Are Your Employees The Weakest Link Against Cyber Crime?

It goes without saying that cyber security features prominently in the to-do list of just about any organisation. Cyber criminals aren’t picky - they will happily target the financial sector, the retail sector, legal firms, public sector organisations and even the Government.

If there is money to be made from a ransomware attack or sensitive data to be harvested via a phishing link, hackers will be having a go. They are a persistent bunch.
 
It makes sense that businesses take all the right steps when it comes to investing in robust defences and solutions against cyber attacks. So, they invest their cyber budget on AI and ML based solutions with enhanced security such as CASB. They invest in multifactor authentication or passwordless systems or they have started to get quotes on zero trust network architecture - all sensible approaches.

However, all these things are rendered almost null and void if you neglect to fortify arguably the most critical part of the security puzzle - your people.

If there is no (or very little) security training for your employees, then they will continue to be the weakest link in your defences. And it doesn’t suffice to provide once-in-a-lifetime training or an initial “new starter workshop” in the hope that your organisation is ticking all of the boxes. The threat landscape (and solutions designed to protect against threats) is forever changing, always adapting.

You should therefore treat training in the same way. It should be both comprehensive and regular.
 
Don’t want to take our word for it?  Here in the UK, the independent body set up to uphold information rights Information Commissioner's Office (ICO) has now mandated such training for organisations. The ICO’s guidance is that all staff and volunteers that have access to data, should receive cyber awareness training as part of their induction, within 30 days of starting and before the employee is granted access to any databases containing personal or sensitive data. In addition, they direct that any such training should be on an ongoing basis for all employees. And be warned. If your organisation reports a cybersecurity breach to the ICO then you must be able to demonstrate to the ICO that all new starters have completed training and that you have ongoing training in place for all employees including management of any employee unable to attend such training. If it turns out that your organisation has failed to comply with the ICO’s guidance here than any financially punitive measures could increase accordingly - perhaps other penalties too.
 
It is worrying to see research published in a report by CybSafe, in conjunction with the National Cybersecurity Alliance, that found that 64% of participants still did not have access to any kind of cyber security advice or training. The report went on to point out that even for those who did receive any such training, many found the initiatives to be of little to no worth (27% said that they did not see the benefits of using the training they had access to). It is generally agreed that the vast majority of cyber attacks (perhaps as high as 90%) involve employee error of some sort.

It is common for cyber attacks to start at the Inbox of your email system, with almost all malware being delivered via email.
 
Given the very high correlation between human behaviour and cybersecurity it seems obvious to state that cultivating a general understanding of cybersecurity amongst employees should be prioritised. After all, if few people in your organisation don’t even know what multi-factor authentication is or why clicking on a link in an email is potentially devastating, then you will always be faced with an uphill battle.

Training, especially on a regular basis, is a very good start - giving your people at least the basic knowledge helps to fortify any investment in security solutions.

Going back to the report above, findings showed that amongst those participants with access to cybersecurity training, most made use of it (73%), demonstrating people’s willingness to learn more about ways to protect themselves online when information is available to them.
 
Fortunately, industry has responded positively to this apparent dearth of knowledge amongst workforces generally. There is cyber security training that sets out to strengthen the ‘human firewall’ by running phishing simulations, for example - remember, almost all successful malware attacks arrive via email. Regular training of this sort will deliver valuable data - your organisation needs to be able to measure the progress of people’s understanding to see if real change is achieved.
 
Cyber crime is a scourge of our times. Criminals constantly adapt their approaches to try and beat the latest and greatest defences served up by the cybersecurity industry. However, perhaps your greatest ally in the war against cyber crime are your people. A well- trained and knowledgeable workforce is the greatest deterrent here.  

Steve Whiter is  Director at  Appurity

You Might Also Read:  

How To Improve Cyber Security Visibility & Control:

 

« Find Your Security Vulnerability Before Hackers Do
Cybersecurity Lessons From Ancient History »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall (and why does it matter)?

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall (and why does it matter)?

Watch this webinar to hear security experts from Amazon Web Services (AWS) and SANS break down the myths and realities of what an NGFW is, how to use one, and what it can do for your security posture.

TrustedIA

TrustedIA

TrustedIA is a cyber and protective security company. Our mission is to help businesses protect themselves from disruptive events that can impact their successful operation.

Information Commissioner's Office (ICO)

Information Commissioner's Office (ICO)

The Information Commissioner's Office is an independent authority set up to uphold information rights in the public interest.

Verimuchme

Verimuchme

Verimuchme is a digital wallet and exchange platform to secure, verify and re-use personal information.

National Association of State Chief Information Officers (NASCIO)

National Association of State Chief Information Officers (NASCIO)

NASCIO's Cybersecurity Committee focuses helps state CIOs to formulate high-level security and data protection policies and technical controls.

Crossword Cybersecurity

Crossword Cybersecurity

We work with research intensive European university partners to identify promising cyber security intellectual property from research that meets emerging real-world challenges.

Ingalls Information Security

Ingalls Information Security

Ingalls Information Security provides network security, monitoring and forensics.

Indusface

Indusface

Indusface offers best website security, web application firewall and SSL certificate to keep your online business much safer.

Tenzir

Tenzir

Tenzir's primary focus lies on network forensics: the systematic investigation of cyber attacks with big data analytics.

State Service of Special Communications & Information Protection of Ukraine (SSSCIP)

State Service of Special Communications & Information Protection of Ukraine (SSSCIP)

State Service of Special Communications and Information Protection is the technical security and intelligence service of Ukraine, under the control of the President of Ukraine.

FiVerity

FiVerity

FiVerity provides financial institutions with cyber fraud defense to combat a dangerous and growing threat - the convergence of fraud-related theft with sophisticated, high-volume cyber attacks.

Deeper Network

Deeper Network

Deeper Network represents the world's first decentralized blockchain network for building a truly private, secure and fair Internet.

VP Techno Labs

VP Techno Labs

VP Techno Labs is an award-winning cybersecurity firm focusing only cybersecurity to develop cutting edge solutions for emerging business.

HTL Support

HTL Support

HTL Support, your trusted partner for comprehensive IT support in London. We specialize in delivering top-tier IT solutions tailored to both large enterprises and small businesses.

SignMyCode

SignMyCode

SignMyCode is a one-stop shop for trusted and authentic code signing solutions to safeguard software.

SecurityBridge

SecurityBridge

SecurityBridge provide a cybersecurity connection between our customers’ IT departments, the forward-facing business services, and their SAP applications.

ESProfiler

ESProfiler

Enterprise Security Profiler. Empowering CISOs with clarity & confidence in their security programme by visualising capabilities, usage and spend against their key threat priorities.