The human factor – How your people can help to protect your organisation from cyber threats

Covid-19 has brought about a seismic change in the way that our businesses operate. Remote working and increased activity on customer-facing networks and online services are now the norm. Yet these new ways of working have opened up a wealth of cyber security vulnerabilities that cybercriminals have been working hard to exploit.

In mid-March the National Cyber Security Centre (NCSC) warned of new cyber threats as a result of Covid-19. Less than two weeks later, the sheer scale of such activity was made clear in a Telegraph article, which reported that phishing “attacks have increased 667pc since the end of February”. Yet it is not just an increase in phishing that is being widely reported, cyber security weaknesses are also being exploited to launch a wide range of cyber attacks, including ransomware and other forms of malware.

What you can do to help
Often regarded as a security weakness, our experience tells us that as employees we can actually help to strengthen cyber security defences. With the right support and guidance, we can work together to detect and mitigate cyber threats, protecting our organisations from the financial, reputational and brand damage that they can inflict.

Developing human sensors
With cyber threats constantly evolving and increasing, it’s vital that we become ‘human sensors’, that can detect and mitigate cyber attacks before they can be exploited. To help us achieve this, our organisations need to build a cyber security aware culture that:

• Encourages and rewards reporting and sharing of attempted cyber attacks
• Offers interactive cyber awareness training that is tailored to the department and/or organisation
• Reminds us of the dangers of cyber security workarounds and the consequences of successful cyber attacks
• Confirms how, who and when important updates will be issued by the organisation (to ensure that phishing emails purporting to be from credible internal sources are discredited).

The human aspect of incident response
An increase in cybercriminal activity coupled with fundamental changes to the way that our organisations work, means that it's more important than ever that incident response plans are fit for purpose. Yet a successful incident response relies on having the right people in place to co-ordinate and implement the plan, but with a distributed workforce and potentially key staff unavailable this can be a significant challenge. Organisations should therefore ask:

How would we respond to a cyber attack with a distributed team, not all of whom may be available?

• Are we adequately testing and rehearsing our plans?
• Are we ‘wargaming’ different scenarios?
• Should new vulnerability assessments be run to identify new weaknesses?
• Does our response plan cover remote working and increased use of online services?

If you would like to learn more about how you can build resilience to cyber threats during these uncertain times, then please contact Al Sweet at Warner McCall Resilience on hello@wmr.co.uk or (0)7778 322230.