Cybersecurity Training Isn’t The Complete Solution

Cyber security training firms continue to stress the importance of educating employees in order to minimise the risk of cyber threats.

‘Staff’, they argue, ‘are both your company’s greatest asset and your biggest potential security risk’. And as employees are the weakest link in the security chain, they must be well trained and educated.  
 
It is true that employees are a huge security weakness: 46% of IT security incidents are caused by employees each year globally and 55% of companies surveyed by Experian Data Breach Resolution said they ‘experienced one or more security incidents where the catalysing event was a negligent or malicious employee’. 

Educating employees, however, is not necessarily the complete answer. As cyber security threats continue to evolve and grow at an increasing pace, employees and training are no longer able to keep up.  

Even Bruce Schneier, the very cyber security expert that popularised the Golden Triangle concept of ‘people, process and technology’, now plays down the importance of education in cyber security in comparison with technology and automation. He now states that ‘People and process work on human timescales, not computer timescales’.
   
To keep up with the pace of cyber threats we should ditch the emphasis on people and process, which are far too slow, and focus on the power of technology.

The only way to manage a technological threat that is growing faster than humans can react to it, is to look to technology itself for solutions.  

Thus for the below reasons, employee education is no longer the way CIOs and other executives should go to in order to keep their companies safe:

1. Cyber threats are evolving too rapidly for mass education of employees to be successful    

With each passing year the technology of cyber-attacks evolves and the speed of this evolution seems to continue accelerating. In the last 12 years alone there have been a 10,000 fold, increase, in the number of new digital threats.  

The hacking profession has moved from annoying viruses and spam created by hackers to show off their computing muscle and gain two minutes of cyber fame, to sophisticated organised hacking networks which gain serious money from cyber-crime.

As Symantec’s 2017 security report summarised, ‘New sophistication and innovation’ have meant ‘seismic shifts in the focus of attacks’. The sophistication of hacking has now evolved to the degree that even the strongest nation states and corporations are fair prey for hackers.  

This timeline demonstrates exactly how these attacks have matured over time and now pose serious financial and reputational consequences to businesses. What started off as basic viruses and worms are now highly sophisticated key and certificate-based attacks which can prise open even the most advanced security systems. 

More worryingly, as businesses, governments and individuals continue to connect more and more things to the Internet, the opportunities for attackers grow ever greater. Eventually, as the internet of things (IoT) hooks up more or less everything to the Internet, so too will more or less everything be fair game for hackers. 

What’s more, cyber security experts only expect the frequency of these attacks to continue to grow. In 2016, Symantec identified some 100 new malware families in 2016 - more than triple the year before.  

Cyber criminals are also suspected to already be manipulating developing technologies such as data on trading platforms where new financial instruments - such as cryptocurrencies - are traded.
 
Including digital infrastructure and cryptocurrencies along with the IoT, there are now three new, rapidly growing sectors that could be vulnerable to hacking.

And while hackers are already working on compromising these areas, most employees are unlikely to even understand the basic concepts of these developing technologies, let alone know how to use them responsibly, demonstrating the true severity of the task of educating employees on cyber security.

2. The cyber security problem is too broad for employees to be provided a complete education  

We have now connected all but every aspect of our lives to the internet meaning the security threat is broader than ever. Business structures and operations have also become more complex, leaving more areas vulnerable to cyber threats. Educating employees on all these areas is very much unfeasible.    

When cyber security training meant teaching employees to change their password regularly and not to open suspicious attachments, the case of educating on cyber security was far simpler.  

Now, however, cyber security training means having to educate employees on how to create passwords; manage file storage and exchange; know which websites and emails are safe; how to download files; which products you should use; how to avoid social engineering and phishing attacks, etc., just to name a few.

As Deloitte summarises in a 2016 risk report, the cyber security concern is not just frequency, but ‘The fact that today’s cyber security efforts require guarding against a broader range of challenges.’ These challenges include ‘new and emerging technologies, trends in mobile usage, social media, well-funded and organised foes, round-the-clock attacks, and more’.

   
And as employees do after all have their own jobs to do, they cannot be expected to somehow keep track of all these threats. The challenge with educating employees is to somehow make them aware of the risk their online activities pose and how to manage it, without rendering them unproductive by overly complex procedures. 

But this balance is looking increasingly difficult to achieve as the breadth of security threats continues to expand.  

More likely, employees will continue to be compromised and continue to cover up these compromises rather than resolve them as has been shown to be the case in the majority of businesses.

3. Modern technologies such as machine learning and big data security are now more efficient and effective solutions for a CIO than educating employees 

So, if hackers will always be one step ahead of employees, what solutions can we use to prevent cyber security breaches?  

One answer is machine learning solutions which are capable of monitoring user and application behaviour. These solutions, such as Cylance Cybersecurity, are very effective in recognising malware. Utilising these alternatives means you are able to predict and prevent threats rather than working reactively on the back-foot, as is the case with anti-virus software.
 
Blockchain is another example of a cutting edge technology that can significantly minimise cyber security risks. It does so by addressing the two key security principles: process and trust.  Blockchain solves the issue of process by implementing smart contracts that can enforce procedures within the company. For example, say, ‘user A can only access X document with approval from user B and C’.
 
In respect to trust, it allows companies to ensure that procedures are being executed in compliance with regulation. In the above example, there is no human verification that could result in security lapses. Instead, the blockchain system approves or denies access based on set criteria, reducing the risk of human error which so often results in security breaches.

So when choosing a security vendor, opt for one that uses the latest technologies that can help reduce the risk of human error.

It is simply no longer possible for your employees to be educated on the latest cyber security threats as they constantly grow and evolve.

Instead, the most effective way to fight the latest technological threats is deploying the latest technological defence systems in your own favour.

ITProPortal

You Might Also Read: 

Blockchain’s Brilliant Approach To Cyber Security:

Will GDPR Protect Privacy Or Just Lead To More Hacks?:

Strategies For A Cyber Security Culture (£):

 

« Tech Giants Face US Congress Over Russia Election
Garry Kasparov On AI & Cybersecurity »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

US Cyber Command (USCYBERCOM)

US Cyber Command (USCYBERCOM)

USCYBERCOM conducts activities to ensure US/Allied freedom of action in cyberspace and deny the same to our adversaries.

Backup112

Backup112

Backup112 has been delivering professional cloud backup services since 2004.

Cyberkov

Cyberkov

Cyberkov services include Pentesting, Vulnerability Assessments, Digital Forensics, Incident Response, Source Code Analysis and Security Training.

Greenbone Networks

Greenbone Networks

Greenbone Networks delivers a vulnerability analysis solution for enterprise IT which includes reporting and security change management.

ETAS

ETAS

ETAS (formerly Escrypt) is a pioneer and one of today’s leading solution providers for embedded IT security.

Jiran Security

Jiran Security

Jiran Security provides data and application security solution over email, mobile device and endpoints.

Romanian Accreditation Association (RENAR)

Romanian Accreditation Association (RENAR)

RENAR is the national accreditation body for Romania. The directory of members provides details of organisations offering certification services for ISO 27001.

THEC-Incubator

THEC-Incubator

THEC-Incubator program is designed for international and ambitious tech startups in the Netherlands. Areas of focus include Blockchain and Cyber Security.

CONCORDIA

CONCORDIA

Concordia is a Cybersecurity Competence Network with leading research, technology, and competences to build the European Secure, Resilient and Trusted Ecosystem.

Ethyca

Ethyca

Ethyca builds automated data privacy infrastructure and tools for developers and privacy teams to easily build products that comply with GDPR, CCPA Privacy Regulations.

Kiberna

Kiberna

Kiberna are a small but niche company specialising in data driven security to manage your cyber risks.

ISECURION Technology & Consulting

ISECURION Technology & Consulting

ISECURION is an information security consulting company. We provide a unique blend of services to our customers catering to the current information security landscape.

Intel Ignite

Intel Ignite

Intel Ignite is an internationally renowned acceleration program for early-stage deep tech startups.

Cyber News Live (CNL)

Cyber News Live (CNL)

Cyber News Live provide vital information and raise awareness about all things 'cyber' to ensure you stay protected in the digital world.

Tenchi Security

Tenchi Security

Tenchi Security are specialized in Third-Party Cyber Risk Management (TPCRM) and aim to reduce information asymmetry when it comes to third and Nth-Party security and compliance risk management.

Aspire Technology Solutions

Aspire Technology Solutions

Aspire is an award-winning IT Managed Service and Cyber Security Provider. We specialise in cyber security, cloud, connectivity, managed services, unified communications and IT support.

AmiViz

AmiViz

AmiViz is the first B2B enterprise marketplace focussed on Cybersecurity business in the Middle East and Africa, designed specially to serve the interests of enterprise resellers and vendors.