Dec 11, 2018
According to an IBM study, 95% of security incidents have the same culprit; employees. These errors are usually not done purposely. Instead, simple negligence or a lack of knowledge is the cause. According to a recent Google survey, 33% of employees reported no cybersecurity training was provided by current employers in various industries.
As cybersecurity protection innovates, so to do the methods of attack. Educating your employees on the importance of software updates, regular antivirus scanning, and complicated passwords are not enough. Staff needs to know the signs and be able to detect possible threats even as they become more and more subtle.
Hackers are becoming more adept with their techniques, utilizing social engineering in their attacks by making their emails, links and attachments more appealing to their targets. By tweaking their approach, they can make their points of entrance appear virtually harmless, blending in with commonly received emails.
One successful method hackers use to do this is known as phishing. An email will be sent looking identical to a corporation’s emails, such as a bank or college, enticing people to click on their links and accidentally download a virus.
Ransomware can enter through clicking on links and attachments of such emails. Once accessed, these viruses will lock up files and hold information for ransom. According to Datto, ransoms in these attacks typically cost around $500, but the main issue is that even if the ransom is paid, the criminals still might not return the information. Even if all goes well and you do get your information back, there is little stopping cybercriminals from doing it again.
A fileless attack is a growing problem in the world of cybersecurity. The payload enters the computer without software and attachments, but by links and popups. They can be very difficult to trace and can evade antivirus software better than most types of attacks.
Considering these socially engineered attacks, managers need to think of their staff as the first line of defense - firewalls, antivirus software, and strong passwords are not enough. A simple review of security threats or a one-time quiz is not enough to keep your employees aware. Here are a few critical measures that should be implemented in every company’s cybersecurity education program.
To keep security as a top priority requires regular lessons. Do not limit methods of education to one approach, remember people learn in different ways. Utilize PowerPoints, infographics, videos, and luncheons to help all employees learn and retain information. Creating an online forum for staff members to interact with each other can help them communicate about security and ask questions that can benefit the whole company.
Employees sometimes simply do not understand how serious leaked information can be for their company and jobs. Cyber-attacks can cost a company thousands of dollars and sometimes days of downtime, not to mention the damage that can come to their reputation if customer information is exposed. 60% of small businesses go out of business within 6 months of an attack. Communicating new tactics and emphasizing the importance of being diligence will help motivate employees to pull their weight in the area of cybersecurity.
People often react differently real-life situations than lessons on a page. It is important to randomly test your employees’ ability to recognize and properly respond to an attack. Simulated phishing emails and administrating quizzes and checks are all ways you can see test how team members will behave if a real attack were to occur. Reviewing the results can pinpoint weaknesses and provide feedback to current teaching techniques.
Implementing a company-wide cybersecurity education program may seem overwhelming to begin. To save time and resources, small and medium-size companies may consider outsourcing cybersecurity management to an IT company. Milner not only provides monitoring, backups, and multi-layer defense protocols but also inexpensive continual security training to all client staff members including simulated testing environments.
An attack is more likely to happen than not; 60% of small and medium businesses are attacked once a year, and, according to a CNBC survey, 2,000 small businesses are not paying enough attention to security. When an attacker comes to your door, will your business be prepared to respond appropriately?
Are your employees your weakest cybersecurity link? Download our self-assessment or contact one of our experts today!
Talk to a Security Expert