Enterprise organizations expanding cybersecurity training to include customers
Enterprise organizations are taking security awareness to the next level. Knowing that even the best technology can only successfully repel a potential cyberattack 90-93% of the time, it is now a mandate of many companies to give employees the training and education they need to prevent them from clicking on something they shouldn’t. Having seen remarkable success in behavioral-based cyber training programs, many are also looking beyond their digital perimeter and providing similar education to members and customers.
These new methodologies are capable of drastically reducing human error-related breaches using an approach that involves understanding the psychology of each learner and providing training to which they can relate.
This is particularly important as phishing and other scams grow in sophistication. Organizations are increasingly looking to customers and members as partners in the pursuit of reducing attacks which have exploded into more than 6 trillion dollars in losses annually.
Human Behavior as a Strength
For a long time, the human factor has generally been spoken of as a “weakness” or “vulnerability” in the defense of an organization’s network. But some are beginning to frame it differently.
“I think humans can be a great strength in cybersecurity,” explains Kin Lee-Yow, Chief Information Officer of the CAA Club Group (CCG) the largest automobile club in Canada. “And a strong cybersecurity defense is crucial not just on an enterprise level, but for people at every level.”
CCG, which admittedly is “obsessed” with the safety of its more than 2.5 million Members, discovered that many of them don’t know where to turn when it comes to learning about online safety. According to a study they conducted, 62% of Members know someone or have personally experienced a privacy or data security breach. One-third personally experiencing a breach thought it could have been avoided with better awareness and education.“If everybody were more knowledgeable and better trained on what to look for from these cyberattacks, then I think overall the hackers would have less success, and that would probably discourage at least some of the activity,” says Lee-Yow.
Recently, after seeing great success with its employees, CCG decided to unveil a new program that gives Members in Ontario and Manitoba free access to a web-based, personalized cybersecurity education platform.
“We’ve seen how this can really make a difference in how people behave, and so we thought, why not offer it to our Members so they can improve their online safety as well,” adds Lee-Yow.
A New Psychology
In an effort to foster a security-aware culture among employees, there has been a shift in thinking. Instead of using generic, one-size-fits-all lessons, the new method focuses on educating the right person at the right time in the right way to instigate change in behavior.
“The first step in the cyberconIQ training we use is to understand your personality profile,” explains Lee-Yow. “Do you tend to follow rules or are you maybe a little bit of a risk taker? Everyone is going to be vulnerable in different ways. So, the training has to match up with that.”
Based in York, PA, cyberconIQ was one of the first companies to merge psychology, cybersecurity, and machine learning to develop a customized approach for each employee. By providing awareness of key motivating factors that drive underlying online employee behavior, companies can greatly reduce the chances of someone falling for a scam and compromising the network.
“I think these companies are beginning to understand that if they have members or clients, they have at least some responsibilities to help protect them as well,” says Jessica Gutierrez, director of learning design and development at cyberconIQ.
The Paradox of Enterprise Security
Large corporations and financial institutions are both the most secure as well as the most vulnerable to a cybersecurity attack. This can be explained by the fact that these organizations typically deploy the latest security technology to protect their perimeter yet are only as secure as their least-aware employee.
Of particular danger are the increased instances of phishing, which the 2022 IBM X-Force Threat Intelligence Index noted makes up 41% of all attacks. With the previously mentioned 7-10% gap in one’s firewall that technology simply cannot close, there is a 100% statistical probability that every employee will eventually come across some form of novel threat – be it in an email, chat, or weblink. They will need to identify it as such and know how to best deal with it.
Ultimate Goal: Raise the Bar
The inclusion of customers in an awareness program has additional advantages. For example, it can protect or even improve a company’s reputation. It can also prevent the business from being attacked by a third party with lax security. The notorious Target security breach of 2013 occurred when a vendor fell for a phishing email; the thieves were able to access Target’s network through the vendor’s account.
“Our Members told us they wanted help in better understanding cybersecurity,” remarked Lee-Yow. “We felt we could fill this gap by offering relevant and timely training.”
This is part of a strategy to combat phishing and hacking on a larger scale; the hope is to thwart attacks by making as many people as possible aware of bad habits by educating them in a way that actually changes behavior.
“The fewer people that are susceptible to cyber criminals, the better for all of us,” Gutierrez concluded.
