Take An Analytical Approach To Cybersecurity Training

The world is rapidly changing, and this digital transformation it's undergoing promises many wonderful new opportunities, different ways of doing business and exciting means to disrupt traditional market sectors. However, the dark side of this future is the massive growth in cyber criminality, which has seen an increasing number of ways being developed to utilise viruses, back doors and other exploits to access a company's most critical information for nefarious purposes.

While there is a plethora of hardware and software security solutions designed to protect businesses from just about any security threat, an enterprise's biggest weakness remains its people.

According to Wayne Woolard, Sales Manager for South Africa at KHIPU Networks, things like malware and ransomware are obviously dangerous, which is why it has become crucial to make staff aware of them and how they operate. By doing so, it becomes easier for individuals within an organisation to identify these threats before they can cause any damage.

While people inside the IT industry are generally well aware of the dangers posed by cyber-attacks, he says, there are still many employees in any given company that are not tech-savvy enough. It is for this reason that an enterprise that spends a small fortune on security hardware and software must not forget the importance of also training the users.

"Traditionally, employees were warned about potential security hazards like malware by the company's IT department. However, such warnings are often not even read by the staff, much less heeded.

“Moreover, providing proper external training around this can be a challenge for a large enterprise, after all, a business with hundreds of employees simply cannot afford to have such a large number of people missing work for training purposes," he explains.

"What's needed is for these enterprises to take an analytical approach to the risk that individual users pose to an organisation, by undertaking a campaign that can test both your systems and your people.

“In essence, it is a simulated phishing campaign, testing how well your security architecture performs, as well as how security conscious employees are, by sending simulated phishing attacks to specific recipients."

Woolard suggests a 'false flag' operation of this sort enables a company to target staff members who may have been identified as potential security risks and see exactly how they deal with a phishing e-mail or SMS.

"This is not about punishing people who may click on the link that is sent or even those who may actually enter credentials of some sort, but rather, it's about understanding who in the business is doing this and why. In this way, they can be upskilled to ensure they don't fall for a genuine scam, if and when this occurs.

"Once the campaign has concluded, follow ups must also be conducted with all affected employees, explaining what the campaign was about, providing them with tips to avoid getting caught out by cyber criminals and of course, ultimately providing additional training to those that require it."

He indicates the standard option for such training is online teaching, which is kept short and pointed, using videos and quizzes that take around half-an-hour to finish and complete. Additionally, there's an option for live, in-classroom training to be undertaken, should this be necessary.

"The idea here really is to get the concept of cyber security lodged in the back of these employees' minds and inculcating a healthy suspicion and a deeper awareness of things.

“For example, an accounts person may have received e-mails dozens of times from a particular individual, but we want them to be aware enough to notice if something like their writing style has changed, as this may be indicative of their mail address having been hijacked."

At the same time, he adds, such a campaign also provides a fundamental understanding of all the key security technologies a company is employing. It helps the IT department to clarify exactly how these work and where the weak spots are that can be exploited.

"After all, if a phishing mail campaign of this sort is conducted, such a mail first needs to get through the organisation's firewall and the mail gateway. If it does so, this is already a problem.

“The same goes for if a suspected malicious attachment is opened by an employee, if your anti-virus program fails to immediately recognise this as dangerous, you need to be asking why.

“Finally, a campaign like this also means the business is able to gauge the reactions of the internal security team with regard to how they handle this.

"Ultimately, the benefits of undertaking such a campaign are enormous. It delivers not only user education, but valuable information around the technologies you are using, as well as how your specialist teams deal with security emergencies.

“In the end, a campaign of this nature is the ideal way to test for security flaws across all the key aspects of the business, namely your people, your processes and your technology.

"At the end of the day, training your users on cyber security and how it can impact both their personal and work life is one of the most effective ways to raise awareness," concludes Woolard.

At CSI we agree and commend Woodlard’s analysis and suggestions and we would recommend using GoCyber by MeLearning, which will be launched in April 2019 - www.melearning.co.uk/

ITWeb:         Image: Nick Youngson

You Might Also Read: 

Military Cyber Training Methods:

 

« Dating Sites Fraudster Alert
Four Ways That Fake-News Sites Trick People »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

Ipsidy

Ipsidy

Our identity platform enables mobile users to more easily authenticate their identity to a mobile phone or portable device of their choosing.

ThreatMark

ThreatMark

ThreatMark provides fraud detection solutions for digital banking and payments.

Rigado

Rigado

Rigado's mission is to enable commercial IoT success by providing high-performance secure and scalable wireless edge connectivity and network infrastructure.

Forgepoint Capital

Forgepoint Capital

ForgePoint Capital is a premier venture investor for early stage cybersecurity companies.

Griffiss Institute (GI)

Griffiss Institute (GI)

GI's primary role is to advocate and facilitate the co-operation of private industry, academia, and the Air Force Research Laboratory in developing solutions to critical cyber security problems.

Humming Heads

Humming Heads

Humming Heads offers a complete solution to fight the advanced threats that target a company's endpoints and servers.

Polaris Infosec

Polaris Infosec

Polaris Web Presence Protection (WPP) is powered by our proprietary artificial intelligence and machine learning engine to ensure that attacks are stopped before they affect your business.

Nostra

Nostra

Nostra are a next generation managed services provider with a constant focus on Security and Business Continuity.

XioGuard

XioGuard

XioGuard is a managed security service for 360-degree cybersecurity coverage, protecting the entire attack surface, increasing performance, reducing cost, and simplifying operations.

Spotit

Spotit

Spotit offers a wide-ranging portfolio of technologies and services, from consultancy, assessments and pentesting to the set up of completely new security and network infrastructures.

BrainStorm

BrainStorm

BrainStorm Threat Defense takes a new human-focused approach to security awareness that traditional training lacks. It’s a cutting-edge platform to make your users more security savvy.

Scybers

Scybers

Scybers are a global cybersecurity advisory and managed services company. With our deep expertise, we help our clients reduce their cyber risks with confidence.

Verisign

Verisign

Verisign is a Global Leader in Domain Names & Internet Security, providing protection for websites and enterprises around the world.

CYBHORUS

CYBHORUS

CYBHORUS are a team of Italian cyber security experts, specialized in cyber threat defense and strategic and organizational consulting.

Ionize

Ionize

Ionize offers solutions to help you uplift your capability across the full-spectrum of cyber security - assessment, remediation, monitoring, governance and ongoing education.

FearsOff

FearsOff

FearsOff is a global information security company serving clients worldwide. White hat operators with a black hat mindset to emulate real world attacks and everchanging threat vectors.