Complex Made Simple

7 essential steps to be cyber security aware

By: Morey Haber, vice president of technology at BeyondTrust

Although cyber-security is a hot topic in the region, Middle East organizations still struggle when it comes to security awareness programs.

In fact, according to a 2016 PwC report, only 37 per cent of regional businesses surveyed have a comprehensive security and training awareness program, against a global average of 53 per cent. Furthermore, only 32 per cent of Middle East organizations require their employees to complete training on privacy policies and practices (compared with 55 per cent globally).

One of my favorite spam emails are the ones from cyber security companies soliciting security awareness training for your employees. Think about it. You are receiving spam email, potentially a phishing attack, from a company offering services on how not to fall for a fraudulent email scam!

Read: The one industry that’s key target for cyber criminals

Security awareness is not a paranoia, but can be looked at in the extremes if misunderstood. This was certainly the case when Yahoo labeled their security professionals the “Paranoids”. Security awareness does require education, but it also requires intelligence, when to respond and when to correctly ignore a situation. If every event, alarm, and situation becomes a problem, security awareness is no different than extreme paranoia. This can take on many forms from cyber security, to physical access. It can be overly dramatized by requiring all visitors to register their laptops upon security check in to a building as a visitor but then denying them even guest access to the Internet or corporate network in any form.

Security awareness needs a causal relationship of action, threat, and outcome not just a blanket statement of denial, or a ‘do not do’.  Therefore, when we consider security awareness education, we need to consider the following factors in our corporate training:

Read: Cyber attacks: 7 key things businesses need to know

All businesses have crown jewels. Whether it is sensitive data, physical assets, personally identifiable information (PII), classified government material or just private information in general. Team members should be trained on what this information looks like, how to handle sensitive information, and what could happen to them, and the business, if the information is stolen; physically or electronically.

Security awareness also has a legal component. All employees, contractors, and applicable third parties handling sensitive information should be trained, and when appropriate, sign a nondisclosure agreement.

The labeling and handling of sensitive information is key in any form used to communicate the contents. This could include labeling emails as confidential, appropriate levels of encryption for storage and transmission, and even include the destruction of material from shredders to wiping disks securely.

The concepts of authorization and authentication are key to security awareness. This includes everything from biometrics, to passwords and multi-factor authentication. Context aware access from geolocation to concurrent login information is a major part of this and ensures proper methods for protecting access to sensitive information and applications as appropriate.

Traditional security awareness training covers cyber security threats and modern attack vectors like malware, phishing (in all forms), and social engineering. This is more than just “do not click on a link”. It needs to cover why you should not click on a link to raise the bar of attentiveness and ultimately intelligence.

Physical access is just as much a part of security awareness training as cyber. This includes building access, door access, security badges, and reporting of incidents. If a stranger is present, how would you notify the appropriate people? This also includes possessions that should never be permitted in the workplace, even personal computers.

All team members should be aware of the consequences in the event of a violation. This could be personnel discipline but also should establish ground rules for what can happen to their employment or company if a violation occurs. If people understand the risk, and why, they are more likely to show attentiveness to the problem than if it is “just policy”.

In the end, security awareness means you comprehend that there is the risk for individuals to deliberately or accidentally steal, damage, or misuse the information or assets prized by an organization. Just by stating “we have done our annual security awareness training” is simply not enough but unfortunately this seems to be the case in several businesses in the Middle East.

Read: 3 most common types of cyber extortion