Cybersecurity Is Too Important To Leave To IT

As hackers increasingly exploit human vulnerability, HR has a vital role to play, not least in ensuring businesses have the technical talent to fight back

They say crime doesn’t pay but, when it comes to cybercrime, it certainly costs. Oxford Economics reports that the average large business loses £120m when it is hit by a hacking attack; averaged out across the economy, it means around £4m per business, per year, is attributed directly to hacking.

And that doesn’t include reputational damage, or the price of defending against cyber assaults. Executives still wake up in terror at the prospect of suffering an email leak as widespread as the one Sony endured in 2014, when the spats of the Hollywood elite were laid bare alongside a trove of almost 50,000 employees’ details. 

TalkTalk’s reputation is still recovering after 150,000 customer records were compromised in 2015.

More recently, the NHS was crippled in May after a widespread ransomware attack, nicknamed WannaCry, locked staff out of computer systems unless they forked out a bitcoin ransom. Relatively few paid up and a workaround was found in days, but the cost of cancelled operations was incalculable, and experts still cannot agree on how the attack spread. To assume such events are primarily solved by better software and a more empowered IT department is to neglect an important detail, say experts: HR must be central to educating employees and addressing organisational vulnerabilities. 

As Claire Logan head of people and talent at PA Consulting Group, says: “HR has a critical role in cyber-security. Too often, IT teams care passionately about it, but don’t know how to communicate that passion to other employees.”
“We cannot protect organisations only through technology,” adds Peter Cheese, chief executive of the CIPD, which last year teamed up with the Department for Culture, Media and Sport to launch an e-learning tool to help the HR profession tackle cyber threats. “An awful lot of it is human behaviour and action.”

Government research discovered that, while almost two-thirds (65 per cent) of large UK businesses had fallen victim to a cyber-security breach in the space of a year, just 17 per cent were training staff on the issue. 

The National Cyber Security Centre in London was launched, in part, to increase awareness of this issue. And the broadening scale and complexity of threats illustrates why such action is necessary. While WannaCry most likely spread via a ‘worm’ that hunted down and exploited vulnerabilities in corporate networks, there are equally pressing issues around targeted hacking, malware in the form of spam emails, or fraudulent, convincingly crafted messages aimed at persuading finance departments to authorise payments.

‘Phishing’, meanwhile, often involves researching individuals via social media to write emails or direct messages that they are more likely to respond to, as opposed to the primitive spam of days gone by. And the threat doesn’t even have to be virtual: a cyber consultancy recently revealed that a major London law firm had discovered that the TV in its boardroom was secretly relaying an audio feed to an external source in a different country. 

New figures from Willis Towers Watson suggest that 46 per cent of UK employees spent half an hour or less on cybersecurity training in 2016, with 27 per cent having done none at all. A new mindset to learning may be required in this area. “We’ve got to move beyond this compliance tick-box approach, which has been used in various contexts over the years to say: ‘Well, we’ve done our training because we’ve ticked a box and everybody’s done their e-learning course on anti-bribery or corruption or modern slavery’ or whatever it might be,” says Cheese.

Consultancy firm PwC, for example, recently launched Game of Threats, a digital game designed to mimic a cyber-attack on an organisation, as a learning tool for clients. “Game of Threats engages people in a scenario, in a playful, gamification of cybersecurity,” says Anthony Bruce, HR consulting partner at PwC. 
“It’s about engaging people in a way that is stimulating, fun, not traditional, not sitting in front of a screen pressing buttons.”
Cheese believes the trick to creating training that lands is to link it to how cybercrime could affect staff in their personal lives. “Make them feel: ‘Gosh, this affects me just as much as it affects the organisation’, then you create that buy-in and engagement much more strongly than just presenting this as a rather dull corporate thing,” he says.

However, even the most awe-inspiring training programme won’t help protect an organisation if the wider company culture is not geared towards cyber threats. 
“To really make a difference to cybersecurity, the HR team needs to think and act as though it’s a culture change activity,” says Logan.

Studies suggests cyber awareness among the public at large is still low. In 2016, researchers at the University of Illinois dropped USB sticks around their campus, 98 per cent were picked up and people opened files on 45 per cent of the sticks, sometimes within six minutes of the device being planted. When asked why they had accessed the files, the majority (68 per cent) said they were trying to locate the drive’s owner, although 18 per cent admitted they had given in to curiosity.
Bruce says: “We’ll know we’re getting there when, if you’re in a meeting and there’s a USB stick on the table and you want to return it to the owner and go to stick it in your computer, somebody says: ‘Hang on. Do you know where that came from and do we know what’s on it?’”

Building that strong cyber culture involves HR not just in improving learning outcomes, but in sourcing expertise. Recruiter Robert Half Technology says 77 per cent of CIOs fear they will face more security threats over the next five years because of a lack of skilled staff. IT security vacancies increased by 6.2 per cent in the year to April 2017, as businesses scrambled to protect themselves from hacks.
“HR must take an active role in ensuring businesses have access to expertise to protect against cyber-attacks,” says Ann Swain, chief executive of the Association of Professional Staffing Companies.
“This includes the recruitment of IT specialists to ensure systems are secure. HR directors must communicate the need for resource in this area and advise on the potential consequences if adequate skills are not in place.”
Of course, not every staff member is on the organisation’s side in the battle against cyber attacks. An increasing number can be attributed to malicious insiders. “In most cases, there were warning signs before they happened and those signs were ignored. 

It’s a case of: ‘I always thought this individual was acting strangely, but I didn’t think I could tell anyone,’” says Nick Seaver, information and technology risk partner at Deloitte. “HR are great at being the people who can both look for the flags that indicate someone is a risk to the organisation, and help create a culture where people feel empowered to raise a suspicion.”
Throw in the large number of contractors and contingent workers who supplement full-time employees and this vigilance becomes even trickier. “Ensuring contingent workers have completed the same training, that we know who they are and have the same amount of confidence that they don’t have malicious intent is important,” says Bruce. “Because of the turnover in that kind of work, it can be a crucial back door into organisations.” With experts warning it is a question of when, not if, a WannaCry-scale attack is repeated, breaking down the siloes that keep IT and HR apart is a matter of urgency. 

CIPD

You Might Also Read:

Cybersecurity Is A Bigger Issue Than Brexit:

 

Directors Report January 2017. Cyber Security Checklist For Management (£):

 

« Ukraine Police Trace Petya Attack Source
FBI Investigating Kaspersky »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

ZenGRC

ZenGRC

ZenGRC (formerly Reciprocity) is a leader in the GRC SaaS landscape, offering robust and intuitive products designed to make compliance straightforward and efficient.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

TÜV SÜD Academy UK

TÜV SÜD Academy UK

TÜV SÜD offers expert-led cybersecurity training to help organisations safeguard their operations and data.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

Dark Reading

Dark Reading

Dark Reading is the most trusted online community for security professionals.

AppRiver

AppRiver

AppRiver is a global provider of cloud-based email and web security solutions that protect businesses worldwide from today's ever-changing online threats.

Digital Guardian

Digital Guardian

Digital Guardian is a next generation data protection platform designed to stop data theft.

Untangle

Untangle

Untangle provides network security products designed specifically for the below-enterprise market, safeguarding businesses, home offices, nonprofits, schools and governmental organizations.

ArcusTeam

ArcusTeam

ArcusTeam is at the forefront of the firmware and applications security industry, with a mission to increase the level of security on all IoT devices and applications.

Caulis

Caulis

Caulis FraudAlert is a cyber security solution. It can detect fraud and identity theft based on users’ online behaviour.

Fudo Security

Fudo Security

Fudo Security is a leading provider of privileged access management and privileged session monitoring solutions.

1Kosmos

1Kosmos

1Kosmos provide Digital Identity and Passwordless Authentication for workforce and customers. Powered by advanced biometrics and blockchain technology.

Accurics

Accurics

Accurics enables self-healing cloud native infrastructure by codifying security throughout your development lifecycle.

KeyData Associates

KeyData Associates

KeyData is a recognized leader in cybersecurity services specializing in Identity and Access Management (IAM), Customer Identity & Access Management (CIAM) and Privileged Access Management (PAM).

Almond

Almond

Almond is positioned as a key independent French player in audit and consulting in the fields of Cybersecurity, Cloud and Infrastructure.

GeoEdge

GeoEdge

GeoEdge is the premier provider of ad security and quality solutions for the online and mobile advertising ecosystem.

Sotero

Sotero

Sotero is the first cloud-native, zero trust data security platform that consolidates your entire security stack into one easy-to-manage environment.

Dig Security

Dig Security

Dig Security offers the first data detection and response (DDR) solution, providing real-time visibility, control and protection of your data assets across any cloud.

Odaseva

Odaseva

Odaseva delivers the strongest data security solution for enterprises running on Salesforce, safeguarding confidentiality and integrity of critical business information.

LMNTRIX

LMNTRIX

LMNTRIX eliminates the complexity and burden of cyber security for organizations struggling to prepare for, prevent and respond to cyberattacks.