Your Employee's Cyber Awareness Is Critical

As part of the Coronavirus lockdown, non-essential businesses were forced to close their physical premises and move to ways of remote working to continue functioning and because of the less cyber secure home-working in 2020, organisations saw an increase in both ransomware and phishing attacks. On top of all the current cyber security issues with the virus, phishing scams have significantly increased.

Cyber criminals wasted no time in exploiting this opportunity, casting thousands of COVID-related lures onto perhaps more vulnerable than usual users.

According to thier 2021 State of the Phish Report  from Proofpoint, the majority (92%) of UK organisations required or  requested that most employees work from home due to the pandemic, which presented its fair share of teething problems, some of which organisations are still experiencing to this day. Organisational preparedness for remote working is not great and employees were not well-equipped to work remotely. In response, many organisations increased security awareness training and many organisations offered training on how to stay safe while working remotely.

While implementation of additional training is certainly good news, it should not take a global health crisis for organisations to prioritize security awareness.

To be effective, cybersecurity training must take place regularly, continually adapting to address the threats of the moment. It must be a central part of an organization’s security program, all year round. In the first half of 2020 cyber criminals took advantage of the heightened interest surrounding the pandemic, resulting in a flood to phishing email  unlike anything Proofpoint researchers research team has ever seen. While the tactics changed throughout the year, the target remained the same. Some offered cures, others promised speedy tests and priority access to vaccines. Many encouraged victims to hand over valuable credentials.

An appetite for the latest COVID-19 developments was just one factor fueling the phishing fire. Cyber criminals also struck at a time of significant disruption and distraction. 

Many organisations, recognising the elevated risk, conducted COVID-specific security awareness training. Results were good in test conditions too. Average failure rates for the most frequently used COVID-related lures ranged from less than 1% to around 20%. However, awareness is not quite enough. Security best practice behavior only really changes when employees are embedded in the program. For example, an employee receiving a notification to confirm that the potential phishing email they reported was in fact malicious, helps to drive and incentivise a security-first culture, however, this level of training is rare.

Only 64% of organisations conduct formal training sessions, either virtually or in person. For almost two-thirds, training of any sort takes place no more than four times a year. And 36% only train users in certain roles or departments.

Failure to equip employees with the knowledge to detect and deter such attacks is negligent and the response to COVID-related phishing attacks has shown that relevant, targeted, and in-context security awareness training works. Rather than reverting to type once the pandemic subsides, organisations must use this experience to implement long-term training programs that actively seek to change risky behaviors. Programs that focus on the individual and adapt to current, real-world threats.

This is only possible by placing users at the heart of your defence. They are often the only thing standing between the success and failure of an attack. The level of training they receive needs to reflect these high stakes.

Security awareness training must go beyond jargon, definitions of common threats, and multiple-choice tests. It must leave users in no doubt about their responsibilities and the consequences of failing to uphold them. When you deliver this comprehensive, people-centric training regularly, you create a security culture. A culture in which your people understand how simple behaviors can put your organisation at risk. In which all users know how to prevent, detect and deter cyber-attacks and in which best practice becomes standard practice.

The executive business decision-makers are important stakeholders in your organisation, but for security awareness training, users are the most important stakeholders. 

User engagement is critical if you want to make security a core part of your organisation’s culture, making sure that your workforce is aware of the basic cyber security behaviors is also critically important in this new environment. Organisations must have a culture of data security and data privacy and employees need to understand that they are the caretakers of their own organisation’s valuable and often sensitive data, much of which also consists of customer information.

Business need cyber security training and we at Cyber Security Intelligence recommend GoCyber training for all employees and management – it is excellent – please contact us for a free trial.

Proofpoint:   NCSC:   Infosecurity Magazine:   NCSC:       Infosecurity Magazine:     Action Fraud:    Image: Unsplash

You Might Also Read: 

How Has A Year Of Pandemic Changed Cyber Security?:

 

« The European Union Adopts A Cyber Security Strategy
The Satanic Mills of the Fourth Industrial Revolution »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

Pluralsight

Pluralsight

Pluralsight helps enterprises build technology skills at scale with expert-authored courses on today’s most important technologies including information and cyber security.

NTOP

NTOP

NTOP develop high-quality network traffic analysis and DDoS protection software used by small individuals as well by large telecom operators.

Trapmine

Trapmine

TRAPMINE is an innovative cybersecurity products company mainly focusing on protecting organizations from Advanced Persistent Threat & Zero-Day attacks.

Assac Networks

Assac Networks

Assac Networks ShieldIT is an app that completely protects any BYOD smartphone from both tapping and hacking.

Cloud & Cyber Security Expo

Cloud & Cyber Security Expo

Cloud & Cyber Security Expo is the UK’s largest cloud and cyber security event.

SafeGuard Cyber

SafeGuard Cyber

The SafeGuard Cyber SaaS platform empowers enterprises to adopt the social and digital channels they need to reach customers, while reducing digital risk and staying secure and compliant.

YorCyberSec

YorCyberSec

YorCyberSec act as a trusted Cyber and Information Security broker and procurement specialist. We help companies to Reduce Risk, Increase Assurance and Improve Performance.

ADL Consulting

ADL Consulting

ADL Consulting provide information security-related consultancy and training support to businesses across the UK. Our services include ISO27001, GDPR, Cyber Essentials and training.

Kape Technologies

Kape Technologies

Kape Technologies is a cybersecurity company focused on helping consumers around the world have a better digital experience with greater privacy and protection.

Armexa

Armexa

Armexa is a leading provider of advanced industrial cybersecurity solutions that protect your critical OT and ICS infrastructure against ever-changing threats.

FastNetMon

FastNetMon

FastNetMon is a very high performance DDoS detection and mitigation tool which could detect malicious traffic in your network and immediately block it.

Appurity

Appurity

Appurity specialises in mobile and application security, delivering comprehensive solutions across all verticals.

Vertex Cyber Security

Vertex Cyber Security

Vertex provide Cyber Security Services to small to large businesses including Advise, Consulting, Adding Security Partnership, Penetration Testing, ISO 27001-2 and Audits.

Elba

Elba

Employee security needs to be reinvented. SaaS security needs to involve end-user and awareness needs to be actionable. Meet elba, the 5-in-one cybersecurity hub with no compromises.

ZEUSS

ZEUSS

ZEUSS is a diversified data center, cybersecurity, and green energy company.

Armata Cyber Security

Armata Cyber Security

Armata exists to bring Cyber Security to all people – from home users and SMBs to large enterprises. We believe all users have the right to an affordable yet effective Cyber Security solution.