Security Awareness Training Must Be the Foundation of Any Cyber Culture

By Daniel Warelow and Charles Preston

Daniel Warelow

Charles Preston

Life and work as we know them are changing as a result of the COVID-19 crisis, and cyber criminals are using this to their advantage. A new report has found that more than one in four U.K. cyberattacks have been related to the pandemic. As attackers continue to come up with sophisticated and dangerous methods to attack businesses and individuals, cybersecurity measures must be prioritized.

Businesses can no longer rely on technology alone to mitigate the risks that come from cyberthreats, especially while many workforces work remotely through the pandemic. Instead, they need to encourage their employees to work mindfully and responsibly on the frontlines of cyber defense. Businesses must implement continuous security awareness training for employees to be more security conscious as part of their overall IT security strategy and protection.

Human Error

Employees are a vital part of any business’s security strategy. They are the soldiers on the front line in the battle against hackers. However, if they are not educated or trained in what to look out for when it comes to security, they can also become the open gateway for cyberattacks to take place, playing upon user vulnerabilities.

This is the case especially when working from home. Users have additional pressure to work harder and faster, which is when more mistakes can happen. It has been found that 95% of cybersecurity breaches are due to human error. This demonstrates how dangerous humans being the weakest link can be. Internal business risks, such as sending an email to the wrong person or with an incorrect attachment can be detrimental to a business — not only in terms of financial repercussions, but also its reputation.

This is when cybersecurity training and tools that educate the user have never been more important. Employees need to be trained to be vigilant, cautious and suspicious.

Security Awareness Training

The cyberthreat continues to evolve too as hackers and their methods become more and more innovative. However, businesses cannot expect their employees to stay ahead of growing threats without having the education and training in place in response to the changing and modern landscape. Elements such as security awareness training and simulated phishing resources can help mitigate end-user cyber risk and drive secure user behavior.

These programs are designed to help users understand the role they play in helping to combat security breaches. Additionally, using phishing simulations as part of the wider security strategy will help to provide realistic situations that often occur, particularly via email, that employees must be aware of. Further, training allows businesses to assess the nature of the workforce regarding its security awareness posture and provide employees with the information to understand the dangers of social engineering attacks and how to take appropriate actions to protect themselves and the organization.

However, security awareness training should not be a one-size-fits-all approach. Instead, training should be continuous and you should tailor it to each user’s unique vulnerabilities. This creates an optimized and effective cyber strategy. Highlighting any cyber weaknesses in the workforce means they can be targeted through educational resources to ensure that the human is aware of and knows how to detect such risks. More importantly, they will know how to reduce the likelihood of an attack. Regular training, in addition to complementary security tools, can provide a layered defense for organizations to reduce the threats that any business faces.

The Role of the Channel

The channel plays a key role in the fight against cybercrime too. Organizations cannot be expected to stay one step ahead of cyber criminals and adapt to new threats on their own. By relying on the help of their MSP, businesses can feel confident that they have the right education and tools in place to combat the risk of cyberattacks.

There remains a large cyber skills gap across many businesses. And with the immediate move to remote work over the last 12 or so months, being away from the…

…help of on-site IT teams, organizations are more vulnerable than ever. Finding the right vendor and solutions to tackle these evolving threats is crucial. End-user organizations need to work effectively with managed service providers (MSPs) to stay ahead of the attackers. This enables MSPs to become trusted IT security advisers for the businesses they support, helping them to create a secure business and custom-fit security approach.

In addition to this, to meet growing cybersecurity threats to organizations, channel partners can increase their value to their customers by ensuring they have the right security solutions and training programs in place across their existing portfolio. MSPs must take a proactive role in understanding the current state of a customer’s ability to protect against, prevent, detect and respond to modern cyberthreats when recommending the best approaches to being cyber resilient.

By addressing pain points and providing assurance around the security of their working environments, partners can build and strengthen the relationship with their customers, while recognizing the opportunity surrounding the related additional revenue streams.

Daniel Warelow is product manager at cloud service provider Giacom. Charles Preston is founder and CEO of usecure, which provides a cloud-based cyber awareness platform for MSPs. Both are based in the U.K.