Every Single Employee Requires Cyber Security Training

What has become very apparent in the last few years is that all employees, from senior management to part-timers, are the largest cyber security vulnerability that any organisation faces. Proper training will reduce security costs, improve an organisations future commercial strategy, PR and its Brand security image. The Covid-19 global pandemic forcing millions of office workers to become remote workers has created a “perfect tsunami” for cyber criminals seeking to exploit the crisis and penetrate corporate defences via unsecured home networks.

Businesses investing heavily in cyber security often base their investments on technology, but don’t sufficiently attend to the human side of the problem, which is a very important issue and requires cyber security training and engagement for all employees.

The reasons why employees are so important for the operations security is because often cyber criminals will perform attacks on an organisation using phishing emails and similar tactics, making employees the first line of defense that needs to be strengthened.Of course, computers and apps aren’t clicking on phishing emails, humans are, so that’s where cybersecurity investments need to be focused. 

Employees are also the ones with everyday access to many of the organisation’s computers, networks and systems, which means they play an important part in building resilience in the threat landscape.

This means that organisations need to spend more time and thought creating a more sophisticated cyber security culture and behaviour change within their organisation and cyber training is a very important part of this process. Despite the fact that some organisations has a partial focus on developing cyber security awareness, few individuals actually understand their role in the organisation’s security culture.

A recent report by the leading certification organisation CompTIA showed that over half of most organisations employees have not received effective cyber security training, so it’s no surprise for instance that 96% of them still save passwords on their devices so they can ‘remember them’. But when standard security training often means a bland instructional video or a boring PowerPoint presentation, we can’t really blame employees for a lack of awareness. 

Effective cyber security training is difficult to do well. Security awareness training for end users is often too broad and sporadic to cultivate real needed skills for safe operation on networks. 

Often the responsibility for cyber security dwells in IT, or information security, whereas responsibility for training resides in human resources. Typically, IT specialists lack responsibility for and proficiency in training. HR professionals are uniquely positioned to understand the role of trained employees in cyber risk mitigation and to mediate solutions for an organisation’s cyber security challenges. However, they often do not have expertise in cyber security and they may lack technical expertise in cyber defense. 

Each aspect of the organisation knows part of the solution but none knows the whole solution and the result is disjointed and dysfunctional education and training.

Nevertheless, we have found cyber security training videos and engagement of employees that works that is created by companies like GoCyber

Security training needs to be more than a mere annual necessity. It needs to be an interactive and engaging experience that will solidify their role in the security posture of the organisation. Our forthcoming series of Cyber Training Reports, are aimed at helping the management of organisations to review and comprehend the changing Cyber issues and how to deal with their cyber security training requirements that your organisation needs. These issues need to be understood and used by senior management for strategic and tactical planning by all aspects of your organisation. 

One of the major issues that has become apparent and is not focused upon enough is the need for real time cyber training. 

Cyber security training needs to take place within all organisations in order to significantly reduce the chances and risks of criminal success that are using cyberattacks and hacking methods to steal your data, money, company secrets and login information. Currently cyber criminals are after identity resources such as social security numbers, credit card information and login credentials. These can be used to impersonate or steal directly from the organisation and cyber-attacks are being used to steal, monitor and influence most organisations via their management and employees.    

Background
We are at the beginning of an electronic revolution, that like earlier industrial revolutions, is already altering and 
substantially changing and redefining our society. The development has been called a Cyber Innovation or Web 0.3, but is probably best described as the 4th Industrial Revolution and will be a new age transformation for the world. This change is happening far faster than previous industrial revolutions. It began as a form of Information Technology but it is now developing and employing a range of emerging electronic technologies. These technologies include 3D commercial production, data driven vehicles, robotic, bio-technology, AI and there is a blurring of physical, digital and biological elements to create a new techno-reality. And of course this is also changing and bringing new types of criminal activity. 

You share in this new revolution as you are part of over half of the world’s population that now browses the Web, be it for work, shopping, social media, news, entertainment, or as part of the cyber criminals on the Dark Web. Cyberspace can be visualised as an electronic nervous system running through many national and international sectors and systems. Digital technology has already significantly rocked some industries like the publishing industry. Publishing has been completely changed by digital technology and has allowed readers a far faster electronic engagement with issues, news and analysis. 
However, as in all revolutions Cyber has a criminal down side and this also needs all of our engaging attention.

Cyber Attacks & Fraud
Cyber-attacks have cost US businesses over $650 billion in 2019 and UK businesses have lost almost $40 billion in the past 12 months due to cyber security attacks, hacks and related security incidents.The insurer found 55% of business had faced an attack in 2019 which is an increase from 40% in 2018. Currently almost 75% of firms are ranked as early starters in terms of cyber readiness. 

Most Directors and Boards are often ignorant to the dangers of hackers as they rely and trust the confident in their IT Department’s ability to keep their organisations safe.  Often to stay safe within the organisations belief protocol IT managers often hide the systems weaknesses as they are often under pressure to reduce costs. Almost two thirds of all organisations have no board member tasked specifically to tackle cyber threats and these organisations have not had a cyber security audits completed on their organisation’s IT systems and personnel.

Training is also an issue with the whole organisation, despite the fact that employee education is the best way to tackle these types of threats. 

Only around 27% of organisations have trained their employees in the last 12 months and this should be done on a frequent basis that doesn’t take up much of their time but keeps them on the cyber moment as the technology and the methods of attack change and become more sophisticated. For instance, currently Londoners are losing an average of £26 million a month in cyber-attacks on businesses and individuals, London's Scotland Yard has warned. Thousands of cyber fraud are recorded in the capital each month, with phishing emails, ransomware and malware the most common scams. 

Senior London Police officers have warned that fraudsters often target individual employees to bypass company security systems. Analysists suggest that about 73 per cent of frauds are carried out online, with many criminals based overseas, making it difficult for police in the UK to pursue a case. The saying 'Information is Power' is certainly true when it comes to cybercrime and access to your personal information is what gives hackers the power to tap into your accounts and steal your money or your identity. 

Everyone from governments, commercial organisations and each peson as an individual needs a new understanding, strategies and specific tactics to protect cyber secuirty. 

This requires a change in perspective, continued research and changes to working methods employing the relevant technology that projects into the new interconnected global future. It is very important that senior management in all areas of business and commerce, police forces, the military and all other aspects of government create and continually review an electronic cyber training strategy. This will help to ensure that continually up-dated and educated employees from senior management to trainees use of cyber and IT tactics within the organisation and also when they are working on personal computers away and outside the organisation’s offices. 

Directors and management should use training reports to track and summarise the key take-aways from training programs. This report will review some training program and focus on training sessions they have already used.  Business leaders will be able to use the new CSI Report to evaluate what is working and what isn't and to develop recommendations for change. 

Training Report
Our forthcoming Cyber Security Intelligence Report seris, will evaluate the positive and negative aspects of the current types of cyber training programs and the problems surrounding the current cyber-attacks and hacks.  We start by defining the training programs and move to recommending ways to improve cyber security and training. We will review the best duration times of the training, and review different training programs.

Describe the Background and Objectives The report will discuss the training program background and objectives and how information for the report was gathered. Reports might include feedback from trainers and attendee reviews or surveys. Define why the training occurred and what leadership sought to accomplish by appropriating resources for the program. 
Training Methods and Activities Include an explanation for how the training was conducted. Describe the presentation content as well as participant workshop exercises and the duration of each. 
Key Findings and Recommendations The final section will highlight the key take-aways. It will review some key feedback in surveys. 

In the conclusions we will discuss potential implications to the organisation considering new training based on the key findings. 

For a cost effective Report on your organisation’s cyber security and training needs  please Contact Cyber Security Intelligence and we will recommend the right cyber training and audit for your organisation. 

Image: Nick Youngson

You Might Aso Read: 

Creating A Cyber Incident Response Policy:

 

 


 

« Cyber Criminals Exploit Lockdown Workers
Q1 2020: Key Trends In Cyber Security »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Cyber Security Supplier Directory

Cyber Security Supplier Directory

Our Supplier Directory lists 6,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

BackupVault

BackupVault

BackupVault is a leading provider of completely automatic, fully encrypted online, cloud backup.

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

Bishop Fox

Bishop Fox

Bishop Fox provides tailored security consulting services to companies across all industries. Our customers include many of the top organizations in the world.

Zymr

Zymr

Zymr specialize in cloud computing solutions including Cloud Security, Cloud Mobility, Cloud Apps, Cloud Infrastructure and Cloud Orchestration.

Fidelis Cybersecurity

Fidelis Cybersecurity

Fidelis Cybersecurity is a leading provider of extended threat detection and response (XDR) solutions for your security operations.

CyberSecurity Malaysia

CyberSecurity Malaysia

CyberSecurity Malaysia is the national cyber security specialist agency under the Ministry of Science, Technology and Innovation (MOSTI).

Leibniz-Rechenzentrum (LRZ)

Leibniz-Rechenzentrum (LRZ)

The LRZ supports ground-breaking research and teaching in a wide range of scientific disciplines including information security and data protection.

Bangladesh Association of Software & Information Services (BASIS)

Bangladesh Association of Software & Information Services (BASIS)

BASIS is the national trade body for Software & IT Enabled Service industry of Bangladesh.

Tigera

Tigera

Tigera provides zero-trust network security and continuous compliance for Kubernetes platforms that enables enterprises to meet their security and compliance requirements.

Travelers

Travelers

Travelers is a leading writer of US commercial property casualty insurance and one of the world’s largest global insurers for cyber insurance.

Buglab

Buglab

The Buglab contest and Vigilante Protocol help companies all over the world to discover and fix vulnerabilities on their digital solutions or assets.

Pryv

Pryv

Pryv is a Swissmade software for privacy, personal data collection, usage, sharing and storage.

BRANDIT

BRANDIT

BRANDIT is a provider of online brand protection and legal enforcement services.

HardSecure

HardSecure

Hardsecure supports organizations to face security threats through the adoption of cybersecurity capabilities that guarantee 360º monitoring, visibility, mitigation, and blocking.

Exterro

Exterro

Exterro is a leading provider of e-discovery and information governance software specifically designed for in-house legal, privacy and IT teams at Global 2000 and Am Law 200 organizations.

Airgap Networks

Airgap Networks

Airgap is fixing the fundamental flaw of excessive trust. We help enterprises modernize their network for a simple and secure infrastructure.

Visory

Visory

Great businesses depend on great technology. We make sure our clients go to market with enterprise-level technology and world-class security for their data and infrastructure.

Moro Hub

Moro Hub

Moro Hub, a subsidiary of Digital DEWA, is a UAE-based digital data hub focused on digital transformation and operational services.