s industry. Results can be used as feedback to improve the organization’s security awareness program, and to motivate staff to be more vigilant.

For clearly sensitive business processes and repositories, specialized social engineering security assessments are invaluable in proving due-diligence. These exercises can also demonstrate for management and employees how a determined attacker might find a way to exploit weaknesses in staff behaviour. This may involve telephone inquiries or in-person attempts to infiltrate the business and access sensitive information and systems.

TRM can provide a written report, as well as a management briefing on the assessment results. Once employees realize the actual methods that might be used by attackers, they typically become more vigilant and more open to security guidance.

TRM’s Employee Social Engineering and Security Awareness solutions are extremely flexible, with special attention put on fairness to employees and responsible governance of the processes. This makes the program especially appropriate for organizations in the public sector as well as those in financial and healthcare industries.