Call (716) 373-4467
29May

Create an Army of Employees to Fight Cybercrime

It’s common belief that people are the last line of defense during a cybersecurity attack. Wrong. In many instances people are in fact the first line of defense. If your employees are (1) aware and (2) properly trained, then they will be one of your single strongest assets in fighting a never-ending war against cybercrime.

Basic human behaviors such as inquisitiveness, excitement, distraction, and indecision make people extremely vulnerable to one of the most popular and effective cyber-attacks called Social Engineering. Social Engineering is a term used to describe a wide variety of techniques that are used by malicious hackers to exploit human beings and execute a successful cyber-attack. 

The most common example of a Social Engineering attack is called Phishing. This is an exercise where an email is sent with the intent of tricking the recipient and convincing them to either click on a malicious link, download a malicious attachment, or even relinquish sensitive information such as passwords, credit card numbers or bank account details.  The victim rarely knows they are being exploited until it is too late.

The results of a successful Phishing attack can be devastating. In some cases, the network is infected with malware or a virus causing loss of data and significant outages or disruptions. In other cases sensitive information or data is stolen and further exploited or resold on the dark web. There are even many documented cases of unauthorized wire transfers resulting in tremendous and unrecoverable financial losses.

So, how does an organization take a group of employees and turn them into an effective cybercrime fighting machine? I’m glad you asked. There are three simple steps that must be executed:

 

Step 1. Develop A Culture Of Security 

Cultures are ultimately defined and upheld from the top down. Leadership, Executive and Management teams must commit to the creation and enforcement of cybersecurity policies, procedures and processes. They must also emphatically message and communicate the importance of good cybersecurity hygiene.

Employees should understand how exactly they can be good cybersecurity stewards and more importantly why it is so critical that they are. Lastly, employees who transform into skeptical, protective and enlightened cybercrime fighting soldiers should be recognized and rewarded.

TIPS to help Develop A Culture Of Security:

  • Create cybersecurity policies – these are the guidelines and rules.
  • Publish cybersecurity policies – allow employees to read and digest the content.
  • Assign roles and responsibilities – tell employees what they must do.
  • Good governance – enforce the rules, reprimand offenders & celebrate achievers.
  • Frequent Communication – talk about cybersecurity often, remind and reinforce!

 

Step 2.  Educate And Train

The best armies are well trained. They are not only armed, but they understand exactly how and when to use their weapon. They understand their mission, know what they are fighting for, and they have practiced and are ready for combat.

Teach your employees about common threats and dangers such as Social Engineering attacks. Show them how to use software and computers in a secure fashion. Explain correct process and procedures are. Provide them with the critical training they need to effectively fight cybercrime.

TIPS to help Educate And Train:

  • Implement a security awareness training program – commit to the training.
  • Be sure the content is meaningful and relevant.
  • Make the training fun and engaging – tell lots of stories.
  • Make the training mandatory.
  • Make the training frequent – at least once a year.
  • Focus on the basics – keep the content simple and easy to understand.

Contact us today to learn how we can help you start establishing cybersecurity throughout your organization.

 

Step 3. Test The Effectiveness

It will be difficult to know if your new cybersecurity culture is performing as you hoped unless you test the effectiveness of policies, processes, procedures and awareness training. Is the effort you’ve put into creating an army of equipped cybercrime fighting employees actually providing the protection you desire?

There are only two ways to find out. One, wait for a legit attack to occur and hope for the best – or – two, launch a simulated attack yourself. Controlled Phishing attacks, penetration tests, table top incident response exercises or even a Monday morning pop quiz can all be effective exercises to test your employees’ level of understanding and compliance.

Use the test results as an opportunity to re-engage with employees or even re-tool training efforts. Get better with practice.

TIPS to help Test The Effectiveness:

  • Launch simulated Phishing attacks – see how employees actually behave.
  • Spot check for policy compliance – it is after 5PM, is the Clean Desk Policy working?
  • Include social attacks in the scope of penetration testing.
  • Conduct table top exercises.
  • Document and share results.
  • Learn and get better.

Right now, your employees are probably the weakest link in your cybersecurity defense chain. Make them your strongest link. Our Breach Prevention Platform and Security Awareness Training with simulated phishing tests will give your employees the tools they need to spot a phishing attempt. Reach out today at 716-373-4467 x115 or [email protected] to speak with one of our experienced team members about getting started.

 

Content used with permission from Cyberstone.

comments powered by Disqus
Administrative Privileges AI AI algorithms AI in Cybersecurity Annual Security Training Anti-Virus Artificial Intelligence Authenticator App Backup and Recovery Backup Redundancy BCDR BEC breach prevention Breach Prevention Platform Breaches business continuity Business Email Compromise Business Email Compromises Business Phone System Business Software BYOD Call Directory Cisco Cloud Accounts Cloud Data Backup Cloud Infrastructure Cloud Security Cloud Solutions Compliance Comprehensive Cybersecurity Compromised Credentials computer support Computer Upgrades Conditional Access Credential Theft Cyber Attacks Cyber Criminals Cyber Defenses Cyber Insurance cyber liability insurance Cyber Risk Management Cyberattacks Cyberinsurance cybersecurity Cybersecurity Awareness month Cybersecurity Breach Cybersecurity Culture Cybersecurity Strategy Cybersecurity Training Cybersecurity Webinar Dark Web Dark Web Monitoring Data Backup Data Backup and Recovery Data Backup Solution Data Breach Data Breaches Data Governance Data Management Data Privacy Compliance Data Privacy Regulation data protection Data Recovery Data Restoration Data Security deepfake Deepfakes Defense in Depth Denial of Service Device Security Disaster Recover Disaster Recovery DNS Filtering doug wilson employee cybersecurity training Endpoint Detection and Response field technician Foundation Security Gift Card Scams Hackers Hosted VoIP Hybrid work i.t. service provider Identity Theft incident response plan Incident Response Planning Insider Threats Internet Explorer Internet of Things Intrusion Detection Intrusion Prevention IoT Devices IT Budgeting IT Compliance IT Infrastructure IT Myths IT Partner IT Policies IT Resource IT Security IT Service Provider IT Services IT Support Juice Jacking Local Admin local admin privileges Lost Devices M365 malware Managed Clients Managed Detection and Response Managed IT managed service provider managed services Manages Services MDR MFA Microsoft Microsoft 356 Microsoft 365 Copilot Microsoft Office Mobile Devices MSP MSP501 Multi-Factor Authentication Network Monitoring Network Security Network Testing New Computer NIST Framework Offboarding Office 365 Outlook Outsourced IT password management Password Manager Password Managers Password Protection password security Passwords Patch Management Patches Patching PC Performance Penetration Testing Personal Data phishing Phishing Attacks PII Proactive Monitoring Processor productivity Professional Tune-Up Public WiFi Push-Bombing RAM Ransomware Ransomware Prevention Recovery point objective Recovery Time Calculator Recovery time objective Remote Monitoring Remote Working repeatbusinesssystems Ring Groups risk assessment Risk Management Risk Tolerance Rock-It VoIP RPO RTO RTO Costs SaaS SaaS Backup Scammers Scams security Security Assessment Security Awareness Training Security Defaults Security Key Security Scans SLAM Method Smishing SMS Social Engineering Social Media Security Software-as-a-Service Solid-State Drive Sponsored Google Ads SSD stolen credentials Storage Teams technical support scam technology best practices Technology Management Technology Policies Technology Review Threat Detection Threat Identification Threat Modeling Updates virus VoIP Systems VPN Vulnerabilities Vulnerability Assessment Vulnerability Management Warning Signs Webinar Windows 8.1 Work Computers World Backup Day zero trust policy