Are Your Employees The Weakest Link Against Cyber Crime?

It goes without saying that cyber security features prominently in the to-do list of just about any organisation. Cyber criminals aren’t picky - they will happily target the financial sector, the retail sector, legal firms, public sector organisations and even the Government.

If there is money to be made from a ransomware attack or sensitive data to be harvested via a phishing link, hackers will be having a go. They are a persistent bunch.
 
It makes sense that businesses take all the right steps when it comes to investing in robust defences and solutions against cyber attacks. So, they invest their cyber budget on AI and ML based solutions with enhanced security such as CASB. They invest in multifactor authentication or passwordless systems or they have started to get quotes on zero trust network architecture - all sensible approaches.

However, all these things are rendered almost null and void if you neglect to fortify arguably the most critical part of the security puzzle - your people.

If there is no (or very little) security training for your employees, then they will continue to be the weakest link in your defences. And it doesn’t suffice to provide once-in-a-lifetime training or an initial “new starter workshop” in the hope that your organisation is ticking all of the boxes. The threat landscape (and solutions designed to protect against threats) is forever changing, always adapting.

You should therefore treat training in the same way. It should be both comprehensive and regular.
 
Don’t want to take our word for it?  Here in the UK, the independent body set up to uphold information rights Information Commissioner's Office (ICO) has now mandated such training for organisations. The ICO’s guidance is that all staff and volunteers that have access to data, should receive cyber awareness training as part of their induction, within 30 days of starting and before the employee is granted access to any databases containing personal or sensitive data. In addition, they direct that any such training should be on an ongoing basis for all employees. And be warned. If your organisation reports a cybersecurity breach to the ICO then you must be able to demonstrate to the ICO that all new starters have completed training and that you have ongoing training in place for all employees including management of any employee unable to attend such training. If it turns out that your organisation has failed to comply with the ICO’s guidance here than any financially punitive measures could increase accordingly - perhaps other penalties too.
 
It is worrying to see research published in a report by CybSafe, in conjunction with the National Cybersecurity Alliance, that found that 64% of participants still did not have access to any kind of cyber security advice or training. The report went on to point out that even for those who did receive any such training, many found the initiatives to be of little to no worth (27% said that they did not see the benefits of using the training they had access to). It is generally agreed that the vast majority of cyber attacks (perhaps as high as 90%) involve employee error of some sort.

It is common for cyber attacks to start at the Inbox of your email system, with almost all malware being delivered via email.
 
Given the very high correlation between human behaviour and cybersecurity it seems obvious to state that cultivating a general understanding of cybersecurity amongst employees should be prioritised. After all, if few people in your organisation don’t even know what multi-factor authentication is or why clicking on a link in an email is potentially devastating, then you will always be faced with an uphill battle.

Training, especially on a regular basis, is a very good start - giving your people at least the basic knowledge helps to fortify any investment in security solutions.

Going back to the report above, findings showed that amongst those participants with access to cybersecurity training, most made use of it (73%), demonstrating people’s willingness to learn more about ways to protect themselves online when information is available to them.
 
Fortunately, industry has responded positively to this apparent dearth of knowledge amongst workforces generally. There is cyber security training that sets out to strengthen the ‘human firewall’ by running phishing simulations, for example - remember, almost all successful malware attacks arrive via email. Regular training of this sort will deliver valuable data - your organisation needs to be able to measure the progress of people’s understanding to see if real change is achieved.
 
Cyber crime is a scourge of our times. Criminals constantly adapt their approaches to try and beat the latest and greatest defences served up by the cybersecurity industry. However, perhaps your greatest ally in the war against cyber crime are your people. A well- trained and knowledgeable workforce is the greatest deterrent here.  

Steve Whiter is  Director at  Appurity

You Might Also Read:  

How To Improve Cyber Security Visibility & Control:

 

« Find Your Security Vulnerability Before Hackers Do
Cybersecurity Lessons From Ancient History »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Resecurity, Inc.

Resecurity, Inc.

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

ON-DEMAND WEBINAR: Navigating cloud security: The importance of posture management tools

ON-DEMAND WEBINAR: Navigating cloud security: The importance of posture management tools

Watch this webinar to see how cloud security posture management (CSPM) tools can fit into your cloud security strategy.

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

Happiest Minds Technologies

Happiest Minds Technologies

Happiest Minds offers domain centric solutions in IT Services, Product Engineering, Infrastructure Management and Security.

Elemendar

Elemendar

Elemendar Artificial Intelligence reads cyber threat reports written by humans and translates them into industry-standard, machine-readable and machine-actionable data.

ECOMPLY

ECOMPLY

ECOMPLY is an all-in-one GDPR Compliance Solution. Efficient data protection management system for businesses and DPOsomply.

Lightship Security

Lightship Security

Lightship Security is an accredited Common Criteria and FIPS 140-2 IT security testing laboratory that specializes in test conformance automation solutions and IT product security certifications.

Cybersecurity Professionals

Cybersecurity Professionals

Search vacancies from top cyber security jobs worldwide on CyberSecurity Professionals. View IT security jobs or upload your CV to be seen by recruiters from industry leading firms.

CybX Security LLC

CybX Security LLC

CybX is the first company of its kind to merge the practice of computer forensics with computer security and information security.

Bolt Learning

Bolt Learning

Bolt's Cyber Security eLearning module provides users with an in-depth understanding of cybercrime, how it can occur and what everyone can contribute to preventing it.

Stratosphere Networks

Stratosphere Networks

Stratosphere Networks offer managed cybersecurity services rooted in Managed Detection and Response and Security Operations Center services that our team can tailor to meet your needs.

Datacentrix

Datacentrix

Datacentrix provides end-to-end cybersecurity services for the operational technology (OT) and IT environments to monitor, assess and defend our customers' information assets.

Netography

Netography

Netography provides a scalable and reliable platform for detection & remediation of cyber threats found on your network.

XioGuard

XioGuard

XioGuard is a managed security service for 360-degree cybersecurity coverage, protecting the entire attack surface, increasing performance, reducing cost, and simplifying operations.

BT Security

BT Security

BT provides telecommunications and network infrastructure services to keep businesses around the world connected and secure.

Marcum Technology

Marcum Technology

Marcum Technology consultants are focused on helping you reach your company’s full potential by exploring creative ways to integrate tomorrow’s technology into your business today.

Proximus Ada

Proximus Ada

Proximus Ada is the first Belgian center of excellence combining artificial intelligence and cybersecurity.

Evo Security

Evo Security

Evo Security is an Identity and Access Management company focused exclusively on serving MSPs, MSSPs and their SMB and Mid-Market customers.

Defimoon

Defimoon

DeFimoon is the International Blockchain Development & Security Agency. We provide professional services and solutions at the highest quality on world-leading chains.