Some Employees Think They Can Dodge Cyber Security

The number of cyber attacks is estimated has risen by 67% over the last five years, with the majority of these data breaches being traced to human error. CIOs are under more pressure than ever before when it comes to cybersecurity concerns, especially now that many or even all of the staff in their organisation are working from home, perhaps using unfamiliar software and hardware as they try to do their jobs under lockdown

The potential risks of such attacks are vast and can have a serious impact on both organisations and individuals, but protecting against cyber security threats can be extremely complicated. Not only is the technology we use every day getting more complex, but attackers are constantly finding new ways to bypass security measures.

Mimecast has released a study titled Don't Just Educate: Create Cybersafe Behaviour. The survey shows that while customer data breaches and reputational damage around the world is encouraging businesses to re-examine their security practices, employee cyber behaviour still needs to change.

The survey, conducted by Forrester Consulting, found that while 59% of security and IT managers think they are 'ticking the security compliance box', their employees report a huge disconnect. More than half of the 240 employees surveyed in APAC (53%) disagree with that statement, and 51% believe their managers do not stress the importance of good security practices.

The survey was conducted across Australia, Hong Kong, New Zealand and Singapore between January and February 2020 and involved 120 senior IT and business decision makers responsible for cyber safety at companies with more than 100 employees. Respondents represented 20 industry sectors including government, healthcare, legal, marketing, energy, telecoms, transport and logistics. 

The survey included a wide range of questions around Security Awareness and Training (SA&T) Programs in APAC, including security measure and implementation, employee behaviour changes, security culture and overall effectiveness in delivering effective training programs. Results of the employer survey were measured against feedback from 240 knowledge workers within these companies, who regularly use email and digital channels in the workplace.

Across the region the study also found that attending training activities does not necessarily translate to a change in behaviour for employees, with a third of SA&T attendees still admitting to flouting security policies, increasing to more than 50% for respondents in New Zealand.

"While security leaders in APAC believe they've made security a social norm by leading and encouraging others, this survey underscores that employees are not retaining, understanding or implementing key areas of cyber security training - and the existing outdated modes of training are simply not bringing about behavioural change," said Nick Lennon, of Mimecast.  

Additional findings from the Forrester Consulting study include:

  • Traditional SA&T is long and unengaging, uses outdated content types, and does not rely on behavioural science to achieve its objectives of behaviour and culture change.
  • As a result, employees' behaviours are not changing, which further contributes to a disconnect between employers' perceptions and how their employees really feel about security.
  • APAC firms must advance SA&T programs by exploring alternative content types, providing different methods of delivery based on employee preferences, and extending training outside the workplace.

Business leaders and employees need to understand and value the importance of cyber security best practice within their organisation. They simply cannot ignore the consequences or circumvent the protocols,” Nick Lennon said

Efforts to combat this within organisations often involves providing members of employees with relevant training sessions. But such training can quickly become obsolete, or simply forgotten. Workers also tend to be busy. When people are trying to complete other tasks, they might not remember to stay secure, particularly when doing so makes their job more difficult or time consuming. 

Mimecast:      MarketWatch:      Yahoo:      ZDNet:  

You Might Also Read: 

Take Action On Cyber Security Training:


Business need cyber security training and we at Cyber Security Intelligence recommend GoCyber training for all employees and management please contact Cyber Security Intelligence for a free trial.
 

For more information and a Cyber Audit about your organisation’s cyber risks and about security risks in your industry please contact Cyber Security Intelligence for a very economic strategic cyber assessment. 

« Is AI A Benefit Or A Potential Threat?
Using AI In Cyber Security »

CyberSecurity Jobsite
Check Point

Directory of Suppliers

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

Resecurity

Resecurity

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

Directory of Cyber Security Suppliers

Directory of Cyber Security Suppliers

Our Supplier Directory lists 8,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

softScheck

softScheck

softScheck is an IT security consultancy. Services range from pentesting and compliance testing to security auditing of software and IT infrastructure.

Cysec - TU Darmstadt

Cysec - TU Darmstadt

CYSEC is the Cybersecurity faculty of the Technical University of Darmstadt and performs internationally renowned research in numerous areas of cybersecurity.

Cybersecurity Credentials Collaborative (C3)

Cybersecurity Credentials Collaborative (C3)

C3 provides a forum for collaboration among vendor-neutral information security and privacy and related IT disciplines certification bodies.

Seceon

Seceon

Seceon OTM, is a cyber security advanced threat management platform that visualizes, detects, and eliminates threats in real time.

Cyber Security Malta

Cyber Security Malta

Cyber Security Malta is part of Malta's National Cyber Security Strategy which aims to combat cybercrime, strengthen national cyber defence and provide cyber security awareness and education.

QuickLaunch

QuickLaunch

QuickLaunch transforms how cloud-savvy institutions and companies manage human and device authentication, authorization, access control and integration.

ReliaQuest

ReliaQuest

ReliaQuest’s GreyMatter solution connects existing technology, people, and process – then equips security teams with unified, actionable insights across their entire environment.

Sixgill

Sixgill

Sixgill, an IoT sensor platform company, builds the universal data service and smart process automation software allowing any organization to effectively govern its IoE assets.

CyberSecurity Non-Profit (CSNP)

CyberSecurity Non-Profit (CSNP)

CyberSecurity Non-Profit (CSNP) is a 501(c)(3) non-profit organization dedicated to promoting cybersecurity awareness and education.

Startup Capital Ventures

Startup Capital Ventures

Startup Capital Ventures is an early stage venture capital firm with a focus on FinTech, Cloud/SaaS, Security, Healthcare IT, and IoT.

AUREA Technology

AUREA Technology

The photon counter SPD_OEM_NIR from AUREA Technology is designed for quantum key distribution at telecom wavelengths.

HackEDU

HackEDU

HackEDU provides secure coding training to companies ranging from startups to the Fortune 500.

Island

Island

Island puts the enterprise in complete control of the browser, delivering a level of governance, visibility, and productivity that simply weren’t possible before.

Appalachia Technologies

Appalachia Technologies

Appalachia is a full service Managed Services Provider with a focus on cybersecurity, backed by the best engineers.

IONOS

IONOS

IONOS is a leading provider of cloud infrastructure, cloud services, and hosting with more than 8.5 million customers contracts.

Cyber Civil Rights Initiative (CCRI)

Cyber Civil Rights Initiative (CCRI)

CCRI is the leading organization serving thousands of victims around the world and advocating for technological, social, and legal innovation to fight online abuse.