Take An Analytical Approach To Cybersecurity Training

The world is rapidly changing, and this digital transformation it's undergoing promises many wonderful new opportunities, different ways of doing business and exciting means to disrupt traditional market sectors. However, the dark side of this future is the massive growth in cyber criminality, which has seen an increasing number of ways being developed to utilise viruses, back doors and other exploits to access a company's most critical information for nefarious purposes.

While there is a plethora of hardware and software security solutions designed to protect businesses from just about any security threat, an enterprise's biggest weakness remains its people.

According to Wayne Woolard, Sales Manager for South Africa at KHIPU Networks, things like malware and ransomware are obviously dangerous, which is why it has become crucial to make staff aware of them and how they operate. By doing so, it becomes easier for individuals within an organisation to identify these threats before they can cause any damage.

While people inside the IT industry are generally well aware of the dangers posed by cyber-attacks, he says, there are still many employees in any given company that are not tech-savvy enough. It is for this reason that an enterprise that spends a small fortune on security hardware and software must not forget the importance of also training the users.

"Traditionally, employees were warned about potential security hazards like malware by the company's IT department. However, such warnings are often not even read by the staff, much less heeded.

“Moreover, providing proper external training around this can be a challenge for a large enterprise, after all, a business with hundreds of employees simply cannot afford to have such a large number of people missing work for training purposes," he explains.

"What's needed is for these enterprises to take an analytical approach to the risk that individual users pose to an organisation, by undertaking a campaign that can test both your systems and your people.

“In essence, it is a simulated phishing campaign, testing how well your security architecture performs, as well as how security conscious employees are, by sending simulated phishing attacks to specific recipients."

Woolard suggests a 'false flag' operation of this sort enables a company to target staff members who may have been identified as potential security risks and see exactly how they deal with a phishing e-mail or SMS.

"This is not about punishing people who may click on the link that is sent or even those who may actually enter credentials of some sort, but rather, it's about understanding who in the business is doing this and why. In this way, they can be upskilled to ensure they don't fall for a genuine scam, if and when this occurs.

"Once the campaign has concluded, follow ups must also be conducted with all affected employees, explaining what the campaign was about, providing them with tips to avoid getting caught out by cyber criminals and of course, ultimately providing additional training to those that require it."

He indicates the standard option for such training is online teaching, which is kept short and pointed, using videos and quizzes that take around half-an-hour to finish and complete. Additionally, there's an option for live, in-classroom training to be undertaken, should this be necessary.

"The idea here really is to get the concept of cyber security lodged in the back of these employees' minds and inculcating a healthy suspicion and a deeper awareness of things.

“For example, an accounts person may have received e-mails dozens of times from a particular individual, but we want them to be aware enough to notice if something like their writing style has changed, as this may be indicative of their mail address having been hijacked."

At the same time, he adds, such a campaign also provides a fundamental understanding of all the key security technologies a company is employing. It helps the IT department to clarify exactly how these work and where the weak spots are that can be exploited.

"After all, if a phishing mail campaign of this sort is conducted, such a mail first needs to get through the organisation's firewall and the mail gateway. If it does so, this is already a problem.

“The same goes for if a suspected malicious attachment is opened by an employee, if your anti-virus program fails to immediately recognise this as dangerous, you need to be asking why.

“Finally, a campaign like this also means the business is able to gauge the reactions of the internal security team with regard to how they handle this.

"Ultimately, the benefits of undertaking such a campaign are enormous. It delivers not only user education, but valuable information around the technologies you are using, as well as how your specialist teams deal with security emergencies.

“In the end, a campaign of this nature is the ideal way to test for security flaws across all the key aspects of the business, namely your people, your processes and your technology.

"At the end of the day, training your users on cyber security and how it can impact both their personal and work life is one of the most effective ways to raise awareness," concludes Woolard.

At CSI we agree and commend Woodlard’s analysis and suggestions and we would recommend using GoCyber by MeLearning, which will be launched in April 2019 - www.melearning.co.uk/

ITWeb:         Image: Nick Youngson

You Might Also Read: 

Military Cyber Training Methods:

 

« Dating Sites Fraudster Alert
Four Ways That Fake-News Sites Trick People »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

CEPS

CEPS

CEPS is a leading think tank and forum for debate on EU affairs, ranking among the top think tanks in Europe. Topic areas include Innovation, Digital economy and Cyber-security.

MobileIron

MobileIron

MobileIron provides EMM capabilities to IT organizations that need to secure mobile devices, applications and content.

ThaiCERT

ThaiCERT

ThaiCERT is the national Computer Security Incident Response Team (CSIRT) for Thailand.

Prewen

Prewen

Prewen provide solutions to protect sensitive data across the organisation.

IntaForensics

IntaForensics

IntaForensics offer a full range of digital investigation services and are able to adapt to the individual needs of solicitors, private clients, Law Enforcement Agencies and commercial businesses.

SGCyberSecurity

SGCyberSecurity

SGCyberSecurity is Singapore's No.1 Cyber Security portal. From this platform, you will be able to find useful articles, resources and connect with the security companies for your business needs.

RevenueStream

RevenueStream

RevenueStream uses an innovative algorithmic approach to intercept and prevent payment fraud before it even happens.

Signal Sciences

Signal Sciences

Signal Sciences Web Protection Platform (WPP) provides comprehensive threat protection and security visibility for web applications, microservices, and APIs on any platform.

Virtru

Virtru

Virtru's Data Protection platform protects and controls sensitive information regardless of where it's been created, stored or shared.

AAROH

AAROH

AAROH helps customers in Government, Law Enforcement, and Enterprises to identify, prevent, detect, resolve and protect from threats, crimes, breaches & fraud.

IT Security Jobs

IT Security Jobs

IT Security Jobs is a dedicated portal for everything related to IT professionals looking for IT Security jobs.

Level39 (L39)

Level39 (L39)

Level39 is the world's most connected tech community, with over 200 tech startups and scaleups based onsite.

Rogers Cybersecure Catalyst

Rogers Cybersecure Catalyst

Rogers Cybersecure Catalyst helps Canadians and Canadian companies seize the opportunities and tackle the challenges of cybersecurity.

SessionGuardian

SessionGuardian

SessionGuardian (formerly SecureReview) is the world's first and only technology which ensures second-by-second biometric identity verification of your remote user, from log on to log off.

Pacific Global Security Group

Pacific Global Security Group

Pacific Global Security Group offers an intelligence-driven focus on all aspects of cybersecurity for IT/ICS/OT.

Catalogic Software

Catalogic Software

Catalogic helps clients backup, recover, manage, and protect their data across their enterprise and cloud environments with Smart Data Protection solutions.