Cybersecurity Is Too Important To Leave To IT

As hackers increasingly exploit human vulnerability, HR has a vital role to play, not least in ensuring businesses have the technical talent to fight back

They say crime doesn’t pay but, when it comes to cybercrime, it certainly costs. Oxford Economics reports that the average large business loses £120m when it is hit by a hacking attack; averaged out across the economy, it means around £4m per business, per year, is attributed directly to hacking.

And that doesn’t include reputational damage, or the price of defending against cyber assaults. Executives still wake up in terror at the prospect of suffering an email leak as widespread as the one Sony endured in 2014, when the spats of the Hollywood elite were laid bare alongside a trove of almost 50,000 employees’ details. 

TalkTalk’s reputation is still recovering after 150,000 customer records were compromised in 2015.

More recently, the NHS was crippled in May after a widespread ransomware attack, nicknamed WannaCry, locked staff out of computer systems unless they forked out a bitcoin ransom. Relatively few paid up and a workaround was found in days, but the cost of cancelled operations was incalculable, and experts still cannot agree on how the attack spread. To assume such events are primarily solved by better software and a more empowered IT department is to neglect an important detail, say experts: HR must be central to educating employees and addressing organisational vulnerabilities. 

As Claire Logan head of people and talent at PA Consulting Group, says: “HR has a critical role in cyber-security. Too often, IT teams care passionately about it, but don’t know how to communicate that passion to other employees.”
“We cannot protect organisations only through technology,” adds Peter Cheese, chief executive of the CIPD, which last year teamed up with the Department for Culture, Media and Sport to launch an e-learning tool to help the HR profession tackle cyber threats. “An awful lot of it is human behaviour and action.”

Government research discovered that, while almost two-thirds (65 per cent) of large UK businesses had fallen victim to a cyber-security breach in the space of a year, just 17 per cent were training staff on the issue. 

The National Cyber Security Centre in London was launched, in part, to increase awareness of this issue. And the broadening scale and complexity of threats illustrates why such action is necessary. While WannaCry most likely spread via a ‘worm’ that hunted down and exploited vulnerabilities in corporate networks, there are equally pressing issues around targeted hacking, malware in the form of spam emails, or fraudulent, convincingly crafted messages aimed at persuading finance departments to authorise payments.

‘Phishing’, meanwhile, often involves researching individuals via social media to write emails or direct messages that they are more likely to respond to, as opposed to the primitive spam of days gone by. And the threat doesn’t even have to be virtual: a cyber consultancy recently revealed that a major London law firm had discovered that the TV in its boardroom was secretly relaying an audio feed to an external source in a different country. 

New figures from Willis Towers Watson suggest that 46 per cent of UK employees spent half an hour or less on cybersecurity training in 2016, with 27 per cent having done none at all. A new mindset to learning may be required in this area. “We’ve got to move beyond this compliance tick-box approach, which has been used in various contexts over the years to say: ‘Well, we’ve done our training because we’ve ticked a box and everybody’s done their e-learning course on anti-bribery or corruption or modern slavery’ or whatever it might be,” says Cheese.

Consultancy firm PwC, for example, recently launched Game of Threats, a digital game designed to mimic a cyber-attack on an organisation, as a learning tool for clients. “Game of Threats engages people in a scenario, in a playful, gamification of cybersecurity,” says Anthony Bruce, HR consulting partner at PwC. 
“It’s about engaging people in a way that is stimulating, fun, not traditional, not sitting in front of a screen pressing buttons.”
Cheese believes the trick to creating training that lands is to link it to how cybercrime could affect staff in their personal lives. “Make them feel: ‘Gosh, this affects me just as much as it affects the organisation’, then you create that buy-in and engagement much more strongly than just presenting this as a rather dull corporate thing,” he says.

However, even the most awe-inspiring training programme won’t help protect an organisation if the wider company culture is not geared towards cyber threats. 
“To really make a difference to cybersecurity, the HR team needs to think and act as though it’s a culture change activity,” says Logan.

Studies suggests cyber awareness among the public at large is still low. In 2016, researchers at the University of Illinois dropped USB sticks around their campus, 98 per cent were picked up and people opened files on 45 per cent of the sticks, sometimes within six minutes of the device being planted. When asked why they had accessed the files, the majority (68 per cent) said they were trying to locate the drive’s owner, although 18 per cent admitted they had given in to curiosity.
Bruce says: “We’ll know we’re getting there when, if you’re in a meeting and there’s a USB stick on the table and you want to return it to the owner and go to stick it in your computer, somebody says: ‘Hang on. Do you know where that came from and do we know what’s on it?’”

Building that strong cyber culture involves HR not just in improving learning outcomes, but in sourcing expertise. Recruiter Robert Half Technology says 77 per cent of CIOs fear they will face more security threats over the next five years because of a lack of skilled staff. IT security vacancies increased by 6.2 per cent in the year to April 2017, as businesses scrambled to protect themselves from hacks.
“HR must take an active role in ensuring businesses have access to expertise to protect against cyber-attacks,” says Ann Swain, chief executive of the Association of Professional Staffing Companies.
“This includes the recruitment of IT specialists to ensure systems are secure. HR directors must communicate the need for resource in this area and advise on the potential consequences if adequate skills are not in place.”
Of course, not every staff member is on the organisation’s side in the battle against cyber attacks. An increasing number can be attributed to malicious insiders. “In most cases, there were warning signs before they happened and those signs were ignored. 

It’s a case of: ‘I always thought this individual was acting strangely, but I didn’t think I could tell anyone,’” says Nick Seaver, information and technology risk partner at Deloitte. “HR are great at being the people who can both look for the flags that indicate someone is a risk to the organisation, and help create a culture where people feel empowered to raise a suspicion.”
Throw in the large number of contractors and contingent workers who supplement full-time employees and this vigilance becomes even trickier. “Ensuring contingent workers have completed the same training, that we know who they are and have the same amount of confidence that they don’t have malicious intent is important,” says Bruce. “Because of the turnover in that kind of work, it can be a crucial back door into organisations.” With experts warning it is a question of when, not if, a WannaCry-scale attack is repeated, breaking down the siloes that keep IT and HR apart is a matter of urgency. 

CIPD

You Might Also Read:

Cybersecurity Is A Bigger Issue Than Brexit:

 

Directors Report January 2017. Cyber Security Checklist For Management (£):

 

« Ukraine Police Trace Petya Attack Source
FBI Investigating Kaspersky »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

ZenGRC

ZenGRC

ZenGRC (formerly Reciprocity) is a leader in the GRC SaaS landscape, offering robust and intuitive products designed to make compliance straightforward and efficient.

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

AppSec Labs

AppSec Labs

AppSec Labs specialise in application security. Our mission is to raise awareness in the software development world to the importance of integrating software security across the development lifecycle.

Early Warning Services

Early Warning Services

Early Warning is committed to providing awareness, education, and enablement around fraud prevention.

Norton

Norton

NortonLifeLock is dedicated to helping secure the devices, identities, online privacy, and home and family needs of approximately 50 million consumers.

Wireless Logic

Wireless Logic

Wireless Logic delivers a range of secure and resilient value-added M2M/IoT managed services that empower remote devices to communicate cost-effectively, two ways.

Platin Bilişim

Platin Bilişim

Platin Bilisim is an IT Security company providing consultancy, solutions and operational support services.

SecuLution

SecuLution

SecuLution is an Antivirus product using Application Whitelisting which offers much more protection than Virus Scanners ever can.

Bluink

Bluink

Bluink specializes in identity and access management and customer identity verification, using your smartphone as a strong authenticator and secure identity store.

H-ON Consulting

H-ON Consulting

H-ON Consulting develops and applies robust cyber security procedures enabling control systems to be secure.

IEEE Cyber Science and Technology Congress (CyberSciTech)

IEEE Cyber Science and Technology Congress (CyberSciTech)

CyberSciTech provides a platform for scientists, researchers, and engineers to share their latest ideas and advances in the broad scope of cyber-related science, technology, and application topics.

Haven Group

Haven Group

Haven Group and its companies are a cyber security one-stop-shop for our clients offering a full range of cyber security services to our clients in a unified and united way.

Singular Security

Singular Security

Singular Security help public and private organizations minimize cybersecurity risk and pass their IT compliance audit.

Dynics

Dynics

The Dynics ICS-Defender is an Industrial Control System Security Appliance for OT or OT/IT convergent environments.

New Net Technologies (NNT)

New Net Technologies (NNT)

NNT SecureOps provides ultimate protection against all forms of cyberattack and data breaches by automating the essential security controls.

NetCentrics

NetCentrics

NetCentrics leverages an innovative, agile, ‘what’s-next’ approach to our customers’ IT and cyber challenges.

Box

Box

Box is the Cloud Content Management company that empowers enterprises to revolutionize how they work by securely connecting their people, information and applications.

ioSENTRIX

ioSENTRIX

ioSENTRIX offers tailored, risk-focused assessments that reduce true business risk.