Yaron Assabi | CEO | Founder | Digital Solutions Group | mail me |
Cybersecurity education, through the use of anti-phishing training programs, is vital in a world where humans remain the weakest link in the cybersecurity chain.
Cybersecurity is a term on every businessperson’s mind, as the legal, financial and reputational implications of a breach are massive.
Employees are the biggest threat
The challenge is that, while a company can implement the best cybersecurity technologies, the biggest threat to a firm remains its people, who are susceptible to social engineering, phishing and many other cyber threats. This means that the best approach to security lies in delivering relevant training that can turn your people into ‘human firewalls’.
Organisations should adopt a positive approach to cybersecurity awareness and training, focusing on education and behavioural change, and ultimately empowering people to recognise risk and take action.
“We named our company Beauceron, after a type of sheepdog, and we feel it is appropriate, because our solutions help to turn employees from passive victims of cybercrime into active defenders against it – or from sheep to sheepdogs, in other words. In our experience, cybersecurity is more of a people, processes and culture issue than it is a technology one alone. This is why our aim is to create a culture of security within our clients’ businesses, and to proactively foster learning that empowers their people to do something about it.”
– David Shipley, CEO at Beauceron Security
The above leads to the subject of anti-phishing programs and training, which are often implemented to reduce the instances of cybercrime attempted against an organisation.
However, there remain criticisms of these programs, including that they fail to reduce click rates to zero, that they can create negative emotional experiences for employees, and they can create a bias towards technology solutions, creating an expectation that they can solve everything.
Real risks that employees are facing
The reality is that a really good program, when sending out simulated phishing attacks, should get you to a click range of around 3-5%.
If your click rate is zero, chances are the program doesn’t actually represent the real risks your employees are facing. We thus recommend using an automated randomisation of phishing templates, which are sent out randomly to your users, and they should have various levels of difficulty. This will help replicate the nature of most phishing attacks, giving your people a chance to learn how to deal more effectively with threats.
Certain types of phishing mails sent as part of such a program may create a negative emotional experience for users. For example, mails promising fake holiday bonuses, or those that focus on romance or sexuality can cause additional distress. Therefore, always ensure you use templates that are appropriate for your organisational context and threat environment.
Remember, there are other, less distressing ways to educate people around such potential threats. You could provide these in a training module, or in a newsletter, or even a talk that is non-threatening, and does not single out individuals. You will still achieve the goal of educating that person, without the attendant distress.
Creating a powerful mechanism
Crucially, when using phishing as an educational tool, staff must never see it as an ‘us and them’ approach, where they feel IT is out to get them or to trick them.
Always remember it is about teaching them, not about tricking people. So, my advice is to create a powerful mechanism for recognising and rewarding users for properly reporting phishing simulations, as well as rewarding reporting of real phishing mail.
Looking beyond simple click rate, organisations should also consider the report rate – that is, the number of employees who regularly report all phishing attempts, both simulated and real. This rate demonstrates how many of your people know what a phishing mail actually looks like, as well as that they care enough to inform you about it. It is, of course, important to celebrate employees like this, that do the right thing.
In conclusion
Staff need to understand that while technology can help defeat cyberattacks, the fact is that all secure gateways have a failure rate against sophisticated phishing attacks, so while it helps, it is certainly not a silver bullet.
In fact, it is best explained using a car analogy: if your employee is the driver and cybersecurity is the act of driving, they would need to be well educated and knowledgeable about the dangers of driving, so they are unlikely to have an accident.
The various cybersecurity technologies are the equivalent of an airbag in the car, in that they help to protect even careful drivers when something bad does happens. However, the reality of safe driving is that avoiding the majority of accidents comes down to how well-trained the driver is. Very much the same could be said about cybersecurity.
