TradeB is a consulting company headquartered in California. With years of expertise in creating business strategies, TradeB enables organizations to grow and build a competitive advantage through management consulting, technology, and design solutions. Since the company provides consultancy for many organizations performing in different sectors, it has established different teams with experts from various fields, including data scientists, designers, engineers, architects, linguists, which help organizations transform their business and achieve better results.
Due to the confidential nature of the information it handles, TradeB is obliged to ensure information security. To improve their information security, TradeB implemented an ISMS based on ISO/IEC 27001.
During the implementation process, TradeB was committed in ensuring that all staff members understand the importance of information security within the company. The information security training program was designed to ensure that employees of the company will consider the security aspects of their actions in their daily work.
Knowing that security threats are perpetual, TradeB decided to conduct weekly security awareness sessions at the beginning of the ISMS implementation process. Those awareness sessions were held by Alex, one of the information security experts contracted by TradeB. The training program was available for every employee of the company; however, its focus was to train employees outside the information security sector. Therefore, employees of the Finance Department were the first to be trained.
The training program covered threats faced by TradeB as well as best practices to be followed to mitigate those threats. Employees were trained to come up with and use strong passwords. In addition, by simulating realistic scenarios, employees were trained to recognize phishing or social engineering attacks. That way, they were able to put their skills into practice. The awareness sessions were also used to communicate information security processes and procedures within the company taking into account the confidentiality of the company's information.
However, the awareness sessions did not result successful as expected. Most of the employees of the Finance Department lacked information security expertise, so they found it challenging to understand some of the concepts and terminology used. They claimed that some of the issues being discussed were too technical and as such, they did not understand the sessions fully. Moreover, they claimed that their questions were not answered appropriately from the trainer, Alex.