Business Daily Media

SME Business News

Cybersecurity training in the era of remote work

  • Written by Josh Lemon, Certified Instructor and Course Author at SANS Institute

Before the pandemic, IT managers had the comfort of knowing employees were working in the office within a secured network. This gave organisations the security of company documents being saved on internal systems, collaboration taking place securely, and the ability to control the risk of networks getting compromised. However, the shift to remote working in March 2020 required employees to use their home Wi-Fi and ultimately work within an uncontrolled or monitored security environment.

In fact, since March 2020, the past three notifiable data breach reports from the Office of the Australian Information Commissioner (OAIC) revealed there had been 1,503 data breaches reported with malicious or criminal attacks accounting for the majority of these breaches. Given the prevalence of cyberattacks since the start of the remote working era, organisations must develop a cyber-resilient culture that starts with education.

Communicating cybersecurity risk to employees

According to the most recent OAIC report, 43 per cent of the reported data breaches resulted from cybersecurity incidents, with phishing incidents the main perpetrator. Phishing is a method of attack where threat actors portray to be someone they’re not with a specific call to action (phishing lure) that compromises a system or financial gain for the threat actor. These phishing lures can be a request for funds or information; for example, the “CEO” asking a financial controller to send funds to a specified account. The urgency often portrayed in these emails can cause people to take action without realising something isn’t right.

However, for employees to stay vigilant during a phishing attempt, they need to know what to look out for.

Cybercriminals are getting better and sophisticated at social engineering and putting more time and effort into researching their targets, such as learning names, titles, and employee responsibilities, making their attempts much more believable.

A starting point for employees should be to review the sender’s email domain and their ‘reply to’ domain address. Most organisations have a specific email domain, so an address ending with ‘@gmail.com’ can indicate a phishing attempt. Even slight variations to an email domain can make a huge difference, so don’t be fooled into thinking @g0v.au is trustworthy—it’s very different from @gov.au.

In addition to email domains, employees should be vigilant in opening attachments or clicking on links. Attachments should only be opened from trusted sources and when absolutely necessary, while links should always be treated with caution. Doing a quick Google search of a website URL to confirm it’s legitimate can mean the difference between an organisation’s entire system being locked and business-as-usual.

How to lead a remote cyber training session

To develop cyber resilience and an educated workforce, organisations must implement a regular training program that ensures employees are equipped with the skills and know-how to identify attacks and apply best practices.

In addition, there must be a transparent process in place that guides the organisation on appropriate next steps when an attack has occurred. I recommend businesses adopt the MITRE’s Cyber Exercise Playbook to help organisations plan and run tabletop exercises.

When an organisation is under attack, every department and employee has a role in the recovery effort. Incident response tabletops are designed to test the effectiveness of an organisation’s security program, from its cyber defensive processes, recovery procedures, to cyber preparedness prior to a cyberattack. They can help identify weak points in an organisation and further indicate gaps in processes or knowledge, allowing organisations to better focus future cybersecurity training.

Simulating an organisation’s cybersecurity procedures via an incident response tabletop can help in reducing the impact of a cyberattack on organisations, while providing additional benefits to employees:

  1. Validation: Implementing such procedures allows an organisation the opportunity to educate employees on the organisation’s guidelines for cybersecurity responses

  2. Situational awareness: It is essential to update employees on new tactics threat actors use when they are trying to infiltrate an organisation. Employees will be better equipped with the skills needed to identify cyber threats.

  3. Team building: In the time of remote working, employees lose the physical interactions with their colleagues, so engaging in meetings where employees can discuss strategies used while working remotely can unify team members

With many Australians living in and out of government lockdowns, organisations must lead frequent cybersecurity training sessions to mitigate their chances of data breaches and encourage employee accountability to embrace the increased risks of cyberattacks in the era of remote work.

Business Daily Media Business Development

Reflections on stigma | ADHD is not a man’s disease | 3 women in business explain how it's a super power

For people living with attention deficit hyperactivity disorder or ADHD, daily life is made up of a series of challenges, where even simple tasks like getting out of bed and getting to w...

Business Daily Media - avatar Business Daily Media

CBA offers a zero interest business loan for Christmas

In a bid to give small businesses across Australia a much needed Christmas boost, Commonwealth Bank is offering a zero interest business loan and just one simple fee² paid over the...

CBA - avatar CBA

Riskline reveals top business travel risks for 2022

Natural disasters, extremism, elections and social unrest will join the continuing impact of Covid-19 across the world as the major threats and disruptions to travellers in 2022, ac...

Business Daily Media - avatar Business Daily Media

Supremacy Games to release unique mobile NFT racing game Race Team Rivals

Multiple NFT games in the pipeline, many titles based on global hit licensed properties - Auction to begin very soon! Helsinki, Finland - November 29, 2021 - Supremacy Games announce...

Business Daily Media - avatar Business Daily Media

Writers Wanted



NewsServices.com

Content & Technology Connecting Global Audiences

More Information - Less Opinion