The worldwide WannaCrypt/WannaCry ransomware attack creates both an incentive and an opportunity for IT and cybersecurity professionals. You and your team can use current events to engage users more emphatically and effectively as defenders against such attacks and other threats.

In many if not most enterprises, users with any awareness of relevant current events are already nervous and waiting for, if not demanding, guidance from their IT and/or cybersecurity teams. They want to hear from you. And you want them to do everything they can to avoid falling victim to phishing, social engineering, bogus attachments and Web links, and other points of entry for ransomware and other malware.

Based on numerous conversations with and presentations by Ivanti customers and other enterprise IT users, here are three suggestions to help you accomplish both goals. Feel free to think of these as the new “three R’s” for more and better cybersecurity.

1. Remind your users

It’s obvious to you, and it’s obvious to some of them. But sometimes, even people who know things forget them, or let them slip in priority or importance. Where their role in protecting the enterprise from malware is concerned, users don’t have that luxury.

In its November 2016 report, “Ransomware Protection Best Practices,” Forrester Research makes five specific recommendations for nearly immediate cybersecurity improvements. Here is one of them. “Protect against phishing emails and ‘watering hole’ websites by leveraging all available anti-spam, anti-phishing, and web control tools on your network, and by educating, motivating, and empowering users to act as a ‘human firewall.’” (Italics added.)

If you don’t already communicate cybersecurity tips, tricks, best practices, and reminders to your users, start doing so now. Even if you already do, use current events to justify “special edition” outreach. Make sure to include links to resources from credible sources outside of your team and enterprise. (I recommend the WannaCrypt Webinar we held this week and the free patch management software we’re offering as great starting points.)

2. Reward your users

Include in your outreach opportunities for your users to gain rewards, from recognition to actual prizes. Use brief quizzes, deadlines for completing cybersecurity tests, responses to surveys, submission of suspicious emails, or all of the above to engage and solicit input and feedback. Rewards don’t have to be expensive. They can start with attribution and kudos in future editions of your outreach method of choice. (Small amounts of gift card value or other currency are always appreciated.)

3. Reinforce your users

You and your team will do well to convince your users that where cybersecurity is concerned, you are all in this together. To that end, user education must be supplemented by user training. And those users or teams identified as weaker links in your ransomware and malware defense chains should receive additional training, not reprimands.

As reported by TechRepublic, a recent survey of more than 1,200 IT and business decision makers found that 75 percent of CEOs use applications and programs not approved by their IT departments. 91 percent of those acknowledged that such behaviors are security risks to their organizations, but they use those unauthorized tools anyway to enhance their own productivity.

A separate survey, also reported by TechRepublic, found that more than one-third (35 percent) of cybersecurity professional surveyed “admitted to circumventing, disabling, or otherwise bypassing their organization's security.” Ten percent of those responding to the survey admitted to paying ransoms demanded by hackers.

Taken together, these survey reports make one fact abundantly clear. To be maximally effective, cybersecurity training must be frequent, easily consumed, and pervasive across the entire organization. Starting with IT and cybersecurity professionals themselves in many cases.

Beyond user education: Solutions from Ivanti

Ivanti offers numerous solutions designed to detect, prevent, and remediate malware and ransomware of all types. Ivanti can also help you and your team to rein in admin privileges and the vulnerabilities to attack they can create, and to control which applications run on your network. And Ivanti offers industry-leading patch management software for endpoints and servers, including some you can begin using now for free. So feel free to do so, or to read more tips on communicating with users, or contact Ivanti for more information about our cybersecurity solutions. We look forward to helping you to engage—and protect, and defend—your users more effectively.

Layered Security is the Whole Endpoint full report