SecurityBrief Asia logo
Asia's leading source of cybersecurity and cyber-attack news
Story image

Cybersecurity: Starting with the human factor

By Contributor
Wed 3 Jul 2019
FYI, this story is more than a year old

Article by World Wide Technology VP and APAC head Nilesh Mistry 

These days, it is difficult to dodge the topic of digitalisation in Singapore.

With the “Smart Nation” initiative in full swing, Singapore is set to reap the full benefits of digitalisation.

A study by the Economist Intelligence Unit (EIU) last year ranked Singapore as one of the most technologically ready economies for the period of 2018 – 2022.

Yet, as more of Singaporeans’ data moves towards digital platforms, there is also a broader surface area for cyber threats to prey upon.

In a recent report by Dell EMC, it was discovered that data-loss incidents cost Singapore organisations an average of US$1.4 million over 12 months.

This is higher than the global average of US$939,703.

Coupled with the fact that Singapore has also experienced high-profile data breaches such as the SingHealth hack in 2018, it is obvious that cybersecurity is an issue.

Whenever a data breach occurs, people usually see and hear of repercussions affecting the organisation’s C-suites.

However, cybersecurity is the collective responsibility of everyone in an organisation. A chain is only as strong as its weakest link.

The best technologies, infrastructure and legislation mean nothing if cyber threats target the human actor in the security chain.

It is no surprise the majority of the high-profile leaks that have taken place in the past year were all facilitated by some form of human lapses.

To ensure a robust and cohesive security strategy, cybersecurity consciousness must be fostered in the company culture and throughout the organisation.

Starting with organisational culture

Driving a culture change is not impossible but it would require a comprehensive cybersecurity awareness programme.

The first step toward creating a successful cybersecurity awareness programme is to recognise that it is not a project with a defined timeline and an expected completion date, nor is it something to measure with KPIs.

A successful cybersecurity awareness programme should focus instead on permeating the cybersecurity consciousness throughout the company culture.

This requires constant education and vigilance.

Typically, the most effective programmes are those that educate users upon initial hire and every quarter that follows.

This training should educate all users, especially those at the executive level who are considered high-value targets.

A mature programme should also be shaped by a keen understanding of the organisation’s culture.

This will not only help set the tone for the material but will be informative for coaching and guiding individuals to change their cybersecurity competence and behaviour.

Beefing up awareness training

For most organisations, awareness training is done infrequently and is stale.

Most people candidly forget the majority of what is presented in a cybersecurity training programme because such programmes often fail to leverage a variety of presentation styles and content format. Furthermore, such training probably happens only once a year.

Kick the cadence up to three or four times a year and allow programme managers to take creative liberties with the content to better suit their audiences and demographics. What works for one group may not work for another.

Consider visuals (whiteboards, videos and ideation), use conversational auditory engagement about the subject matter and try role-playing certain concepts so students can move around and engage with each other.

The aim is to make awareness training as intuitive as possible for employees instead of your typical orientation sessions.

A recent report from Gartner and Cybersecurity Ventures even backs up the notion of organisations using a multipronged approach for cybersecurity awareness programmes.

They estimate an employee’s cybersecurity competency will increase by 40 percent by 2020 through the use of different programme tactics.

Awareness training is the most underspent sector of cybersecurity, but it is also the cheapest risk-reducing measure an organisation can invest in.

Create guidelines and tips for email and social media usage

Malicious cyber-actors are constantly developing new and creative ways to fool people into handing over their most precious data.

Be it corporate emails, social media platforms or a phone call, employees need to be on constant alert.

For any service used, take advantage of any two-step verification that is provided. With this turned on, a user enters their login ID and password and then the app texts them a code. The only way to gain access is by entering that final code.

Employees should also look out for phishing attempts. Email phishing is a scam typically carried out by making unsolicited emails appear to originate from legitimate sources.

Attackers prey on unsuspecting victims, seeking to elicit personal and financial information. For an organisation, these fraudulent emails pose a considerable security risk, as the embedded links they contain can become conduits for the installation of malware on corporate assets.

Once an attacker has established a permanent presence on the corporate network, further exploits can occur, including exfiltration of sensitive data or destructive activities that can negatively impact business operations.

Employees must be made aware of such “creative” cyber threats and guidelines should be in place to combat these attempts.

Employees should constantly exercise vigilance, especially in these days where cyber threats can take the guise of email or even a phone call.

Related stories
Top stories
Story image
Ransomware hits 65% of organisations in Singapore
Next-generation cybersecurity firm Sophos has released its annual survey and review of real-world ransomware experiences in the State of Ransomware 2022.
Story image
ChildFund launches new campaign to protect children online
ChildFund says WEB Safe & Wise aims to protect children from sexual exploitation and abuse online while also empowering them to become digitally savvy. 
Story image
Customer experience
Gartner recognises Okta for abilities in Access Management
Okta has announced it has been recognised as a Customers' Choice for the fourth time in a row in the Gartner Peer Insights "Voice of the Customer" report.
Story image
Data Protection
Barracuda launches new capabilities for API Protection
"Every business needs this type of critical protection against API vulnerabilities and automated bot attacks," Barracuda says.
Story image
Palo Alto Networks says ZTNA 1.0 not secure enough
Palo Alto Networks is urging the industry to move to Zero Trust Network Access 2.0 because previous versions have major gaps in security protection.
Story image
Google reveals new safety and security measures for users
Google's new measures include automatic two step verification, virtual cards and making it easier to remove contact information on Google Search results.
Story image
Amazon Web Services / AWS
RedShield leverages AWS to scale cybersecurity services
"Working with AWS gives RedShield the ability to mitigate significant application layer DDoS attacks, helping leaders adopt best practices and security architectures."
Story image
Artificial Intelligence
AI-based email security platform Abnormal Security valued at $4B
"A new breed of cybersecurity solutions that leverage AI is required to change the game and stop the rising threat of sophisticated and targeted email attacks."
Story image
Noname Security partners with Netpoleon to target API issues
Specialist API security firm Noname Security has appointed Netpoleon as its distributor in Australia and New Zealand.
Story image
Companies rushing to secure print infrastructure
As the pandemic prioritised communication channels and the shift to remote work, IT departments fell behind in updating the security of print and IT infrastructure.
Story image
CyberArk launches $30M investment fund to advance security
CyberArk has announced the launch of CyberArk Ventures, a $30 million global investment fund dedicated to advancing the next generation of security disruptors.
Story image
Artificial Intelligence
Updates from Google Workspace set to ease hybrid working troubles
Google Workspace has announced a variety of new features which will utilise Google AI capabilities to help make hybrid working situations more efficient and effective.
Story image
Video: 10 Minute IT Jams - An update from IronNet
Michael Ehrlich joins us today to discuss the history of IronNet and the crucial role the company plays in the cyber defence space.
Story image
Anniversaries remind us to review identity risks
World Password Day provides a timely reminder for ordinary citizens and organisations to stop and think about the risks associated with digital identities.
Story image
HackerOne launches Attack Resistance Management solution
HackerOne has launched Attack Resistance Management - a new category of security solution that targets the root causes of the attack resistance gap. 
Story image
New vulnerabilities found in Nuspire’s Q1 2022 Threat Report
“Threat actors are quickly adjusting their tactics and these exploits tend to get industry attention, but the threat posed by older and attacks still persists."
Story image
Appian awarded billions in damages against Pegasystems Inc.
Appian has been awarded USD$2.036 billion in damages against Pegasystems Inc as the result of a jury verdict in the Circuit Court for Fairfax County, Virginia.
Story image
Data backup plans inadequate, data still at risk - study
The Apricorn 2022 Global IT Security Survey revealed that while the majority organisations have data backup plans in place, data for many are at risk.
Story image
KnowBe4 celebrates reaching 50,000 customers worldwide
KnowBe4 has reached the milestone of 50,000 customers, adding nearly 2,500 in the first quarter of 2022 alone.
Story image
Use of malware, botnets and exploits expands in Q1 2022
"As zero-day attacks and other vulnerabilities among companies like Google and Microsoft come to light, threat actors are quickly adjusting their tactics."
Story image
Supply chain
Jetstack promotes better security with supply chain toolkit
The web-based resource is designed to help organisations evaluate and plan the crucial steps they need to establish effective software supply chain security.
Story image
A third of companies paying ransom don’t recover data - report
Veeam's report finds 76% of businesses who are victims of cyberattacks paid the ransom to recover data, but a third were still unable to get their information back.
Story image
Digital Transformation
Physical security systems guide the hybrid workplace to new heights
Organisations are reviewing how data gathered from their physical security systems can optimise, protect and enhance their business operations in unique ways.
Story image
Nozomi Networks
Nozomi Networks, Siemens reveal software integration
Nozomi Networks and Siemens have extended their partnership by embedding Nozomi Networks’ software into the Siemens Scalance LPE local processing engine.
Story image
Managed service providers: effective scoping to avoid costly vendor pitfalls
Managed security services are outsourced services focusing on the security and resilience of business networks.
Story image
Ivanti and Lookout bring zero trust security to hybrid work
Ivanti and Lookout have joined forces to help organisations accelerate cloud adoption and mature their zero trust security posture in the everywhere workplace.
Story image
Workato unveils enhancements to enterprise automation platform
"The extra layer of protection with EKM, zero-logging, and hourly key rotation gives customers a lot more visibility and control over more sensitive data."
Story image
Remote Working
How zero trust and SD-WANs can support productive remote working
The way people connect with applications and data has changed, users are remotely accessing resources that could be stored anywhere from a corporate data center to the cloud.
Story image
Digital Transformation
How to modernise legacy apps without compromising security
At a time when digital transformation has become central to business, even the most important applications come with a ‘use-by’ date.
Story image
Tech job moves
Tech job moves - Datacom, Micro Focus, SnapLogic and VMware
We round up all job appointments from May 6-12, 2022, in one place to keep you updated with the latest from across the tech industries.
Story image
Cloud Security
Aqua Security createa unified scanner for cloud native security
“By integrating more cloud native scanning targets into Trivy, such as Kubernetes, we are simplifying cloud native security."
Story image
A10 Networks finds over 15 million DDoS weapons in 2021
A10 Networks notes that in the 2H 2021 reporting period, its security research team tracked more than 15.4 million Distributed Denial-of-Service (DDoS) weapons.
Story image
Rubrik Security Cloud marks 'next frontier' in cybersecurity
"The next frontier in cybersecurity pairs the investments in infrastructure security with data security giving companies security from the point of data."
Story image
Cybersecurity starts with education
In 2021, 80% of Australian organisations responding to the Sophos State of Ransomware study reported being hit by ransomware. 
Find out how you and your business can prevent being caught out by everything from ransomware to cryptojacking.
Link image
Story image
The 'A-B-C' of effective application security
Software applications have been a key tool for businesses for decades, but the way they are designed and operated has changed during the past few years.
Story image
Zerto unveils updates to ransomware recovery capabilities
"Organisations face increased risks from the volume and sophistication of ransomware attacks prevalent today."
Story image
Qualys updates Cloud Platform solution with rapid remediation
The new update is designed to enable organisations to fix asset misconfigurations, patch OS and third-party applications, and deploy custom software.
Story image
Sift shares crucial advice for preventing serious ATO breaches
Are you or your business struggling with Account Takeover Fraud (ATO)? One of the latest ebooks from Sift can provide readers with the tools and expertise to help launch them into the new era of account security.
Story image
Artificial Intelligence
ForgeRock releases Autonomous Access solution powered by AI
ForgeRock has officially introduced ForgeRock Autonomous Access, a new solution that uses AI to prevent identity-based cyber attacks and fraud.
Story image
BeyondTrust integrates Password Safe solution with SailPoint
BeyondTrust has announced the integration of BeyondTrust Password Safe with SailPoint identity security offerings.
Story image
Artificial Intelligence
How to ensure ethical deployment of AI implementations
The increase in automation and machine technology such as AI and machine learning has unlocked a whole new level of scale and service to organisations. 
Story image
Fortinet training edges toward closing cybersecurity gap
The Fortinet Training Institute has made significant progress in closing the cybersecurity skills gap, on track to train one million people by 2026.
Story image
Application Security
What are the DDoS attack trend predictions for 2022?
Mitigation and recovery are vital to ensuring brand reputation remains solid in the face of a Distributed Denial of Service (DDoS) attack and that business growth and innovation can continue.