Are Your Employees The Weakest Link Against Cyber Crime?

It goes without saying that cyber security features prominently in the to-do list of just about any organisation. Cyber criminals aren’t picky - they will happily target the financial sector, the retail sector, legal firms, public sector organisations and even the Government.

If there is money to be made from a ransomware attack or sensitive data to be harvested via a phishing link, hackers will be having a go. They are a persistent bunch.
 
It makes sense that businesses take all the right steps when it comes to investing in robust defences and solutions against cyber attacks. So, they invest their cyber budget on AI and ML based solutions with enhanced security such as CASB. They invest in multifactor authentication or passwordless systems or they have started to get quotes on zero trust network architecture - all sensible approaches.

However, all these things are rendered almost null and void if you neglect to fortify arguably the most critical part of the security puzzle - your people.

If there is no (or very little) security training for your employees, then they will continue to be the weakest link in your defences. And it doesn’t suffice to provide once-in-a-lifetime training or an initial “new starter workshop” in the hope that your organisation is ticking all of the boxes. The threat landscape (and solutions designed to protect against threats) is forever changing, always adapting.

You should therefore treat training in the same way. It should be both comprehensive and regular.
 
Don’t want to take our word for it?  Here in the UK, the independent body set up to uphold information rights Information Commissioner's Office (ICO) has now mandated such training for organisations. The ICO’s guidance is that all staff and volunteers that have access to data, should receive cyber awareness training as part of their induction, within 30 days of starting and before the employee is granted access to any databases containing personal or sensitive data. In addition, they direct that any such training should be on an ongoing basis for all employees. And be warned. If your organisation reports a cybersecurity breach to the ICO then you must be able to demonstrate to the ICO that all new starters have completed training and that you have ongoing training in place for all employees including management of any employee unable to attend such training. If it turns out that your organisation has failed to comply with the ICO’s guidance here than any financially punitive measures could increase accordingly - perhaps other penalties too.
 
It is worrying to see research published in a report by CybSafe, in conjunction with the National Cybersecurity Alliance, that found that 64% of participants still did not have access to any kind of cyber security advice or training. The report went on to point out that even for those who did receive any such training, many found the initiatives to be of little to no worth (27% said that they did not see the benefits of using the training they had access to). It is generally agreed that the vast majority of cyber attacks (perhaps as high as 90%) involve employee error of some sort.

It is common for cyber attacks to start at the Inbox of your email system, with almost all malware being delivered via email.
 
Given the very high correlation between human behaviour and cybersecurity it seems obvious to state that cultivating a general understanding of cybersecurity amongst employees should be prioritised. After all, if few people in your organisation don’t even know what multi-factor authentication is or why clicking on a link in an email is potentially devastating, then you will always be faced with an uphill battle.

Training, especially on a regular basis, is a very good start - giving your people at least the basic knowledge helps to fortify any investment in security solutions.

Going back to the report above, findings showed that amongst those participants with access to cybersecurity training, most made use of it (73%), demonstrating people’s willingness to learn more about ways to protect themselves online when information is available to them.
 
Fortunately, industry has responded positively to this apparent dearth of knowledge amongst workforces generally. There is cyber security training that sets out to strengthen the ‘human firewall’ by running phishing simulations, for example - remember, almost all successful malware attacks arrive via email. Regular training of this sort will deliver valuable data - your organisation needs to be able to measure the progress of people’s understanding to see if real change is achieved.
 
Cyber crime is a scourge of our times. Criminals constantly adapt their approaches to try and beat the latest and greatest defences served up by the cybersecurity industry. However, perhaps your greatest ally in the war against cyber crime are your people. A well- trained and knowledgeable workforce is the greatest deterrent here.  

Steve Whiter is  Director at  Appurity

You Might Also Read:  

How To Improve Cyber Security Visibility & Control:

 

« Find Your Security Vulnerability Before Hackers Do
Cybersecurity Lessons From Ancient History »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

The PC Support Group

The PC Support Group

A partnership with The PC Support Group delivers improved productivity, reduced costs and protects your business through exceptional IT, telecoms and cybersecurity services.

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

Itaccel

Itaccel

IT Accel began a decade ago as a band of technical recruiters who wanted to bring our experience and depth of knowledge to solving complex human resou

BackBox Software

BackBox Software

BackBox is a leading provider of solutions for automated backup and recovery software for security and network devices.

HID Global

HID Global

HID Global is a trusted leader in products, services and solutions related to the creation, management, and use of secure identities.

Tutamantic

Tutamantic

Tutamantic develops software that reduces security risks and weaknesses during the architectural and design stages.

Nordic Cyber Summit

Nordic Cyber Summit

Nordic Cyber Security Summit addresses a wide range of technological issues from the IT Security spectrum and also provides a wider perspective from all aspects of the industry.

Simplilearn

Simplilearn

Simplilearn is the world's #1 online bootcamp for digital skills training in disciplines such as Cyber Security, Cloud Computing, Project Management, Digital Marketing, and Data Science.

AnaVation

AnaVation

AnaVation is a trusted partner delivering high-value, cost-effective solutions that solve the most complex technical and analytical problems for our customers.

Cyberwatch Finland

Cyberwatch Finland

Cyberwatch Finland's services improve decision-makers’ strategic situational picture and enable successful holistic cyber risk management.

Quantum Star Technologies

Quantum Star Technologies

Quantum Star Technologies has developed Starpoint to be a next-next-generation solution to cyber security threats. Our mission is to secure the online world through our patented technology.

RankedRight

RankedRight

RankedRight empowers security teams to take immediate action on their most critical risks.

KYND

KYND

KYND has created pioneering cyber risk technology that makes assessing, understanding, and managing business cyber risks easier and quicker than ever before.

Ruptura InfoSecurity

Ruptura InfoSecurity

Ruptura InfoSecurity provide CREST Accredited Penetration Testing & Offensive Security Services. We secure your critical assets through targeted and research driven penetration testing.

NewEvol

NewEvol

Don’t React, Evolve! Outsmart threats with real-time AI-powered dynamic defense capability of NewEvol all-in-one cybersecurity platform.

Miggo Security

Miggo Security

Miggo is the first Application Detection and Response (ADR) platform on a mission to stop application breaches.

Token Security

Token Security

Token is the new approach designed for the identity boom era. Introducing Machine-First Identity Security.

Bluecyber Insurance

Bluecyber Insurance

At Bluecyber, we are revolutionizing the cyber insurance market, democratizing access to digital protection for small and medium-sized businesses.