Hack the human. This is a growing trend understood very clearly by the well-funded and organised cybercrime landscape.\u00a0 <\/p>\n\n\n\n
The cyber-syndicate and criminal know that it is far easier to access systems through people than it is to go through the technology. <\/p>\n\n\n\n
According to security software company Trend Micro, a staggering 91% of successful breaches started with attacks that were focused on the weakest link in the security chain – people.\u00a0 <\/p>\n\n\n\n
The human factor is what allows for the opportunistic\nphishing attack, extortion scheme, or clicking of an unfortunate attachment,\nbut it is also one that requires that the enterprise transform its security\nculture to ensure ongoing education and understanding.<\/p>\n\n\n\n
\u201cThe attack vectors aimed at people are becoming incredibly sophisticated,\u201d said Anna Collard, Managing Director of Popcorn Training, a KnowBe4 Company. <\/p>\n\n\n\n
\u201cThe cybercriminals can spoof people\u2019s email addresses, use voice recordings to instruct people to do things under the guise of being an employer or decision maker, and unleash extortion schemes that can defraud people of large sums of money. <\/p>\n\n\n\n
“The human factor has become very important to the security of the organisation and yet security education is still a begrudging project often dumped with IT.\u201d<\/p>\n\n\n\n
A significant number of successful cyber attacks are from people making mistakes that could be avoided if they understood the risks and the warning signs. It\u2019s easy for those with inherent security understanding \u2013 the decision maker, the IT department, the Chief Security Officer \u2013 to assume that the average employee can recognise a threat, but the truth is that they often can\u2019t. A sophisticated phishing message can catch anyone off guard, from a physician to a retail executive to a technically savvy millennial.<\/p>\n\n\n\n
\u201cA lot of companies assume that the millennials, the so-called digital natives, are security savvy and more aware of the risks than the older generation but this isn\u2019t the case at all,\u201d added Collard.<\/p>\n\n\n\n
\u201cThey know how to use the technology, but they don\u2019t care as much about the threats. This ties into how certain behaviours can impact on a company\u2019s security culture and posture. <\/p>\n\n\n\n
“Even if a security education campaign is run successfully, the challenge is that people will still behave in certain ways and it is this behaviour that needs to be addressed when transforming a security culture.\u201d<\/p>\n\n\n\n
Human beings are creatures of habit and can adapt to two to three new behaviours a year, if at all. To achieve a security culture that educates around the principles of risk and the understanding of threats, then the training process has to be steady, relevant and repeatable. <\/p>\n\n\n\n
It can\u2019t be rolled out in volume with a new session every month as this only results in cognitive overload. <\/p>\n\n\n\n
\u201cIt\u2019s the analogy of \u2013 if I throw one or two balls at you, you will likely catch both, but if I throw ten at you, you won\u2019t catch any of them,\u201d said Collard. <\/p>\n\n\n\n
\u201cTo ensure that security message sticks you need to select a few key messages for each year and drive these throughout. It\u2019s also important to include varied methodologies into the training to ensure that the lessons are heard, learned and understood.\u201d<\/p>\n\n\n\n
Collard advises the inclusion of gamification and\nstories to create security training solutions that are memorable. Through the\nuse of anecdotal evidence, employees can see how the risks directly affect them\nand the business, can understand what to look out for, and can develop a clear\nunderstanding of the company\u2019s security requirements and regulations.<\/p>\n\n\n\n
\u201cThe goal isn\u2019t to turn every person in your company into a security specialist but to rather give them the level of understanding they need to apply the rules and remain secure,\u201d said Collard. <\/p>\n\n\n\n
\u201cPeople need to understand that if they use technology, they have to be cognisant of the risks. Organisations can support this understanding by investing into training that\u2019s relevant, targeted and memorable. Training that can sustainably transform the company\u2019s security culture.\u201d<\/p>\n","protected":false},"excerpt":{"rendered":"
Hack the human. This is a growing trend understood very clearly by the well-funded and organised cybercrime landscape.\u00a0 The cyber-syndicate and criminal know that it is far easier to access systems through people than it is to go through the technology. According to security software company Trend Micro, a staggering 91% of successful breaches started […]<\/p>\n","protected":false},"author":25,"featured_media":29022,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[4950,5,6,399,10675],"tags":[5475,11077,3840,11075,11076,5473],"class_list":["post-29021","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-analysis","category-enterprise-security","category-insights","category-more-news","category-thought-leadership","tag-anna-collard","tag-chief-security-officer","tag-cyber-attacks","tag-cyber-syndicate","tag-knowbe4","tag-popcorn-training"],"acf":[],"publishpress_future_workflow_manual_trigger":{"enabledWorkflows":[]},"_links":{"self":[{"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/posts\/29021","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/users\/25"}],"replies":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/comments?post=29021"}],"version-history":[{"count":1,"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/posts\/29021\/revisions"}],"predecessor-version":[{"id":29023,"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/posts\/29021\/revisions\/29023"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/media\/29022"}],"wp:attachment":[{"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/media?parent=29021"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/categories?post=29021"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/tags?post=29021"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}