ASD ISM 2071 Training on managing social engineering threats

Managers should organise regular training sessions for staff who handle user accounts.

These sessions should cover examples of social engineering attacks, such as phishing emails or deceptive phone calls, and provide strategies to recognise and avoid them. Use role-playing scenarios and real-life examples to make the training engaging and memorable.

HR should update onboarding processes to include social engineering awareness.

Introduce new hires to basic concepts of social engineering during their first week, ensuring they know how to report any suspicious encounters or requests. Provide a user-friendly guide they can refer back to as needed.

The IT team should develop a simple guide on identifying social engineering threats, tailored to the organisation's specific risks.

This guide should be easily accessible on the intranet and include contact information for reporting incidents. Regularly update the guide with new tactics that attackers might be using.

Department heads should establish a clear reporting procedure for any suspected social engineering attempts.

Encourage staff to report without fear of blame. Ensure they know who to contact and how to escalate the issue if needed. Follow up on incidents to assess and improve response measures.

Communications teams should regularly remind staff about the risks of social engineering through newsletters or bulletins.

Highlight recent examples of attempted attacks and successful interventions by staff. This keeps the topic top-of-mind and encourages vigilance across the organisation.