The cybersecurity threat landscape continues to expand – and not only is it expanding in size, but threats are also growing more sophisticated. Employees are increasingly becoming targets for cyber attackers as threat sophistication climbs.
Employees can be a strong line of defense at their organizations, but at the same time, if they aren’t aware of the methods threat actors use, they can introduce risks and make their organization vulnerable to attacks. According to the 2021 Verizon Data Breach Investigations Report, 85 percent of data breaches involve human interaction. Employees need to be cyber-aware to truly protect a company’s valuable digital assets. Let’s explore the why and how of building a cyber-aware workforce.
Strong Security Posture is Essential
It’s not enough for your organization’s security posture to have the latest security technology. It’s also crucial for you to have integrated security solutions to ensure a strong security posture against threats. This includes protecting endpoints, such as using endpoint discovery and response (EDR) solutions. To protect against ransomware, next-generation EDR solutions provide enhanced, real-time threat intelligence, management, analysis, visibility and protection for endpoints—both pre- and post-infection.
These EDR solutions can detect and neutralize possible threats in real time, reducing the attack surface and helping to prevent malware infection, as well as automate response and remediation using customizable playbooks. Other fundamental tools include email gateway security, sandboxing, incident response, network segmentation and network segmentation.
It’s also important to implement zero trust—which is predicated on the idea that every device or user has the potential to be hacked, hence every access request must be verified every time. Even then, individuals and devices can only access the resources they need to do their tasks.
The "Zero Trust Edge," a method based on the same approach, is currently being deployed to the network's remote edges. This novel zero-trust method to safeguarding networks' expanding edges contributes to the widespread adoption of security-driven networking—the necessary merging of security and networking. This allows security to react to changes in the underlying network infrastructure, such as connectivity, while still granting explicit access to programs based on context and identity of the user.
Developing Robust Cyber Training and Awareness
Beyond your security solutions, employee training and education are a key part of any security strategy.
Building a cyber-aware workforce and culture requires training and ongoing awareness—it’s never a one-and-done. Organizations should require all their employees, regardless of role, to have a foundational understanding of cyber threats.
Education for today’s threat landscape must include cybersecurity concerns specific to hybrid and remote work settings. As previously mentioned, 85 percent of data breaches involve human interaction. You may have every security solution that exists, but you'll never be completely secure if you don't train your personnel in cyber hygiene and awareness.
Give your employees extensive training in recognizing and reporting unusual cyber activity, such as phishing emails. A social engineering approach, such as phishing, is used in about half of all ransomware attacks. Keeping your personnel current on these types of attacks is important, particularly as adversaries hone their tactics. This will help to keep your employees from falling prey to the attacker.
Training should include details on the most recent social engineering attack methods, such as spear phishing, smishing and vishing. Employee training must keep up with the rapid changes in attack strategies. It also must keep up with changing work environments, incorporating cybersecurity elements that are unique to hybrid and remote work environments.
CISOs can construct a baseline of protection at the most vulnerable edge of their network and keep important digital resources secure by educating personnel, particularly remote workers, on how to maintain cyber distance, be aware of strange requests, and adopt fundamental security tools and protocols.
And fortunately, organizations don’t have to go it alone—there are security and training awareness service offerings that can help ensure employees are getting the latest and greatest when it comes to cyber hygiene and training. It’s especially important to keep them current as employees switch roles and teams.
Trained for Security Success
As ransomware attacks increase, so does human involvement in their success via careless or poorly trained employees. An effective cybersecurity strategy includes a variety of security solutions, but it cannot succeed without an educated workforce. Through education and training, you can ensure your workforce maintains their cyber distance from adversaries and stays wary of suspicious requests to help keep critical digital resources secure.
Rob Rashotte is vice president of global training and technical field enablement, Fortinet.
