Unsurprisingly, cyberattacks are continuing to occur more frequently, becoming more complex and targeting every possible economic sector. This underlying trend is leading more and more companies to review their position and roll out new initiatives to train their employees on good IT practices. The goal here is to create natural reflexes that allow everyone to play an active role in protecting themselves from threats, which can have a vast array of consequences for companies, including sensitive information leaks, reputation loss, damaged customer and partner confidence, etc. It is essential to constantly adapt habits and behaviours to deal with these issues. In this way, having concentrated more on the ‘awareness’ aspects of cyber-related risks, companies need to switch to ‘intensive training’ mode for their staff, positioning their employees as the final defence against cybercriminal attacks. By putting continuous training at the heart of security and cyberdefence policies, companies will be able to move from a state of risk awareness to a state of alert. This is about the need to be on guard, assessing your present circumstances in view of the threats against them.
The end of omnipresent technology as the ultimate barrier against new threats
It is important to understand that, whilst still a necessary component, technology alone is no longer enough to protect us. Indeed, the human element is just as important here and must be clearly addressed within security policies. This has led many companies to introduce ‘awareness’ focussed actions in a variety of different formats, including classroom-style training sessions, displays, mock exercises, e-learning, etc. However, once again, this approach is not enough on its own. These initiatives are all too often infrequent and don’t incorporate the reflexes that allow companies to move from a ‘consciously competent’ state to a ‘subconsciously competent’ state, as often described in NLP*.
The final step that businesses need to take therefore concerns a state of perpetual vigilance, unconsciously and automatically exercising their skills. Inspired by the Zanshin** approach and just like in everyday life, it’s about paying close and sustained attention to actions or behaviours that could be dangerous and, in this case, expose information systems to intrusion or hacking. This can involve creating ongoing training programmes, with more regular mock exercises, which helps employees develop automatic responses on their way to becoming the last line of defence.
Indeed, whilst artificial intelligence is developing at pace and helping to detect dangerous behaviour, it is not yet sufficiently mature to replace human-led assessments. It is therefore absolutely essential that employees be helped to develop in order to achieve this state of continuous vigilance, helping them make the right decisions at the right time, working better and knowing what to do without panicking.
To achieve this result, we also have to consider information sharing between employees and create a real community-minded response, which is essential to reaching the required state of alert. As things stand, digital technology and collaborative platforms are intrinsically connected, especially within decentralised organisations. It is therefore becoming possible to create internal forums, online spaces and other tools that can be used to provide information in real time to CISOs or, on the other hand, to cascade it down to operational teams.
In view of these factors, it appears that human beings will continue to play a key role in the security mechanisms of information systems, and that a culture of vigilance is becoming central to corporate policies as they try to protect themselves sustainably and effectively.
* Neuro-linguistic programming
** The term Zanshin comes from the Japanese word 残心 and means vigilance towards your opponents, literally, ‘the spirit that remains’. This is an attitude developed within Japanese martial arts.
Stormshield
Leave a Reply