A number of years ago, we here at Pipedrive went from seeing ourselves as a SaaS startup to realizing our responsibility as a medium-sized technology enterprise.
It was time, as a leading sales CRM, to invest further in our security credentials to provide peace of mind to our *|NR_CUSTOMERS_EN|*+ customers that their data is in safe hands. We tested and rolled out various ways of security training our engineers. Here's what we learnt (the hard way) so you don't have to.
According to TechTarget, an Information Security Management System is:
"An information security management system (ISMS) is a set of policies and procedures for systematically managing an organization's sensitive data. The goal of an ISMS is to minimize risk and ensure business continuity by proactively limiting the impact of a security breach."
Online courses are readily available, we used OWASP's web application security training with mixed results. Primarily because our people had different knowledge levels and as a ‘one size fits all' course, it didn't benchmark their ability and tailor course content accordingly. As a result, this learning method may be best suited to SMB's.
Experienced people felt we had wasted their time and the inexperienced, however excited, could not apply the information to the real world, nor did they share their newfound knowledge with peers! So, in summary, online courses are:
✓ Accessible and affordable
× One size does not fit all
× Not practical, therefore easy to forget
× Not cultivators of a security culture
If you have a number of IT and security staff that you could train, but only a limited budget, why not find out who is motivated in the first instance. Try optionally sharing an open source training course to see who takes it up.
Rangeforce Cyber Sieges are live competitions for your team and were the most inspirational and effective training method for Pipedrive.
People were put into teams of 8 to 10 and were tasked with protecting a website from a variety of cyber attacks. It doesn't get more real than that. (Until it's real of course.)
Using a virtual private network, your technical staff have to perform under pressure and learn the consequence of cyber security failures.
Individuals working alone enables workforce benchmarking, while them being grouped into teams and pitted against other teams encourages teamwork and heightens the urgency - just like a real life attack.
Performance is measured by:
We plan on doing ongoing Rangeforce Cyber Sieges because they get people fired up about security knowledge sharing. They also emphasise achieving security in the fastest most effective way possible:
✓ New cyber security knowledge
✓ Live practical learning
✓ Rectifying security flaws at speed
✓ Practice at designing and securing code
✓ Benchmark individual performance for development
Rangeforce is challenging yet fun thanks to the gamification experience. We are sold!
In a cyber attack you are only as strong as your strongest link. Teams with good leadership solve cyber attacks faster than individuals.
The classroom learning we tried was similar to the online course; it didn't provide a practical learning opportunity. Participants got to know a body of knowledge - but didn't get to apply it. Again, learnings were not shared with peers.
✓ Basic, intermediate, advanced level
✓ Investment in your people
× No practical application
× No opportunity to test knowledge
The long term benefit to an organization from classroom learning is questionable from our experience, so the winner is clear!
For comprehensive ‘classroom' learning look at SANS. They're pricey but provide the fullest cyber security education with coursework and qualifications.
The reactions so far from the training here at Pipedrive have been so positive that people have been ASKING to get involved - which is fantastic!
Training is only one piece of the Information Security Management System puzzle, of course. Nevertheless, it's arguably the most important piece.
How have you approached cyber security training?
Start or continue the conversation with like-minded sales and marketing professionals on our Community.Join our Community
A Guide to Email Marketing Regulations: Consent and GDPR
If you’re an email marketer, you need to get verifiable consent from your email users. In the EU (or marketing to the EU), you need to follow GDPR. Read our guide to make sure you know the rules and regulations.
Recurring Revenue: How to Set Up a New Payment Model
If you’re looking to add a recurring revenue model to your business and want to sell it successfully, our guide can help. We cover everything you need to know about types of recurring revenue, its pros and cons, deciding if it’s right for you, and implementing it.
How to Calculate Your Return on Sales Ratio: Formula, Definition and More
Calculating your return on sales ratio will help you gauge the overall health of your business and show how much of your revenue is actual profit versus operating costs. Check out our guide to creating an accurate return on sales formula.