Mastering security awareness in the digital era

Issue 6 2023 Security Services & Risk Management, Training & Education

Simeon Tassev.

Cybersecurity threats are becoming increasingly sophisticated and targeted in today's digital landscape. While organisations invest in advanced anti-malware and threat detection software, they often overlook a critical variable in their security posture: people.

Human error and lack of security awareness remain the number one security threat. Companies must consider the importance of managing employee cyber risk and the significance of training and awareness programmes. Furthermore, organisations need to be cognisant of the ever-evolving nature of human-targeted attacks, the impact of human error on security, best practices for staying security savvy, the components of a strong human risk management programme, and the steps to building a security-first culture.

The evolution of human-targeted attacks

Human-targeted attacks are expected to evolve not only in terms of execution but also in their level of specificity and believability. Threat actors are employing targeted approaches to infiltrate organisations and extract sensitive information. Previously, attacks were generic and employed basic templates. However, today's attackers are increasingly sophisticated, using personalised techniques such as company email attacks. Attackers will continue refining their methods to obtain critical information, thus demanding heightened vigilance from organisations.

Human error poses a significant security risk to organisations, possibly undermining even the most robust security strategies and systems. It is, therefore, crucial to identify critical areas within an organisation and assess the potential risk of human error in those areas. For example, a seemingly minor mistake, such as a call centre agent providing extra information to a caller, can inadvertently aid a perpetrator in launching a company email attack.

Understanding the dynamics of the threat landscape and the potential risks involved allows businesses to prioritise critical areas and implement appropriate training and security measures.

Best practices for employees to stay security savvy

Building a culture of security awareness is crucial for keeping staff security savvy. This can be achieved through various campaigns, tools, and techniques. Regular communication about cyber threats, reminders, screensavers, and posters can help raise awareness and make security second nature. It is essential to continuously educate employees about new techniques and potential threats to ensure they remain up-to-date and vigilant.

Furthermore, a robust human risk management programme combines various tools, policies, procedures, and controls to heighten security measures. While no method is full-proof against human error, it is crucial to understand and prioritise the imminent risks at hand. Risk management allows organisations to identify acceptable risks and focus on mitigating unacceptable risks. Training platforms and risk profiling can help tailor training, additional controls, and policies to specific areas of the business, and success in human risk management requires ongoing assessment and adjustment, acknowledging that unexpected threats can emerge.

Building a security-first culture

Building a security-first culture starts with top-down leadership. Management must understand the importance of security and ensure the implementation and enforcement of relevant policies and procedures. Enforcement helps prevent security breaches and fosters a culture where employees understand the reasoning behind security measures. Scenario-based learning, where employees are exposed to various cyber threat situations, can help them comprehend the relevance of security strategies in their specific roles and environments. In an effort to stay ahead of evolving threats, organisations must maintain a proactive approach to cybersecurity.

In the ever-evolving cyber landscape, organisations must recognise that people play a crucial role in security. Human-targeted attacks continue to evolve, demanding greater vigilance and targeted training efforts. Human error remains the number one security threat, emphasising the need for robust risk management programs and comprehensive security training. Building a security-first culture requires top-down leadership, effective communication, and ongoing education to proactively empower employees to identify and mitigate security risks.

Share this article:
Share via emailShare via LinkedInPrint this page

Further reading:

Deception technology crucial to unmasking data theft
Information Security Security Services & Risk Management
The ‘silent theft’ of data is an increasingly prevalent cyber threat to businesses, driving the ongoing leakage of personal information in the public domain through undetected attacks that cannot even be policed by data privacy legislation.

Data security and privacy in global mobility
Security Services & Risk Management Information Security
Data security and privacy in today’s interconnected world is of paramount importance. In the realm of global mobility, where individuals and organisations traverse borders for various reasons, safeguarding sensitive information becomes an even more critical imperative.

Proactive strategies against payment fraud
Financial (Industry) Security Services & Risk Management
Amid a spate of high-profile payment fraud cases in South Africa, the need for robust fraud payment prevention measures has never been more apparent, says Ryan Mer, CEO of eftsure Africa.

How to prevent and survive fires
Fire & Safety Security Services & Risk Management
Since its launch in August 2023, Fidelity SecureFire, a division of the Fidelity Services Group, has been making significant strides in revolutionising fire response services in South Africa.

A long career in mining security
Technews Publishing Editor's Choice Security Services & Risk Management Mining (Industry)
Nash Lutchman recently retired from a security and law enforcement career, initially as a police officer, and for the past 16 years as a leader of risk and security operations in the mining industry.

Risk management: There's an app for that
Editor's Choice News & Events Security Services & Risk Management
Zulu Consulting has streamlined the corporate risk management process with the launch of Risk-IO, a web-based app designed to consolidate and guide risk managers through the process, monitoring progress as one proceeds.

Integrated information platform for risk management
Editor's Choice News & Events Security Services & Risk Management
Online Intelligence recently launched version 7 of its CiiMS risk and security platform. Speaking to SMART Security Solutions after the launch event, the company’s Arnold van den Bout described the enhancements in version 7.

Global Identity Fraud Report revealing eight-month ‘mega-attack’
Editor's Choice Security Services & Risk Management
AU10TIX recently released its Q4 Global Identity Fraud Report, with the research identifying two never-before-seen attack patterns, with the worst case involving 22 000+ AI-generated variations of a single U.S. passport.

Linking of security officers by security businesses
PSiRA (Private Security Ind. Regulatory Authority) News & Events Security Services & Risk Management
[Sponsored] By law, all security businesses are required to declare their employees to PSiRA so that they can be accounted for administratively. Failure to link employees by security businesses is a contravention of the Code of Conduct and a criminal offence.

AI augmentation in security software
Security Services & Risk Management AI & Data Analytics
The integration of AI technology into security software has been met with resistance. In this, the second of two articles, Paul Meyer explores the challenges and obstacles that must be overcome to empower AI-enabled, human-centric decision-making.