In this article ITC’s Malcolm Taylor, considers the core areas of cyber security awareness training.
Mark Twain famously said, “Training is everything. The peach was once a bitter almond; cauliflower is nothing but cabbage with a college education.” However flippant these remarks may seem, with businesses today facing ever-increasing threats of cyber hacks and data breaches, his words have gained a new relevance.
Cyber attackers don’t tend to like the real world. Not, as might be stereotyped, because they haven’t left their bedrooms since their mid-teens, but rather because this is where they come up against real people with real decisions to make – decisions which will determine whether their attack succeeds or not.
Some cyber-attacks get past even the best technical defences – that’s obvious, otherwise the problem would have been solved by now – and it’s at this point the actions of the user (the real person) are critical. If they make the right decision, they will thwart the attack. No wonder then, that cyber attackers don’t like the real world; it’s almost completely out of their control.
Having said all that, it remains the case that over 90% of cyber-attacks rely for their success on someone (that real person again) inside an organisation unwittingly helping the attackers.
All organisations (all successful ones anyway) train their staff. In HR, health and safety, production, finance and, of course, the use of the IT upon which they invariably rely. Very few, however, train them how to use their IT securely. This is despite the growing body of research which clearly shows that companies who train their staff in this way suffer fewer, and less damaging, cyber-attacks.
But where for years the real world has given attackers an effective free pass, it’s beginning at last to fight back; cyber security awareness training is now available, affordable and (when done right) effective.
Cyber security awareness training is sometimes – uncomfortably – referred to as a way of creating the “human firewall”. Clunky as that may be, it makes the point. The staff of an organisation can be either a part of the problem or a part of the solution; when deciding whether or not to provide this training, an organisation is making this binary choice. It really is that simple.
The decision to provide cyber security awareness training seems straightforward then, and once made it is simply a matter of selecting the training required. There are various delivery methods available, and a number of key components from which to choose. Training methods are largely a matter of compatibility – it would be futile to attempt a classroom-based approach for an organisation of thousands of people dispersed around the globe, for example. Likewise a company of a couple of hundred staff in a single location may not consider an e-learning package a good fit for them. Hybrid solutions are common – perhaps e-learning for many, with tailored face-to-face packages for those deemed in the most at-risk roles such as finance or those who deal with PII or the most sensitive company data.
Perhaps more important than the method of delivery – they can all work well in the right environment – is the selection of areas to be covered. Training budgets are necessarily finite and organisations will always aim for the best return on their investment. To help with the decision-making I’ve detailed the areas I consider core:
Passwords. Call me predictable, but password security is fundamental and remains a key area of weakness. The internet works only through authentication – we have to prove who we are, remotely, every time we log on. The most common means of achieving this is still via a password; every user’s password should be sacrosanct – but very often it is not. All training should cover password security. It should teach how to choose, and crucially remember, secure passwords (for each account).
Phishing. Over 90% of attacks rely on this technique at some point in their lifecycle. Most people have heard of phishing and almost everyone can identify the very worst attempts