printer friendly version

Organisations expanding cybersecurity training to include customers

Enterprise organisations are taking security awareness to the next level. Knowing that even the best technology can only successfully repel a potential cyberattack 90-93% of the time, it is now a mandate of many companies to give employees the training and education they need to prevent them from clicking on something they should not.

Having seen remarkable success in behavioural-based cyber training programs, many are also looking beyond their digital perimeter and providing similar education to members and customers.

These new methodologies are capable of drastically reducing human error-related breaches, using an approach that involves understanding the psychology of each learner and providing training to which they can relate.

This is particularly important as phishing, and other scams, grow in sophistication. Organisations are increasingly looking to customers and members as partners in the pursuit of reducing attacks, which have exploded globally into more than 6 trillion dollars in losses annually.

Human behaviour as a strength

For a long time, the human factor has generally been spoken of as a ‘weakness’ or ‘vulnerability’ in the defence of an organisation’s network, but some are beginning to frame it differently.

“I think humans can be a great strength in cybersecurity,” explains Kin Lee-Yow, chief information officer of the CAA Club Group (CCG), the largest automobile club in Canada. “And a strong cybersecurity defence is crucial, not just on an enterprise level, but for people at every level.”

CCG, which admittedly is ‘obsessed’ with the safety of its more than 2.5 million members, discovered that many of them do not know where to turn when it comes to learning about online safety. According to a study they conducted, 62% of members know someone, or have personally, experienced a privacy or data security breach. One-third, personally experiencing a breach, thought it could have been avoided with better awareness and education.

“If everybody were more knowledgeable and better trained on what to look for from these cyberattacks, then I think overall, the hackers would have less success, and that would probably discourage at least some of the activity,” says Lee-Yow.

A new psychology

In an effort to foster a security-aware culture among employees, there has been a shift in thinking. Instead of using generic, one-size-fits-all lessons, the new method focuses on educating the right person at the right time in the right way to instigate change in behaviour.

“The first step in the CyberconIQ training we use is to understand your personality profile,” explains Lee-Yow. “Do you tend to follow rules or are you maybe a little bit of a risk taker? Everyone is going to be vulnerable in different ways. So, the training has to match up with that.”

CyberconIQ was one of the first companies to merge psychology, cybersecurity, and machine learning to develop a customised approach for each employee. By providing awareness of key motivating factors that drive underlying online employee behaviour, companies can greatly reduce the chances of someone falling for a scam and compromising the network.

“I think these companies are beginning to understand that if they have members or clients, they have at least some responsibility to help protect them as well,” says Jessica Gutierrez, director of learning design and development at CyberconIQ.

The paradox of enterprise security

Large corporations and financial institutions are both the most secure as well as the most vulnerable to a cybersecurity attack. This can be explained by the fact that these organisations typically deploy the latest security technology to protect their perimeter, yet are only as secure as their least-aware employee is.

Of particular danger are the increased instances of phishing, which the 2022 IBM X-Force Threat Intelligence Index noted makes up 41% of all attacks. With the 7-10% gap in one’s firewall that technology simply cannot close, there is a 100% statistical probability that every employee will eventually come across some form of novel threat – be it in an email, chat, or weblink. They will need to identify it as such and know how to best deal with it.

Ultimate goal: raise the bar

The inclusion of customers in an awareness programme has additional advantages. For example, it can protect or even improve a company’s reputation. It can also prevent the business from attack by a third party with lax security. The notorious Target security breach of 2013 occurred when a vendor fell for a phishing email; the thieves were able to access Target’s network through the vendor’s account.

“Our members told us they wanted help in better understanding cybersecurity,” remarked Lee-Yow. “We felt we could fill this gap by offering relevant and timely training.”

This is part of a strategy to combat phishing and hacking on a larger scale; the hope is to thwart attacks by making as many people as possible aware of bad habits by educating them in a way that actually changes behaviour.

“The fewer people that are susceptible to cybercriminals, the better for all of us,” Gutierrez concluded.

Find out more at https://cyberconiq.com/

Share this article:

Further reading: