{"id":41151,"date":"2022-07-27T05:17:00","date_gmt":"2022-07-27T05:17:00","guid":{"rendered":"https:\/\/cloudnewshub.com\/archives\/41151"},"modified":"2022-07-27T05:17:00","modified_gmt":"2022-07-27T05:17:00","slug":"cyber-security-training-boring-and-largely-ignored","status":"publish","type":"post","link":"https:\/\/cloudnewshub.com\/?p=41151","title":{"rendered":"Cyber security training \u2018boring\u2019 and largely ignored"},"content":{"rendered":"
<\/div>\n

While cyber leaders overwhelmingly believe their organisations have a strong security culture, new figures compiled by email security specialist Tessian<\/a> have revealed that they are deluding themselves, exposing an alarming disconnect between security pros and the rest of the business.<\/p>\n

With three-quarters of UK and US organisations having experienced some kind of cyber incident in the past year, a significant proportion of employees seem to regard training exercises as something to be endured, rather than engaged with.<\/p>\n

The report, How security cultures impact employee behaviour<\/a><\/em>, found that while 85% of employees participate in security awareness or training programmes, 64% don\u2019t pay full attention and 36% consider their organisation\u2019s security training boring.<\/p>\n

Overall, the report found a general consensus among security leaders over what goes into making up a strong security culture, but with incident volumes remaining stubbornly high, Tessian said it was clear that those at the top had a lot more work to do.<\/p>\n

\u201cEveryone in an organisation needs to understand how their work helps keep their co-workers and company secure,\u201d said Kim Burton, head of trust and compliance at Tessian. \u201cTo get people better engaged with the security needs of the business, education should be specific and actionable to an individual\u2019s work.<\/p>\n

\u201cIt is the security team\u2019s responsibility to create a culture of empathy and care, and they should back up their education with tools and procedures that make secure practices easy to integrate into people\u2019s everyday workflows.<\/p>\n

\u201cSecure practices should be seen as part of productivity. When people can trust that security teams have their best interest at heart, they can create true partnerships that strengthen security culture.\u201d<\/p>\n

The report showed how training exercises \u2013 which in many firms comprise little more than \u201chome-brewed\u201d PowerPoint presentations cooked up by legal and compliance experts who have no real understanding of how people engage with educational materials \u2013 are failing to impact employees across the board.<\/p>\n

For example, 30% of respondents said they didn\u2019t think they had a personal role to play in keeping their company secure, while 45% did not know how to, or who to, report a security incident, and only one in three said they were satisfied with their IT or security team\u2019s communications.<\/p>\n

Meanwhile, over half of respondents said they saw nothing inherently risky in actions such as downloading apps to work devices, sending sensitive data to their own personal email accounts, sharing passwords internally, or connecting to open or public Wi-Fi networks on work devices.<\/p>\n

And even when it came to clearly risky actions, such as clicking on links in emails from unknown sources or opening unsolicited attachments, leaving work devices unlocked and unattended and reusing passwords, well over 40% of respondents said they didn\u2019t see a problem.<\/p>\n

\n

<\/i>Stop scaring people<\/h3>\n

A big source of disconnection seemed to be a tendency among leadership to use security training to spread fear and uncertainty as a motivator.<\/p>\n

For example, half of respondents to Tessian\u2019s study claimed to have had a \u201cnegative experience\u201d with a phishing simulation<\/a>, as evidenced by the 2021 story of a phishing test at West Midlands Trains which went disastrously wrong<\/a>.<\/p>\n

The test appeared to be an email from company leadership detailing a thank-you bonus for employees who had worked through the pandemic, and many people clicked on the link, only to find themselves being ticked off for being insufficiently security-conscious. Union officials described the stunt as \u201ccrass and reprehensible\u201d.<\/p>\n

According to Karen Renaud, chancellor\u2019s fellow at the University of Strathclyde<\/a>, and Marc Dupuis, assistant professor at the University of Washington Bothell<\/a>, such tactics can \u201ccripple employee decision-making, creative thought processes, and the speed and agility that businesses need to operate in today\u2019s demanding world\u201d.<\/p>\n

Tessian said there were several things security leaders should be doing to engage employees better with cyber security procedures.<\/p>\n

For example, security leaders need to play more of an active role at key touchpoints during an employee\u2019s \u201cjourney\u201d with the organisation, such as onboarding, role or office changes, and offboarding. Tessian said onboarding new hires represents a great opportunity to capture people\u2019s imagination before they become cynical and jaded, while more thoughtful and comprehensive offboarding processes can help prevent critical data going missing when someone leaves.<\/p>\n

Another thing every security leader should be doing as a matter of course is to establish clear and regular lines of communication across the entire organisation, paying close attention to how much information they share, who it comes from, via what channels, and how frequently.<\/p>\n

Tessian offered four key pointers on how to do this effectively:<\/p>\n