Are Your Employees The Weakest Link Against Cyber Crime?

It goes without saying that cyber security features prominently in the to-do list of just about any organisation. Cyber criminals aren’t picky - they will happily target the financial sector, the retail sector, legal firms, public sector organisations and even the Government.

If there is money to be made from a ransomware attack or sensitive data to be harvested via a phishing link, hackers will be having a go. They are a persistent bunch.
 
It makes sense that businesses take all the right steps when it comes to investing in robust defences and solutions against cyber attacks. So, they invest their cyber budget on AI and ML based solutions with enhanced security such as CASB. They invest in multifactor authentication or passwordless systems or they have started to get quotes on zero trust network architecture - all sensible approaches.

However, all these things are rendered almost null and void if you neglect to fortify arguably the most critical part of the security puzzle - your people.

If there is no (or very little) security training for your employees, then they will continue to be the weakest link in your defences. And it doesn’t suffice to provide once-in-a-lifetime training or an initial “new starter workshop” in the hope that your organisation is ticking all of the boxes. The threat landscape (and solutions designed to protect against threats) is forever changing, always adapting.

You should therefore treat training in the same way. It should be both comprehensive and regular.
 
Don’t want to take our word for it?  Here in the UK, the independent body set up to uphold information rights Information Commissioner's Office (ICO) has now mandated such training for organisations. The ICO’s guidance is that all staff and volunteers that have access to data, should receive cyber awareness training as part of their induction, within 30 days of starting and before the employee is granted access to any databases containing personal or sensitive data. In addition, they direct that any such training should be on an ongoing basis for all employees. And be warned. If your organisation reports a cybersecurity breach to the ICO then you must be able to demonstrate to the ICO that all new starters have completed training and that you have ongoing training in place for all employees including management of any employee unable to attend such training. If it turns out that your organisation has failed to comply with the ICO’s guidance here than any financially punitive measures could increase accordingly - perhaps other penalties too.
 
It is worrying to see research published in a report by CybSafe, in conjunction with the National Cybersecurity Alliance, that found that 64% of participants still did not have access to any kind of cyber security advice or training. The report went on to point out that even for those who did receive any such training, many found the initiatives to be of little to no worth (27% said that they did not see the benefits of using the training they had access to). It is generally agreed that the vast majority of cyber attacks (perhaps as high as 90%) involve employee error of some sort.

It is common for cyber attacks to start at the Inbox of your email system, with almost all malware being delivered via email.
 
Given the very high correlation between human behaviour and cybersecurity it seems obvious to state that cultivating a general understanding of cybersecurity amongst employees should be prioritised. After all, if few people in your organisation don’t even know what multi-factor authentication is or why clicking on a link in an email is potentially devastating, then you will always be faced with an uphill battle.

Training, especially on a regular basis, is a very good start - giving your people at least the basic knowledge helps to fortify any investment in security solutions.

Going back to the report above, findings showed that amongst those participants with access to cybersecurity training, most made use of it (73%), demonstrating people’s willingness to learn more about ways to protect themselves online when information is available to them.
 
Fortunately, industry has responded positively to this apparent dearth of knowledge amongst workforces generally. There is cyber security training that sets out to strengthen the ‘human firewall’ by running phishing simulations, for example - remember, almost all successful malware attacks arrive via email. Regular training of this sort will deliver valuable data - your organisation needs to be able to measure the progress of people’s understanding to see if real change is achieved.
 
Cyber crime is a scourge of our times. Criminals constantly adapt their approaches to try and beat the latest and greatest defences served up by the cybersecurity industry. However, perhaps your greatest ally in the war against cyber crime are your people. A well- trained and knowledgeable workforce is the greatest deterrent here.  

Steve Whiter is  Director at  Appurity

You Might Also Read:  

How To Improve Cyber Security Visibility & Control:

 

« Find Your Security Vulnerability Before Hackers Do
Cybersecurity Lessons From Ancient History »

ManageEngine
CyberSecurity Jobsite
Check Point

Directory of Suppliers

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

ZenGRC

ZenGRC

ZenGRC (formerly Reciprocity) is a leader in the GRC SaaS landscape, offering robust and intuitive products designed to make compliance straightforward and efficient.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

CloudPassage

CloudPassage

CloudPassage, a cloud security and compliance pioneer, safeguards cloud infrastructure for the world’s best-recognized brands.

Cybertrust Japan

Cybertrust Japan

Cybertrust Japan provides a comprehensive security certification and digital authentication service, enabling customers to build and manage highly secure IT infrastructures.

PhishLine

PhishLine

PhishLine helps Information Security Professionals meet and overcome the increasing challenges associated with social engineering and phishing.

CybSafe

CybSafe

CybSafe is a cloud-based platform focussed on addressing the human component of cyber security - an intelligent approach to awareness training.

Cybraics

Cybraics

Cybraics nLighten platform implements a unique and sophisticated artificial intelligence engine that rapidly learns your environment and alerts security teams to threats and vulnerabilities.

Destel

Destel

Destel is a system integrator and provider of IT services focused on Advanced Network & Security Solutions.

Jenson Knight

Jenson Knight

Jenson Knight is a global cyber security, cloud and IT infrastructure staffing specialist.

Zymbit

Zymbit

Zymbit provides hardware security modules (HSM) for IoT devices, including Raspberry Pi and other single board computers.

Netography

Netography

Netography provides a scalable and reliable platform for detection & remediation of cyber threats found on your network.

Exterro

Exterro

Exterro is a leading provider of e-discovery and information governance software specifically designed for in-house legal, privacy and IT teams at Global 2000 and Am Law 200 organizations.

Stratascale

Stratascale

Stratascale is a consultant, systems integrator, and technology advisor with expertise in Automation, Cloud Ascension, Cybersecurity, Data Intelligence, and Digital Experience solutions.

Resmo

Resmo

Resmo is an all in one platform for SaaS app and access management for modern IT teams.

GAM Tech

GAM Tech

GAM Tech is a Managed IT Service Provider that serves small and medium sized businesses in Alberta, British Columbia, Ontario and Quebec.

Ncontracts

Ncontracts

Our mission at Ncontracts is to continually improve our clients’ ability to manage risk and compliance.

CelcomDigi

CelcomDigi

CelcomDigi aspire to be Malaysia’s top Telco-Tech company, transforming beyond core connectivity to lead digitalization and innovation as part of nation-building.

VPNBlade

VPNBlade

VPNBlade is your go-to resource for expert reviews and advice on VPN services.