Take An Analytical Approach To Cybersecurity Training

The world is rapidly changing, and this digital transformation it's undergoing promises many wonderful new opportunities, different ways of doing business and exciting means to disrupt traditional market sectors. However, the dark side of this future is the massive growth in cyber criminality, which has seen an increasing number of ways being developed to utilise viruses, back doors and other exploits to access a company's most critical information for nefarious purposes.

While there is a plethora of hardware and software security solutions designed to protect businesses from just about any security threat, an enterprise's biggest weakness remains its people.

According to Wayne Woolard, Sales Manager for South Africa at KHIPU Networks, things like malware and ransomware are obviously dangerous, which is why it has become crucial to make staff aware of them and how they operate. By doing so, it becomes easier for individuals within an organisation to identify these threats before they can cause any damage.

While people inside the IT industry are generally well aware of the dangers posed by cyber-attacks, he says, there are still many employees in any given company that are not tech-savvy enough. It is for this reason that an enterprise that spends a small fortune on security hardware and software must not forget the importance of also training the users.

"Traditionally, employees were warned about potential security hazards like malware by the company's IT department. However, such warnings are often not even read by the staff, much less heeded.

“Moreover, providing proper external training around this can be a challenge for a large enterprise, after all, a business with hundreds of employees simply cannot afford to have such a large number of people missing work for training purposes," he explains.

"What's needed is for these enterprises to take an analytical approach to the risk that individual users pose to an organisation, by undertaking a campaign that can test both your systems and your people.

“In essence, it is a simulated phishing campaign, testing how well your security architecture performs, as well as how security conscious employees are, by sending simulated phishing attacks to specific recipients."

Woolard suggests a 'false flag' operation of this sort enables a company to target staff members who may have been identified as potential security risks and see exactly how they deal with a phishing e-mail or SMS.

"This is not about punishing people who may click on the link that is sent or even those who may actually enter credentials of some sort, but rather, it's about understanding who in the business is doing this and why. In this way, they can be upskilled to ensure they don't fall for a genuine scam, if and when this occurs.

"Once the campaign has concluded, follow ups must also be conducted with all affected employees, explaining what the campaign was about, providing them with tips to avoid getting caught out by cyber criminals and of course, ultimately providing additional training to those that require it."

He indicates the standard option for such training is online teaching, which is kept short and pointed, using videos and quizzes that take around half-an-hour to finish and complete. Additionally, there's an option for live, in-classroom training to be undertaken, should this be necessary.

"The idea here really is to get the concept of cyber security lodged in the back of these employees' minds and inculcating a healthy suspicion and a deeper awareness of things.

“For example, an accounts person may have received e-mails dozens of times from a particular individual, but we want them to be aware enough to notice if something like their writing style has changed, as this may be indicative of their mail address having been hijacked."

At the same time, he adds, such a campaign also provides a fundamental understanding of all the key security technologies a company is employing. It helps the IT department to clarify exactly how these work and where the weak spots are that can be exploited.

"After all, if a phishing mail campaign of this sort is conducted, such a mail first needs to get through the organisation's firewall and the mail gateway. If it does so, this is already a problem.

“The same goes for if a suspected malicious attachment is opened by an employee, if your anti-virus program fails to immediately recognise this as dangerous, you need to be asking why.

“Finally, a campaign like this also means the business is able to gauge the reactions of the internal security team with regard to how they handle this.

"Ultimately, the benefits of undertaking such a campaign are enormous. It delivers not only user education, but valuable information around the technologies you are using, as well as how your specialist teams deal with security emergencies.

“In the end, a campaign of this nature is the ideal way to test for security flaws across all the key aspects of the business, namely your people, your processes and your technology.

"At the end of the day, training your users on cyber security and how it can impact both their personal and work life is one of the most effective ways to raise awareness," concludes Woolard.

At CSI we agree and commend Woodlard’s analysis and suggestions and we would recommend using GoCyber by MeLearning, which will be launched in April 2019 - www.melearning.co.uk/

ITWeb:         Image: Nick Youngson

You Might Also Read: 

Military Cyber Training Methods:

 

« Dating Sites Fraudster Alert
Four Ways That Fake-News Sites Trick People »

CyberSecurity Jobsite
Check Point

Directory of Suppliers

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

Tines

Tines

The Tines security automation platform helps security teams automate manual tasks, making them more effective and efficient.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

Armor

Armor

Armor provide managed cloud security solutions for public, private, hybrid or on-premise cloud environments.

CloudLayar

CloudLayar

CloudLayar is a cloud-based website firewall for protecting your website against online threats.

Information-Technology Promotion Agency (IPA) - Japan

Information-Technology Promotion Agency (IPA) - Japan

IPA is an implementing agency in Japan with a role to address Information Security, IT Systems Reliability and IT Resource Development.

Snyk

Snyk

Snyk is the leader in developer security. We empower the world’s developers to build secure applications and equip security teams to meet the demands of the digital world.

bwtech@UMBC

bwtech@UMBC

The bwtech@UMBC Cyber Incubator is an innovative business incubation program that delivers business and technical support to start-up and early-stage cybersecurity/IT products and services companies.

Hysolate

Hysolate

Hysolate has transformed the endpoint, making it the secure and productive environment it was meant to be.

Red Alert Labs

Red Alert Labs

Red Alert Labs is an IoT security provider. We created an independent security lab with a disruptive business offer to solve the technical and commercial challenges in IoT.

Protocol Labs

Protocol Labs

Protocol Labs is a research, development, and deployment institution for improving Internet technology.

IntaPeople

IntaPeople

IntaPeople are IT and engineering recruitment specialists. We have specialist teams for job sectors including Cybersecurity, IT infrastructure and DevOps.

Adzuna

Adzuna

Adzuna is a search engine for job ads used by over 10 million visitors per month that aims to list every job everywhere, including thousands of vacancies in Cybersecurity.

Absa Cybersecurity Academy

Absa Cybersecurity Academy

Absa Cybersecurity Academy is an initiative aimed at empowering marginalised South African youths to become certified cybersecurity specialists.

Hunton Andrews Kurth

Hunton Andrews Kurth

Hunton Andrews Kurth LLP serves clients across a broad range of complex transactional, litigation and regulatory matters. Practice areas include Privacy and Cybersecurity.

Ultra Intelligence & Communications (Ultra I&C)

Ultra Intelligence & Communications (Ultra I&C)

Ultra Intelligence & Communications provides critical, tactical capabilities that inform decision making in the most challenging environments.

Safe Systems

Safe Systems

Safe Systems provide compliance centric IT services for community banks and credit unions, ensuring that they are kept up to date on current technologies, security risks, and regulatory changes.

Rayzone Group

Rayzone Group

Rayzone Group offers a wide range of Cyber Security solutions and services, providing hollistic protection suitable for both enterprises and National cyber security centers.

Motive Managed Services

Motive Managed Services

Motive Managed Services take the complexity out of IT, Cybersecurity, and Network Operations, so you can focus on growing your business.