Abstract:Cyber security threats, including risks to remote workers, are varied and diverse, with the number of scams and business email compromise breaches increasing. Firms and their staff are experiencing mass phishing attacks, several typical precursors to more sinister attacks like cyber-enabled fraud, ransomware, and denial of service (DDoS) attacks. Threat actors are leveraging new technologies such as machine learning and artificial intelligence (AI) to deliver sophisticated scam and phishing messages that are challenging for users to identify as malicious. Several businesses are increasing technical efforts in critical areas, including network hardening, robust patching, anti-malware, ransomware detection applications, and multi-factor authentication to detect, prevent, and recover from potential threats. Despite that, these measures provide only a partial solution if the users who access the systems do not have good security awareness training. In this study, we review some cyber risks related to remote working and detail how they can be remediated through regular security awareness education campaigns (SAECs). The study presents the results of a proof of concept (PoC) experiment conducted to establish the value of regular SAECs in the fight against scams and phishing attacks against remote workers. The pilot results confirm that securing the remote office requires a robust SAEC. It argues that to be successful and help staff protect business systems and data, SAECs must be regular and varied, providing opportunities for staff to understand what to look for in suspicious scams and phishing emails. Moreover, they must provide opportunities for staff to practice their knowledge and understanding through practical exercises such as spam and phishing simulation exercises, which could help users avoid falling victim to spam and phishing emails.

A Study of Different Awareness Campaigns in a Company

Phishing in Organizations: Findings from a Large-Scale and Long-Term Study

The Effects of Group Discussion and Role-playing Training on Self-efficacy, Support-seeking, and Reporting Phishing Emails: Evidence from a Mixed-design Experiment

Content, Nudges and Incentives: A Study on the Effectiveness and Perception of Embedded Phishing Training

Comparative Simulation of Phishing Attacks on a Critical Information Infrastructure Organization: An Empirical Study

Cyber Security Awareness Campaigns: Why do they fail to change behaviour?

Phishing simulation exercise in a large hospital: A case study

Don’t click: towards an effective anti-phishing training. A comparative literature review

Analyzing the risk and financial impact of phishing attacks using a knowledge based approach

The Anatomy of Deception: Measuring Technical and Human Factors of a Large-scale Phishing Campaign

Securing the remote office: reducing cyber risks to remote working through regular security awareness education campaigns

Less is More: Exploiting Social Trust to Increase the Effectiveness of a Deception Attack

Setting Priorities in Behavioral Interventions: An Application to Reducing Phishing Risk

Education and Training Against Threat of Phishing Emails

Eyes wide open: The role of situational information security awareness for security‐related behaviour

Spear phishing in a barrel: Insights from a targeted phishing campaign

The Anatomy of Deception: Technical and Human Perspectives on a Large-scale Phishing Campaign

SoK: Human-Centered Phishing Susceptibility

"What Keeps People Secure is That They Met The Security Team": Deconstructing Drivers And Goals of Organizational Security Awareness

Exploring the Evidence for Email Phishing Training: A Scoping Review

Discover and Automate New Adversarial Attack Paths to Reduce Threat Risks for The Security of Organizations