Final line of defence: how to create a human firewall

Cyber attacks have increased every year, as people try to benefit from vulnerable business systems. As a result, the importance of providing staff with effective training should not be underestimated.

According to research, 78% of employees are aware of the risks of suspicious email links but still click on them. With cyber attacks becoming more complex, and at times quite dangerous, it is important that you have a robust security strategy in place to protect your business. We caught up with IT Hotdesk’s managing director Gordon Christie about how the correct training can provide your staff with the skills and confidence to protect your business from cyber attacks.

What is a human firewall?

“A human firewall is when employees support your security strategy by actively looking for and reporting suspicious activity both online and through emails. The more employees that you have on board, the more higher the level of detection and the stronger your human firewall will become.”

What is Security Awareness Training?

“Security Awareness Training is one of the best ways to create and strengthen your company’s firewall as it educates employees, providing protection for themselves and your business assets from cyber threats. It is all about ensuring employees are aware of current cyber threats and the different forms that they come in.”

How does IT Hotdesk’s Security Awareness Training differ from others?

“All forms of security awareness training is helpful, but research has shown that traditional security training, where staff watch a presentation and complete a short exam, does not help convert users into a strong defensive line, as they will complete a course once a year and within a couple of weeks will have forgotten what they have learned.

“While traditional training will introduce topics, best practices and policies, the learnings rarely stick with people long term. In order to modify a person’s behaviour, you must create an environment where they are constantly looking for a potential test or threat.

“This is why our courses are so popular with customers. Our training is delivered through computer-based software and covers an array of threats that businesses may face. Working with our customers to establish their business needs, our cyber security experts will design bespoke campaigns for each training course.

“Using interactive modules and games that are tailored to each group's security maturity, our team will educate and inform staff as part one of their training. Upon successful completion of part one, our team will then launch random simulated attacks on staff.”

What are the benefits of this approach?

“Our approach exposes staff to real-life experiences but within a safe environment. By using interactive modules and games, staff are fully immersed into the scenario which results in increased engagement and enhanced understanding.

“The most successful training courses are the ones that engage delegates. Our bespoke approach to Security Awareness Training provides a huge range of benefits:

• Gamification makes the training more rewarding for the employees
• Our personalised training automatically matches the skill, level, role, or department of the user for an engaging and realistic experience
• The frequency in our training has a real impact on a person’s learning and behaviour
• After reporting a simulation, users will get a few tips to help them to recognise malicious emails in the future
• The relevant content will make employees wonder whether they received simulation or an actual threat, keeping them alert at all times.”

“Because everything is online, the course can be completed as and when people have the capacity. Although we can monitor and provide feedback throughout the training, we also provide a report when the course is complete. This approach works well as it allows for business owners to identify who has ignored the training, who has failed the training, and who needs more in depth support.

“Educating staff on the risks and highlighting what they need to look out for, will increase their awareness meaning that they have the skills required to actively protect your business from attacks.”

What are the risks associated with cyber attacks?

“Being a victim of a cyber attack can cause long term damage to your business. In the short term, you can experience down time, lose data and be held ransom by your attackers. But the effects of being attacked can carry on long after the attack has been dealt with.

“When a business is attacked, it is usually due to one of two reasons: to hold files at ransom for a monetary value or to steal a business’s data. Most people dread the first reason but actually the latter will likely cost you more in the long run. The reputational damage of a data breach is far greater than any financial implications.

“When hacked, the cyber criminal has access to your systems and can impersonate you or a member of your team, contacting staff, customers and suppliers.

How can businesses benefit from Security Awareness Training?

“The benefits to completing a comprehensive Security Awareness Course can create an array of benefits to both business owners and staff. The main benefits that our customers report following the completion of our Security Awareness Training course are:

• Reduced risk of successful attacks - staff who have completed the training are reporting potential attacks more frequently, reducing the likelihood of a cyber criminal succeeding in their attempt to attack
• Improved staff confidence - staff feel more comfortable using technology in their day-to-day role and responsibilities, particularly when accessing emails and online content
• Increased understanding of staff capabilities - the course provides a breakdown of all team members, identifying those who require more support
• Peace of mind - knowing that your staff are acting as the final line of defense
• Saving time and money - by reducing the level of successful attacks, businesses will have less downtime and will not be held at ransom by cyber criminals.”

Will Security Awareness Training provide 100% protection?

“The cyber threat landscape is ever evolving, criminals are becoming smarter and their attacks are more sophisticated. In the same way that email filtering solutions cannot provide 100% guaranteed protections, there will be times that a member of staff does not catch a potential attack.

“For example, when people are tired or are busy, they are more likely to skim over the contents of an email and click on a link. However by creating a culture where people are more aware, you will find an increased level of attacks being reported, and a decrease in the number of successful attacks.

“In order to maximise the effectiveness of a cyber security strategy, we would recommend that businesses implement the essential technology to work alongside fully trained and engaged staff.

If you are interested in our security awareness training, and would like more information, please get in touch with the IT Hotdesk team by completing the form below. We will then be in touch as soon as possible to provide you with more details, as well as organise a free one-to-one cyber security consultation.