e-Learning Blog

Generally, information security training in companies aims to improve each employee's security literacy (the knowledge and skills related to information security and the ability to correctly apply them) in order to prevent security incidents (information security accidents) from occurring.

Examples of security incidents include unauthorized access and malware infections. When these incidents occur, they can pose significant risks to companies, potentially leading to information leaks and data tampering, which can be critical issues for businesses.

To avoid risks, it is important to organize and review work approaches as well as implement measures to enhance security itself. However, even with an advanced security system in place, it is humans who actually use it, so improving the security literacy of each employee is essential. Information security training can be said to be one of the most important employee training programs for companies to operate stably and continue growing.

So, what exactly does information security training entail?

General Information Security Training (Example)

Explanation of the risks and countermeasures when using internet-based services such as browsing websites, sending emails, and using information devices and mobile terminals.

Explanation of precautions and troubleshooting when disseminating information using dedicated platforms available on the internet, such as SNS and blogs.

Awareness through the introduction of case studies based on actual accidents and damages, and methods for avoiding risks learned from them

Information Security Training for Companies and Organizations (Example)

Explanation of security measures related to each employee, such as password management, virus protection, precautions during telework, and measures when using portable media and devices.

An explanation aimed at executives overseeing the organization regarding the necessity of information security measures, the concept of information security management, and the responsibilities of companies handling personal information.

In addition to "physical measures" against unauthorized access, viruses, and targeted attacks, explanations of security measures that information management personnel should implement, such as "physical security" related to server management and equipment failure measures, and the introduction and operation of information security policies.

As such, the content of information security education in companies varies depending on the position and role of the participants. It is important for each employee to be aware of their own responsibilities and actions to raise the overall security awareness of the organization and minimize security risks.

In this chapter, we will understand the information security risks surrounding companies and reaffirm the importance of information security education.

●Information security risks include "threats" and "vulnerabilities"

Information security risk refers to the potential for damage or negative impact related to information systems and their data, classified into "threats" and "vulnerabilities."

First, a "threat" refers to a factor that causes risk. There are human-made threats due to human actions and environmental threats such as disasters.

Next, a "vulnerability" refers to a weakness that can be exploited by threats. It indicates "security holes" such as insufficient antivirus protection, software bugs, or unlocked buildings. The greater the vulnerability, the more likely it is to be targeted by malicious attackers, increasing the risk of confidential information being stolen.

●Increasing Damage from Targeted Attacks

Currently, malicious cyberattacks are increasingly targeting specific organizations or individuals with the primary goal of financial gain. These attacks aimed at "specific organizations or individuals" are called "targeted attacks." There are various types of targeted attacks, but one of the most common is spoofed emails.

By cleverly guiding employees with spoofed emails and infecting their PCs with viruses, the virus spreads through the internal network from those PCs, stealing confidential information or destroying systems. These attacks often continue over long periods, and there are many cases where information was stolen without the victim realizing it!

●A red flag for business continuity due to loss of trust

Companies hold not only information about their own employees and personal data but also various information about business partners, contractors, and customers. Therefore, if this information is leaked improperly, the company may lose trust, leading to a decline in competitiveness and a fall in its market position. As a result, there may be cases where it becomes difficult to continue business operations.

In other words, if information security education is insufficient, it can cause serious damage to the company. Therefore, companies need to provide adequate information security education and minimize risks.

Here, we introduce the overall picture of information security education conducted by corporations, divided into six processes. Each of these is an essential step to enhance the effectiveness of the education.

1. Investigation and Analysis of the Current Status and Issues of Information Security Education
First, grasp the current status of security education implementation, employees' level of understanding, and past incident trends to identify issues. This allows you to clarify the priorities and scope of the educational content.

2. Formulation of an Educational Plan for Implementing Information Security Training
Based on the survey results, a plan is established to determine "who will be educated, what will be taught, and how it will be delivered." The content for each target group, the annual schedule, and evaluation methods are also specifically designed.

3. Development of Educational Programs Based on the Education Plan
In accordance with the education plan, prepare the actual teaching materials, curriculum, and educational methods to be used. The key is to combine methods suited to the purpose, such as e-learning, group training, and case studies.

4. Preparing the Environment for Implementing Information Security Education
To conduct education more efficiently and effectively, preparing the learning environment is essential. In addition to introducing a Learning Management System (LMS), establishing mechanisms to support review after learning and knowledge retention is also important to ensure the effectiveness of the education.

5. Conducting Information Security Training for Employees
This is the practical stage. Conduct training according to the established plans and programs, and continuously monitor learners' understanding and changes in awareness. Also, record data such as attendance rates and test results to help improve future training.

6. Analysis and Review of Education Implementation Results and Revision of Plans for Continued Implementation
Even after the education is completed, it is important to analyze the effectiveness of the implementation and improve the materials and plans as needed. Additionally, since information security is a constantly evolving field, regular updates are essential.

Information security education is not something that ends once it is conducted. Continuously carrying out the cycle of understanding the current situation, planning, implementation, evaluation, and improvement enhances the literacy of each employee and ultimately leads to improved organizational security.

When conducting information security education, it is important to choose an appropriate method according to the purpose and the internal environment of the company. Here, we compare five representative educational methods based on five criteria: "cost," "resources," "environment," "convenience," and "updatability." Understand the characteristics of each and consider the best method for your company.

Of course, cost and updateability are important, but selecting the optimal method while also considering the ease of learning for participants and the burden on those implementing it is the key to enhancing educational effectiveness.

So, what steps should be taken when actually conducting information security education in a company? We will explain this along with specific steps.

〈STEP.1〉Clarify the Educational Content and Theme
First, clearly define "what you want learners to gain from the education." At this stage, instead of setting a broad theme like "overall information security," try to establish as specific a theme as possible. Even if it is necessary to explain knowledge broadly, it is recommended to divide it by theme.
Examples: "Precautions when sending and receiving emails," "Precautions when sharing files with external parties," "Security risks inherent in telework"

〈STEP.2〉Select the Education Target Audience
Once the content and theme of the education are decided, select the target audience for the training. For example, determine whether all employees are targeted or if it is limited to employees of specific departments or branches. Defining the scope will make the training content more focused and practical. Additionally, assigning a person responsible for following up with each target group will help ensure smooth operation after the training begins.

〈STEP.3〉Assume the Frequency and Timing of the Training
Plan the frequency and timing of the training in advance and incorporate it into the schedule so that it can be conducted as part of regular work.
(Examples of frequency) Every April, once per quarter, etc.
(Examples of timing) At the time of joining the company, when an accident occurs at a competitor, when internal rules change, etc.

〈STEP.4〉Consider the Means of Conducting the Training
Based on the characteristics of the training methods explained in the previous chapter, consider the most suitable means of implementation for your company.

〈STEP.5〉Create or Arrange Training Materials
Once the means of implementation is decided, create or arrange the corresponding training materials. Even when arranging ready-made materials, if they can be customized to fit your company’s operations and environment, edit and adjust them as needed.

When utilizing existing materials such as e-learning or DVDs, there is the advantage of saving the effort required for creation. However, since the field of information security is constantly evolving, be sure to verify that the latest information is reflected. On the other hand, if creating materials in-house, it is beneficial not only to explain the theory but also to include real-life near-miss cases and scenarios related to actual work, adding elements that encourage employee interest and understanding.

We will provide a detailed introduction to the specific methods for creating e-learning materials later, so please be sure to check that as well.

〈STEP.6〉Conducting the Training
Once the preparations up to this point are complete, it is finally time to conduct the training. Use the prepared materials to thoroughly instill information security knowledge in your employees.

〈STEP.7〉Measure the Effectiveness of Training and Make Improvements if Necessary
When conducting training, carry out tests, interviews with employees (learners), and surveys to measure the extent of their understanding. Based on the results, evaluate the effectiveness of the training and make improvements to the materials if needed. Additionally, if there are employees with low test scores, it is important to provide follow-up such as retraining.

Information security education is not complete after just one implementation. Correctly measuring the effectiveness of the education and continuously improving the materials and delivery methods based on the results are essential for enhancing employees' understanding and practical skills. Here, we explain specific methods for measuring effectiveness and key points for utilizing the results in education.

〈Methods of Measuring Effectiveness〉

After the training, it is effective to combine the following methods to grasp the educational outcomes of employees.

(Method 1) Conducting Tests
Administer comprehension tests based on the training content to confirm the retention of knowledge.

(Method 2) Interview
Conduct hearings with learners to grasp their actual level of understanding, insights, and awareness of applying the knowledge in the workplace.

(Method 3) Questionnaire Survey
An effective means to broadly collect feedback on post-training satisfaction, clarity of the materials, and points for improvement.

〈Points for Utilizing Effect Measurement Results〉

By making use of the obtained measurement results, it is expected that the quality of education can be continuously improved.

(Point.1) Individual Follow-up for Learners with Low Understanding
For learners judged to have insufficient understanding based on tests or surveys, provide detailed follow-up such as individual instruction or supplementary lessons.

(Point.2) Identify Issues and Review Implementation Methods
Based on the overall trends of learners and feedback from each individual, it is important to examine whether there are any issues with the content or delivery methods of the materials and reflect these findings in the plan for the next implementation.

By continuing the cycle of measurement and improvement, information security education becomes more effective. To encourage each employee's understanding and behavioral change, adopt the perspective of "measuring and nurturing" rather than just "measuring and finishing."

There are various methods for information security education, but e-learning is especially recommended from the perspectives of continuity, convenience, and ease of updating.

E-learning, which can be accessed anytime and anywhere, offers employees an easy way to learn, while allowing administrators to centrally manage learning progress and feedback. Additionally, the interactive elements such as videos and quizzes make it appealing to gain knowledge about information security while having fun.

In addition to using existing materials, e-learning education can also be conducted by creating original materials in-house. Original materials can offer stronger uniqueness and provide content that is highly relevant to employees (learners), which can enhance their appeal. Here, we introduce methods for creating e-learning materials for information security education.

〈Method of Creating Materials.1〉Create with PowerPoint
When creating e-learning materials, PowerPoint is one of the easiest methods. The period from drafting to distribution is relatively short, and by utilizing existing assets (such as materials already prepared for group training), you can create materials more efficiently. Therefore, it is suitable for materials that require frequent updates, such as information security.

<Method of Creating Teaching Materials.2> Creating with e-Learning Authoring Tools
E-learning authoring tools are tools that allow you to easily create interactive teaching materials by combining various media such as text, images, audio, and video. Even without knowledge of programming, you can easily create high-quality materials simply by selecting configuration options. Examples of e-learning authoring tools include "iSpring Suite," a PowerPoint add-in software, and "Vyond," which specializes in animation.
＞ iSpring Sales 
＞ Vyond (Animation Production) Sales 

〈Method of Creating Materials.3〉Outsource to Professionals
This method involves ordering custom-made e-learning materials from vendors (sales companies) that provide e-learning content. A major advantage is being able to create your company’s unique materials from scratch with professional support. Of course, it is also possible to prepare materials in-house using PowerPoint or e-learning authoring tools introduced above. However, even if only part of the process or materials is outsourced, leveraging external resources can help efficiently produce higher-quality materials.

When creating e-learning materials, consider the following points.

① What tools will be used?
② Will it be created in-house or outsourced?
③ File formats (PowerPoint, video formats, animation)

Then, make the optimal choice that matches the completed image of the materials and various conditions. If you are unsure about your choice, it is also recommended to consult a vendor and receive advice.
＞  E-learning Material Production

In today's digital environment, risks such as cyber attacks and data breaches are always present. To protect companies from these threats, it is essential for each employee to enhance their security literacy, and information security training is a must.

If you have concerns such as "I don't know what kind of education to provide" or "I'm worried if the teaching materials are appropriate," why not consult with a vendor who has specialized knowledge?

Human Science provides comprehensive support for various advice on e-learning, including planning, design, and production of teaching materials. Additionally, we offer the e-learning material "Fundamentals of Information Security Course."

The "Information Security Basics Course" clearly and understandably introduces important points to consider when using computers and smartphones for business, such as software updates and precautions when using free Wi-Fi. The content is general and applicable across various industries, making it widely useful.

For more details, please refer to the e-learning site of Human Science Co., Ltd.

e-Learning Manuscript Easy Arrangement Series
＞ "Basics of Information Security Measures in Companies <Case Studies>"
＞ "Basics of Information Security Measures in Companies"
＞ "Information Security Basics Course - Information Security for Computers and Smartphones"
＞ "Information Security Basics Course - Information Security for Telework and Remote Work"
＞ "Information Security Basics Course - Targeted Attacks"
＞ "Information Security Basics Course - Ransomware"