The Great Resignation

According to Fortune Magazine, 40% of U.S. employees are considering an exit from their current place of business. This trend, which has been termed “The Great Resignation,” creates instability within organizations. High employee turnover increases security risks, making companies more vulnerable to attacks as human infrastructure becomes fragmented, leaving gaps that very often expose an organization.

This problem is compounded by the “Quiet Resignation” or quiet quitting - a trend of employees who feel overworked because of additional responsibilities placed on their shoulders, due in large to today’s employee shortage.

This trend has employees choosing to not go above and beyond in their jobs, such as not checking email in off-hours, passing on assignments outside of their normal duties, and limiting their compliance with security rules and practices.

Because of this employee exodus, the influx of untrained employees, and general malaise, the deployment of a successful security awareness program can be more challenging than ever for security teams.

With new employees entering the organization at every level, the extent of cultural dissonance increases, creating instability. Security professionals need to act quickly in response to security concerns caused by this instability to protect their organizations during these volatile times.  

Issues that commonly arise as employees transition out and enter the organization include the following: 

  • Potential data leaks:   When employees leave, there's a high risk of sensitive data leaks. Poor off-boarding processes and lurking emails may lead to data loss.
  •  Need for educational leveling:   When new employees join the organization, even if security training is well conducted, they are usually not on par with their peers. Unknown security habits may put the organization at risk, requiring the need for supplemental training.
  • Security oversight by employees:   With fewer staff, employees are overburdened and pressured. Security may be "forgotten" or neglected in the process.
  • Lack of support for remote work:  To support rapid employee recruitment, working at home is a must. Remote work flexibility helps to attract and retain new employees. 
  • Training mobility:   Remote work requires securing remote devices and dealing with new employee behavior for inherent distractions - on the go and at home.

With these challenges confronting organizations, security teams should consider deploying the following strategies:

1.    Continuous Training:   All employees are needed to protect against sophisticated phishing threats and this has become even more complicated in light of The Great Resignation. Because of the fractured and less-trained employee base, companies are at much greater risk. To mitigate that risk, training needs to be frequent - at least once a month and short – to not add additional burden to already burned-out employees. The training must also be positive so employees are motivated to get actively involved in the cybersecurity effort. 

2.    Prioritize New Employees:   Security depends on employee help and cooperation. Therefore, it is important to establish best practices in the workplace. New employees with unknown cybersecurity habits pose a high risk for the organization and need to level up their awareness fast. Start with low difficulty, create a foundation, then continually promote learning to the next level. 

3.    Implement data-driven Training:  For a cyber awareness training program to be successful, security teams must plan, operate, evaluate and adapt the training continuously. With data-driven platforms, security teams can monitor campaign performance to fine-tune employee defenses and build custom high-intensity training campaigns for high-risk groups, while also adapting the training per employee locale - to optimize learning results.     

4.    Maintain Vigilance:   Security itself is a full-time job. Keeping the training unpredictable to maintain employee vigilance is an essential part of the process, such as surprising simulation campaigns in a continuous cycle with the idea of catching employees off-guard – which deliver the best learning experience. To create high engagement, ensure training content is relevant to daily actions. Use short, frequent, and intriguing content in the employees’ own language. Tailor the training content to local references and current news.

5.    Promote long-term results:  Take advantage of the 'golden moment’ of failure to generate a meaningful learning experience. Instead of random enforcement training which can often be irrelevant to employees, make a lasting impression right when mistakes happen. Ensuring that training uses this limited window of time is also known as ‘just-in-time learning and is the key to the most effective results and behavior change. 

Comprehensive integration of the latest security know-how into everyday work is a must to counter the new risks of The Great Resignation and related workforce trends, making it more important than ever for every employee to get up to speed for high cyber resilience quickly.

Until the current state of affairs shifts in a direction more favorable to a stable and secure environment, IT professionals must be proactive in their security awareness training approach.                 

Omer Taran is the Co-Founder and CTO of CybeReady

You Might Also Read:

Cyber Training And The Skills Shortage:

 

« Under A Watchful Eye - Unified Observability
Britain's Cyber Security Laws Get Updated »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

TrustedIA

TrustedIA

TrustedIA is a cyber and protective security company. Our mission is to help businesses protect themselves from disruptive events that can impact their successful operation.

Infosecurity Europe

Infosecurity Europe

Infosecurity Europe is Europe’s number one information security conference and exhibition.

Digital Infrastructure Association (DINL)

Digital Infrastructure Association (DINL)

DINL is the leading representative for companies and organisations which are active within the Dutch digital infrastructure sector.

bwtech@UMBC

bwtech@UMBC

The bwtech@UMBC Cyber Incubator is an innovative business incubation program that delivers business and technical support to start-up and early-stage cybersecurity/IT products and services companies.

exceet Secure Solutions

exceet Secure Solutions

exceet Secure Solutions is your experienced specialist for Internet of Things (IoT), Heath Telematics, electronic signatures and timestamps and IT security.

Shinobi Cyber

Shinobi Cyber

Shinobi Defense System is an integrated security system that absolutely secures information with smart, automatic encryption and protects your endpoints by stopping any unauthorized actions.

Relution

Relution

Relution is the Unified Endpoint Management platform for innovative companies and educational institutions. It enables you to manage your mobile apps and devices easily and securely.

IoT Security Institute (IoTSI)

IoT Security Institute (IoTSI)

IoT Security Institute is an academic and industry body dedicated to providing frameworks and supporting educational services to assist in managing security within an Internet of Things eco-system.

Cyber Physical Security Research Center (CPSEC)

Cyber Physical Security Research Center (CPSEC)

CPSEC aims to contribute to the security enhancement of industrial infrastructure that creates value across cyber space and physical space.

Sonrai Security

Sonrai Security

Sonrai Security delivers an enterprise security platform focused on identity and data protection inside AWS, Azure, and Google Cloud.

NETRIO

NETRIO

If you are looking for a highly mature, exceptionally competent Managed Service Provider, NETRIO has solutions to keep your business running at warp speed with zero disruptions.

PrivacySavvy

PrivacySavvy

PrivacySavvy's mission is to provide you with all the information that you need to ensure that your internet privacy is intact, your devices are secure, and that any time you step online, you’re safe.

Arqit Quantum

Arqit Quantum

Arqit's mission is to use transformational quantum encryption technology to keep safe the data of our governments, enterprises and citizens.

Gotham Security

Gotham Security

Gotham Security delivers high-quality penetration testing, malicious adversary simulation, compliance program development, and threat intelligence services.

Rhodian Group

Rhodian Group

Rhodian Group (formerly Adar) specialize in providing Technology, Cybersecurity, and Compliance services to the insurance industry.

Winslow Technology Group (WTG)

Winslow Technology Group (WTG)

Winslow Technology Group is a leading provider of IT Solutions, Managed Services, and Cybersecurity Services dedicated to providing exceptional business outcomes for our customers since 2003.