Organisations looking to boost their Cyber Security defences could be forgiven for pouring time, effort and budget into Technical solutions.
After all, the Cyber battlefield is typically considered a virtual one fought electronically in Cyberspace, what better way to protect your Cyberspace and the valuable assets it holds than with the latest and greatest of firewalls, security software and physical access controls?
Though effective to a point, all these Technical solutions have one major weakness in common. A weakness not technical in nature, but human.
Your staff.
But there is a way to turn this weakness into an advantage.
Invest in Training for staff at all levels of the business and your workforce could become your biggest Cyber Security asset, instead of potentially your biggest Cyber Security risk.
Why is Training so important?
In every sense, training is an investment in your staff. No matter whether it’s focussed on technical or soft-skills, whether generic or industry and role specific, training your staff boosts their value to your business while boosting each individual’s skillset and career progression in one hit.
It should be a no-brainer, but too often training is seen purely as an overhead. Paying for training and taking staff away from their day jobs could be considered just another expense, with little or no value in return.
But given the right training, you can empower your workforce to do their jobs better and with renewed focus and vigour. In addition, ‘Skilling-Up’ your existing workforce could also be an extremely cost-effective way of getting skills into the business compared with the cost of Consultants or Third Parties.
So what is the ‘right’ training?
For training to be truly valuable, it needs to be relevant, relatable and regularly refreshed. Training should demonstrate how it applies to everyone taking part, how it relates to their day-to-day and why it’s important. Using examples and scenarios, ideally tailored to your business or industry, can keep participants engaged with group discussions and exercises helping to make sure the training is really taken on board.
When looking at Cyber Security training particularly, here are some key points you’ll want to consider:
- Awareness is often half the battle The first and most important thing any training should deliver is awareness. Why security is important to the business and you personally, what are the threats and how can you spot them, and how you can work securely are relevant to every member of staff, both in and outside of work.
- Keep it up-to-date Cyber Security threats and attacks are constantly evolving, and your training needs to keep up. This doesn’t mean a simple rewind and repeat of the same training each year (although a reminder of common or particularly relevant threats won’t hurt) but as attacks and defences change over time, the training should be updated accordingly.
- Set the Standard Security training can sometimes be implicit in generally training your staff on what your policies and processes are across the business. Setting out what is expected practice even if not directly related to security means that your staff can spot when something looks fishy (or dare we say, ‘phishy’) Of course, Security-specific policies and practices should be passed on through training. This is especially important if you have, or are looking to attain accreditation against a standards framework such as ISO 27001, where policies and evidence of them being followed across the business is key.
My Staff aren’t technical so they wouldn’t need Cyber Security training, right?
Wrong.
To keep your business secure you need to enlist everyone, at all levels of the business in the fight. One of the major weapons in the war against Cyber Crime is your people, but they can also be the weak link and an easy target for criminals and scammers if they are not aware of the potential threats they may come across, and how to identify them.
According to the 2021 Government Cyber Security Breaches Survey, 83% of UK businesses experienced a Phishing attack in the last year alone. While spam filters and other tech may catch some, even unsophisticated phishing attempts will often get through- and could end up in the Inbox of any one of your employees, and it only takes one attempt to be successful to expose your entire business.
Essentially, every member of staff you have has the potential to be a ‘Human Firewall’- a living, breathing checkpoint able to filter out potential scams, and question anything that looks suspicious.
More importantly, they should be able to spot anything that deviates from specified company policies and practices- and that point in particular is key for all staff regardless of their role, from front desk to board room.
Leading by example
Business owners, board members and Leadership teams are not exempt, they need to be made aware of the threats and need to be trained in the processes and practices in place to mitigate them as much as any other member of staff- if not more so.
Not only might a senior role prove a more attractive and prestigious target for an attacker, but buy-in right from the top of the hierarchy is essential in order for processes to be effective and empowering other members of staff to feel confident in questioning anything they consider to be out of the ordinary.
If a CFO frequently negates standard procedure to request urgent payments for example, it would be easy for a finance administrator to mistake a fraudulent request as a legitimate one and that is how breaches occur and how money is lost. If the CFO always follows process, the standard becomes ordinary behaviour and it becomes much easier to identify anything extraordinary that could indicate a would-be attacker’s attempt to deceive.
In addition to this however there are other key points that Business leaders should be aware of, and this could require some additional training specific to those in senior roles to focus on- such as the following:
- Understanding the Business implications of Cyber Security, and how it can positively affect business and business strategy as well as how to protect the business against threats.
- What laws and regulations the business may fall under, and how to be compliant
- Understanding exactly where and why the business is most at risk
- Common pitfalls, myths and misunderstandings to avoid
CyberScale understands the Business of Cyber Security, and how important an aware and alert workforce is in building the security culture into a business that can set it apart and drive it forward.
Our Security Consultants have devised comprehensive and engaging training courses, delivered as an interactive and memorable experience either online or in-person depending on your needs and your environment.
If you’re wondering what the right training could mean for your organisation, give our experts a call to discuss training options tailored for your business.
