Enhancing Security Awareness Across a Multi College Program with a centralised university

Challenges

Diverse User Base: Faculty, students, and administrative staff exhibited varying levels of technical proficiency and understanding of cybersecurity risks.
Distributed Infrastructure: The decentralized nature of operations across multiple colleges complicated uniform policy enforcement and training dissemination.
Phishing Attacks: Rising incidents of phishing emails targeted at students and staff, leading to credential theft and data breaches.
Compliance Requirements: Ensuring adherence to national data protection laws and university-specific cybersecurity policies.
Engagement: Low interest and participation in prior cybersecurity training sessions.

Customized Training Modules:
- Developed role-specific content for students, faculty, and staff.
- Interactive e-learning modules focused on phishing, password hygiene, and data protection.
Gamification and Incentives:
- Incorporated gamified elements like quizzes, leaderboards, and certifications.
- Offered incentives such as gift cards for top performers and participation in workshops.
Periodic Phishing Simulations:
- Conducted simulated phishing attacks to measure vulnerability and provide instant feedback.
- Follow-up training for individuals who fell for simulated attacks.
Centralized Training Platform:
- Leveraged a learning management system (LMS) to deliver, track, and assess training.
- Enabled localized customization for individual colleges while maintaining a unified framework.
Awareness Campaigns:
- Organized cybersecurity awareness events during National Cybersecurity Month.
- Shared regular newsletters with tips, recent threats, and success stories.
Metrics and Feedback:
- Established KPIs such as phishing susceptibility rates and training completion rates.
- Collected user feedback to continually improve the training modules.

Improved Awareness:
- Over 90% of students, faculty, and staff completed the training program within the first year.
- Post-training assessments showed a 65% improvement in cybersecurity knowledge.
Reduced Incidents:
- Phishing simulation susceptibility dropped from 30% to under 8% within six months.
- No major security incidents reported in the year following the program.
Enhanced Compliance:
- Achieved compliance with national cybersecurity and data protection regulations.
- Received positive feedback during external audits.
Sustainable Culture of Security:
- Greater engagement through gamification resulted in an ongoing commitment to cybersecurity.
- Created a network of "cyber ambassadors" across colleges to champion security initiatives.