Take An Analytical Approach To Cybersecurity Training

The world is rapidly changing, and this digital transformation it's undergoing promises many wonderful new opportunities, different ways of doing business and exciting means to disrupt traditional market sectors. However, the dark side of this future is the massive growth in cyber criminality, which has seen an increasing number of ways being developed to utilise viruses, back doors and other exploits to access a company's most critical information for nefarious purposes.

While there is a plethora of hardware and software security solutions designed to protect businesses from just about any security threat, an enterprise's biggest weakness remains its people.

According to Wayne Woolard, Sales Manager for South Africa at KHIPU Networks, things like malware and ransomware are obviously dangerous, which is why it has become crucial to make staff aware of them and how they operate. By doing so, it becomes easier for individuals within an organisation to identify these threats before they can cause any damage.

While people inside the IT industry are generally well aware of the dangers posed by cyber-attacks, he says, there are still many employees in any given company that are not tech-savvy enough. It is for this reason that an enterprise that spends a small fortune on security hardware and software must not forget the importance of also training the users.

"Traditionally, employees were warned about potential security hazards like malware by the company's IT department. However, such warnings are often not even read by the staff, much less heeded.

“Moreover, providing proper external training around this can be a challenge for a large enterprise, after all, a business with hundreds of employees simply cannot afford to have such a large number of people missing work for training purposes," he explains.

"What's needed is for these enterprises to take an analytical approach to the risk that individual users pose to an organisation, by undertaking a campaign that can test both your systems and your people.

“In essence, it is a simulated phishing campaign, testing how well your security architecture performs, as well as how security conscious employees are, by sending simulated phishing attacks to specific recipients."

Woolard suggests a 'false flag' operation of this sort enables a company to target staff members who may have been identified as potential security risks and see exactly how they deal with a phishing e-mail or SMS.

"This is not about punishing people who may click on the link that is sent or even those who may actually enter credentials of some sort, but rather, it's about understanding who in the business is doing this and why. In this way, they can be upskilled to ensure they don't fall for a genuine scam, if and when this occurs.

"Once the campaign has concluded, follow ups must also be conducted with all affected employees, explaining what the campaign was about, providing them with tips to avoid getting caught out by cyber criminals and of course, ultimately providing additional training to those that require it."

He indicates the standard option for such training is online teaching, which is kept short and pointed, using videos and quizzes that take around half-an-hour to finish and complete. Additionally, there's an option for live, in-classroom training to be undertaken, should this be necessary.

"The idea here really is to get the concept of cyber security lodged in the back of these employees' minds and inculcating a healthy suspicion and a deeper awareness of things.

“For example, an accounts person may have received e-mails dozens of times from a particular individual, but we want them to be aware enough to notice if something like their writing style has changed, as this may be indicative of their mail address having been hijacked."

At the same time, he adds, such a campaign also provides a fundamental understanding of all the key security technologies a company is employing. It helps the IT department to clarify exactly how these work and where the weak spots are that can be exploited.

"After all, if a phishing mail campaign of this sort is conducted, such a mail first needs to get through the organisation's firewall and the mail gateway. If it does so, this is already a problem.

“The same goes for if a suspected malicious attachment is opened by an employee, if your anti-virus program fails to immediately recognise this as dangerous, you need to be asking why.

“Finally, a campaign like this also means the business is able to gauge the reactions of the internal security team with regard to how they handle this.

"Ultimately, the benefits of undertaking such a campaign are enormous. It delivers not only user education, but valuable information around the technologies you are using, as well as how your specialist teams deal with security emergencies.

“In the end, a campaign of this nature is the ideal way to test for security flaws across all the key aspects of the business, namely your people, your processes and your technology.

"At the end of the day, training your users on cyber security and how it can impact both their personal and work life is one of the most effective ways to raise awareness," concludes Woolard.

At CSI we agree and commend Woodlard’s analysis and suggestions and we would recommend using GoCyber by MeLearning, which will be launched in April 2019 - www.melearning.co.uk/

ITWeb:         Image: Nick Youngson

You Might Also Read: 

Military Cyber Training Methods:

 

« Dating Sites Fraudster Alert
Four Ways That Fake-News Sites Trick People »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

FT Cyber Resilience Summit: Europe

FT Cyber Resilience Summit: Europe

27 November 2024 | In-Person & Digital | 22 Bishopsgate, London. Business leaders, Innovators & Experts address evolving cybersecurity risks.

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

Infinigate UK

Infinigate UK

Infinigate is a value-added distributor of IT security solutions to protect and defend IT networks, servers, devices, data, applications, as well as the cloud.

Institute for National Security and Counterterrorism (INSCT)

Institute for National Security and Counterterrorism (INSCT)

INSCT is a center for the study of national security, international security, and counterterrorism. Research programs include New Frontiers in Science, Cyber, & Technology

enSilo

enSilo

enSilo secures customers data on premise or in the cloud. Regardless of the where the threat comes from, enSilo can protect your data.

XCure Solutions

XCure Solutions

XCure Solutions are a Finnish company specializing in data security, data protection and data recovery.

Siscon

Siscon

Siscon delivers tailor-made compliance solutions that are based on the customer's specific wishes and reality and then supplement with many years of experience in the field.

Simula Research Laboratory

Simula Research Laboratory

Simula Research Laboratory carries out research in the fields of communication systems, scientific computing and software engineering.

SecuPi

SecuPi

SecuPi delivers data-centric security with data-flow discovery, real-time monitoring, behavior analytics, and protection across web and enterprise applications and big data environments.

NSW Cyber Security Innovation Node

NSW Cyber Security Innovation Node

NSW Cyber Security Innovation Node is part of a national network designed to foster and accelerate cyber capability and innovation across Australia.

Nexor

Nexor

Nexor are a UK-based cyber security company with 30 years' experience in secure information exchange.

WebOrion

WebOrion

WebOrion is an All-in-One Web Security & Performance Suite. Fortify, accelerate and monitor your website today.

VariQ

VariQ

VariQ is a premier provider of Cybersecurity, Software Development and Cloud services to federal, state, and local government.

Binary Security AS

Binary Security AS

Binary Security is a Norwegian information security consultancy company. We are specialists at application security, penetration testing and secure code reviews.

Netlinkz

Netlinkz

Netlinkz has developed the Virtual Secure Network (VSN) overlay technology platform, a breakthrough in connectivity security, speed, and simplicity.

Cyberani Solutions

Cyberani Solutions

Cyberani Solutions was created to fulfill the cybersecurity needs of industry and government in Saudi Arabia, and across the Middle East and North Africa regions.

Davinsi Labs

Davinsi Labs

Davinsi Labs helps companies achieve Digital Service Excellence with specialized Security Intelligence and Service Intelligence solutions.

S2W

S2W

S2W is a data intelligence company specialized in cyber threat intelligence, brand/digital abuse, and blockchain.