Cybersecurity Training Isn’t The Complete Solution

Cyber security training firms continue to stress the importance of educating employees in order to minimise the risk of cyber threats.

‘Staff’, they argue, ‘are both your company’s greatest asset and your biggest potential security risk’. And as employees are the weakest link in the security chain, they must be well trained and educated.  
 
It is true that employees are a huge security weakness: 46% of IT security incidents are caused by employees each year globally and 55% of companies surveyed by Experian Data Breach Resolution said they ‘experienced one or more security incidents where the catalysing event was a negligent or malicious employee’. 

Educating employees, however, is not necessarily the complete answer. As cyber security threats continue to evolve and grow at an increasing pace, employees and training are no longer able to keep up.  

Even Bruce Schneier, the very cyber security expert that popularised the Golden Triangle concept of ‘people, process and technology’, now plays down the importance of education in cyber security in comparison with technology and automation. He now states that ‘People and process work on human timescales, not computer timescales’.
   
To keep up with the pace of cyber threats we should ditch the emphasis on people and process, which are far too slow, and focus on the power of technology.

The only way to manage a technological threat that is growing faster than humans can react to it, is to look to technology itself for solutions.  

Thus for the below reasons, employee education is no longer the way CIOs and other executives should go to in order to keep their companies safe:

1. Cyber threats are evolving too rapidly for mass education of employees to be successful    

With each passing year the technology of cyber-attacks evolves and the speed of this evolution seems to continue accelerating. In the last 12 years alone there have been a 10,000 fold, increase, in the number of new digital threats.  

The hacking profession has moved from annoying viruses and spam created by hackers to show off their computing muscle and gain two minutes of cyber fame, to sophisticated organised hacking networks which gain serious money from cyber-crime.

As Symantec’s 2017 security report summarised, ‘New sophistication and innovation’ have meant ‘seismic shifts in the focus of attacks’. The sophistication of hacking has now evolved to the degree that even the strongest nation states and corporations are fair prey for hackers.  

This timeline demonstrates exactly how these attacks have matured over time and now pose serious financial and reputational consequences to businesses. What started off as basic viruses and worms are now highly sophisticated key and certificate-based attacks which can prise open even the most advanced security systems. 

More worryingly, as businesses, governments and individuals continue to connect more and more things to the Internet, the opportunities for attackers grow ever greater. Eventually, as the internet of things (IoT) hooks up more or less everything to the Internet, so too will more or less everything be fair game for hackers. 

What’s more, cyber security experts only expect the frequency of these attacks to continue to grow. In 2016, Symantec identified some 100 new malware families in 2016 - more than triple the year before.  

Cyber criminals are also suspected to already be manipulating developing technologies such as data on trading platforms where new financial instruments - such as cryptocurrencies - are traded.
 
Including digital infrastructure and cryptocurrencies along with the IoT, there are now three new, rapidly growing sectors that could be vulnerable to hacking.

And while hackers are already working on compromising these areas, most employees are unlikely to even understand the basic concepts of these developing technologies, let alone know how to use them responsibly, demonstrating the true severity of the task of educating employees on cyber security.

2. The cyber security problem is too broad for employees to be provided a complete education  

We have now connected all but every aspect of our lives to the internet meaning the security threat is broader than ever. Business structures and operations have also become more complex, leaving more areas vulnerable to cyber threats. Educating employees on all these areas is very much unfeasible.    

When cyber security training meant teaching employees to change their password regularly and not to open suspicious attachments, the case of educating on cyber security was far simpler.  

Now, however, cyber security training means having to educate employees on how to create passwords; manage file storage and exchange; know which websites and emails are safe; how to download files; which products you should use; how to avoid social engineering and phishing attacks, etc., just to name a few.

As Deloitte summarises in a 2016 risk report, the cyber security concern is not just frequency, but ‘The fact that today’s cyber security efforts require guarding against a broader range of challenges.’ These challenges include ‘new and emerging technologies, trends in mobile usage, social media, well-funded and organised foes, round-the-clock attacks, and more’.

   
And as employees do after all have their own jobs to do, they cannot be expected to somehow keep track of all these threats. The challenge with educating employees is to somehow make them aware of the risk their online activities pose and how to manage it, without rendering them unproductive by overly complex procedures. 

But this balance is looking increasingly difficult to achieve as the breadth of security threats continues to expand.  

More likely, employees will continue to be compromised and continue to cover up these compromises rather than resolve them as has been shown to be the case in the majority of businesses.

3. Modern technologies such as machine learning and big data security are now more efficient and effective solutions for a CIO than educating employees 

So, if hackers will always be one step ahead of employees, what solutions can we use to prevent cyber security breaches?  

One answer is machine learning solutions which are capable of monitoring user and application behaviour. These solutions, such as Cylance Cybersecurity, are very effective in recognising malware. Utilising these alternatives means you are able to predict and prevent threats rather than working reactively on the back-foot, as is the case with anti-virus software.
 
Blockchain is another example of a cutting edge technology that can significantly minimise cyber security risks. It does so by addressing the two key security principles: process and trust.  Blockchain solves the issue of process by implementing smart contracts that can enforce procedures within the company. For example, say, ‘user A can only access X document with approval from user B and C’.
 
In respect to trust, it allows companies to ensure that procedures are being executed in compliance with regulation. In the above example, there is no human verification that could result in security lapses. Instead, the blockchain system approves or denies access based on set criteria, reducing the risk of human error which so often results in security breaches.

So when choosing a security vendor, opt for one that uses the latest technologies that can help reduce the risk of human error.

It is simply no longer possible for your employees to be educated on the latest cyber security threats as they constantly grow and evolve.

Instead, the most effective way to fight the latest technological threats is deploying the latest technological defence systems in your own favour.

ITProPortal

You Might Also Read: 

Blockchain’s Brilliant Approach To Cyber Security:

Will GDPR Protect Privacy Or Just Lead To More Hacks?:

Strategies For A Cyber Security Culture (£):

 

« Tech Giants Face US Congress Over Russia Election
Garry Kasparov On AI & Cybersecurity »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

Resecurity, Inc.

Resecurity, Inc.

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

Pondurance

Pondurance

Pondurance is an IT Security and Compliance company providing services in Cyber Security, Continuity, Compliance and Threat Management.

Riverbed Technology

Riverbed Technology

The Riverbed Network and Application Performance Platform enables organizations to visualize, optimize, accelerate and remediate the performance of any network for any application.

Duane Morris LLP

Duane Morris LLP

Duane Morris is a global law firm with offices in the USA, UK and Asia. Practice areas include Cybersecurity.

FDM Group

FDM Group

FDM Group is an international Professional services company with a focus on IT. Services offered include Software Testing, and Information Security with a focus on operational security and compliance.

Alarum Technologies

Alarum Technologies

Alarum Technologies (formerly Safe-T) is a global provider of cyber security and privacy solutions to consumers and enterprises.

Secure-NOK

Secure-NOK

Secure-NOK provides products and solutions that detect and remove security attacks and harmful events in industrial networks and control systems.

NetDiligence

NetDiligence

NetDiligence is a privately-held cyber risk assessment and data breach services company.

Baffin Bay Networks

Baffin Bay Networks

Baffin Bay Networks operates globally distributed Threat Protection Centers™, offering DDoS protection, Web Application Protection and Threat Inspection.

A3Sec

A3Sec

A3Sec provides professional solutions in the areas of Cybersecurity, Device Monitoring, Business Intelligence and Big Data.

AUTOCRYPT

AUTOCRYPT

AUTOCRYPT is a mobility security provider dedicated to the safety of future transportation

UnderDefense

UnderDefense

UnderDefense provides cyber resiliency consulting and technology-enabled services to anticipate, manage and defend against cyber threats.

Strata Identity

Strata Identity

Strata is pioneering identity orchestration to unify on-premises and cloud-based authentication and access systems for consistent identity management in multi-cloud environments.

Moro Hub

Moro Hub

Moro Hub, a subsidiary of Digital DEWA, is a UAE-based digital data hub focused on digital transformation and operational services.

Fusion Cyber

Fusion Cyber

Fusion Cyber educates students in Zero Trust Risk Management, Defense, and Cyber Offense that lead to taking industry-accepted cybersecurity certifications.

Flawnter

Flawnter

Flawnter is a security testing software that finds hidden security and quality flaws in your applications.

Barrier Networks

Barrier Networks

Barrier Networks are a Cyber Security Managed Service Provider that specialises in Network and Application security.