Are Employees Your Weakest Link When It Comes To Security?

In security, the “human factor” is the bit we can’t account for.  Your technology could have every fail-safe, every safety feature and yet a lack of employee education could instantly compromise all of that.

So just how much of a threat are your employees?  Well, when IBM carried out the 2016 Cyber Security Intelligence Index, it found 60% of all attacks were carried out by insiders.  It’s not just ineptitude or human error either.  Cyber crime is a huge growth area and cyber criminals aren’t just lingering in a locked room on the dark web – they could be suited and booted and sitting right there in your office.

There are so many types of cyber crimes that threaten businesses.  From an activist who deliberately leaks data, to a disgruntled employee who sells a story to the press – you also need to be aware of malicious employees working with hackers or fraudsters too, supplying passwords, sensitive data or releasing malware into your system.  The human factor in all of this is unpredictable, after all.

So how can you turn your biggest threat into your biggest opportunity?

By putting security training at the heart of business development among your employees, and effectively training them to fight against an attack.  It's no easy feat but put yourself in your employees’ shoes: isn’t it much nicer to be invested in, trusted and involved in the security of your organisation?

My advice, don’t perceive employees as a threat – educate them about how they can become a “shield” against cyber crime. If you’re unsure where to start here are three easy ways to get started:

Start the process from the top down: The lines of communication need to be as strong between the security department and the management board as they are between IT and employees. Make briefings a diarised appointment and ensure management are fully briefed on the risks facing your organisation , the potential implications, and how employees can help be part of the solution.  Leading by example cannot be underestimated, so people will be inspired to take security seriously if they see the management board doing so too.

Encrypt everything: Use two factor authentication as standard, and put users into security groups according to their ability and expertise.  A one size approach doesn’t fit all in training terms so it’s important those with a better understanding aren’t talked down to, and those with more to learn are given the tools they need to understand why taking an active role in cyber security is so important.

Talk in terms of “shield” not “threat”: Be positive right from the start and don’t talk down to employees - you should have faith in them, and encourage them to take an interested in shielding the business from threats.  Yes, the risks are real, but inspiring staff is much more successful than demeaning them. You can incentivise through rewards and create ambassadors to promote your goals for you – stakeholder management is a great technique to use.
Teaching your employees to be more cyber aware is a skill for life, so make the training relatable to them and their everyday lives.  If people believe learning something new is good not only for you, as their employer, but for them, and their families, you’ll get a serious level of buy in and find your employees can quite easily become your biggest asset.

Jane Frankland is a cyber security expert and Managing Director of Cyber Security Capital, which helps cyber security professionals to develop their careers or build their businesses. She is passionate about helping to increase the numbers of women in cyber security and has authored a book - In Security: How a failure to attract and retain women in cyber security is making us all less safe.

First pubished on Dropbox Business Blog:

 

 

« London Conference: Protecting Critical Infrastructure
Trump Administration's Policy On Cybersecurity »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

Cyber Security Supplier Directory

Cyber Security Supplier Directory

Our Supplier Directory lists 6,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

Secure360

Secure360

Secure360 focuses on the following key areas: governance, risk and compliance, information security, physical security, business continuity management, and professional development.

Software Engineering Institute (SEI)

Software Engineering Institute (SEI)

At the CERT Division of SEI we study and solve cybersecurity problems, research security vulnerabilities in software, and develop information and training to help improve cybersecurity.

VietSunshine

VietSunshine

VietSunshine is a leading provider of network security infrastructure and solutions in Vietnam.

Mvine

Mvine

Mvine's primary business is authoring and selling Cyber-Secure Platforms for Collaboration Portals and for Identity Management as well as delivering cloud support services.

Findcourses.com

Findcourses.com

Findcourses is a dedicated education search engine designed to make it easy for our learners to search and find exactly what they need from our community of trusted training providers.

Secured Communications

Secured Communications

Secured Communications has developed the only unified secure communications platform trusted by public safety and counter terrorism professionals around the world.

Presidio

Presidio

Presidio is a leading North American IT solutions provider focused on Digital Infrastructure, Business Analytics, Cloud, Security & Emerging solutions.

Appsec Phoenix

Appsec Phoenix

Appsec Phoenix is an end to end vulnerability management platform that focuses on workflows, threat feed, and real time data.

Computer Services Inc (CSI)

Computer Services Inc (CSI)

CSI is a leading fintech, regtech and cybersecurity solutions partner operating at the intersection of innovation and service.

Stronghold Cyber Security

Stronghold Cyber Security

Stronghold Cyber Security is a consulting company that specializes in NIST 800, the Cybersecurity Framework and the Cybersecurity Maturity Model Certification.

Mosyle

Mosyle

Businesses and educational institutions rely on Mosyle to manage and secure their Apple devices and networks.

HiddenLayer

HiddenLayer

HiddenLayer is a provider of security solutions for machine learning algorithms, models and the data that power them.

Binalyze

Binalyze

Binalyze is the world's fastest and most comprehensive enterprise forensics solution. Our software helps you to collaborate and complete incident response investigations quickly.

ThrottleNet

ThrottleNet

ThrottleNet provides world-class managed IT services and cybersecurity to organizations in St. Louis and throughout Missouri.

Hack-X Security

Hack-X Security

Hack-X Security provide IT risk assessment and Digital Security Services. We are a trusted standard for businesses that must protect their data from cyber-attacks.

Genix Cyber

Genix Cyber

Genix Cyber provides world-class cybersecurity services that protect systems, cloud applications, infrastructure, critical data, and networks from evolving cyber threats.