sb-as logo
Story image

Why the C-suite must not be exempt from cyber defense training

31 Jan 2018

The most effective way organisations can prepare for legislation compliance, particularly in the case of Australia's data breach notification and the EU's GDPR is to ensure its processes and tools are strong enough to stop hackers, according to Aleron.

Those hackers may seek unauthorised access to customers’ personal information. As such, organisations and employees should be aware of their security policies and they should communicate responsibilities.

Aleron director Alex Morkos says that when staff don’t know their responsibilities or their security policies to help keep their business secure, it is a major problem.

“This means either these organisations are trusting their continued ability to operate to luck, or their employees are simply unaware of what the organisations are doing to stay safe from cyber attacks,” he explains.

Social engineering schemes such as phishing are not only targeting employees, but top-level executives such as CEOs.

Aleron explains: These phishing attacks are becoming more sophisticated and hard to detect at first glance. For example, the CEO might receive an email that looks like it’s from a reputable source, asking the CEO to re-enter their password. Once that’s done, the hacker now has all the credentials they need to enter the network and steal information, sabotage operations, or set the stage for a future attack.

Those high-ranking professionals make worthy targets for hackers because of the information they possess or the mission-critical systems they can access.

However, some C-suite executives do not think they need training or education to spot attacks – this may be because they are too busy with operations, or because they don’t think they would ever fall for an attack.

“This is a risky approach because of the increasing frequency, prevalence, and sophistication of these attacks. All senior business leaders must insist on receiving appropriate training to avoid the nightmare scenario of accidentally compromising their entire business. With the consequences of attacks being far-reaching and, potentially, expensive, security is no longer an IT-only concern. Rather, it’s now a boardroom issue that demands attention at the highest levels,” Morkos notes.

He adds that employees are also fallible targets and can be the top risk factor in organisations.

“A business can have the most advanced security technology in place but if its employees don’t abide by security policies and processes, it will be easy for malicious hackers to get around the technology barriers. All it takes is for an employee to click on a suspicious link, provide their password to a third-party, or insert an infected USB stick into their laptop and the entire organisation could be compromised.” 

“Good corporate security culture starts from the top and trickles down. C-level executives and other business leaders must show their teams they are committed to security. They must then invest in ongoing education for themselves and their staffs to keep the organisation safe. This issue has never been more urgent as the threat landscape continues to expand and worsen. Companies must act now,” Morkos concludes.

Story image
Claroty discovers vulnerabilities in Ovarro TBox RTUs
The vulnerabilities could enable attackers to break into the systems and run code, crash systems, and meddle with configuration files, amongst other malicious actions.More
Story image
AvePoint brings Salesforce Cloud Backup to channel partners
The product adds to the AvePoint suite of trusted Cloud Backup for Microsoft 365 and Dynamics 365 to provide managed service providers with backup and restore capabilities across multiple, popular SaaS providers.More
Story image
WatchGuard uncovers top cyber threat trends of Q4 2020
“The rise in sophisticated, evasive threat tactics last quarter and throughout 2020 showcases how vital it is to implement layered, end-to-end security protections."More
Story image
Mobile devices biggest enterprise security threat - report
Businesses have left themselves vulnerable and open to cyber criminals in the rush to ensure their workforce could operate remotely during the Covid-19 pandemic.More
Story image
A/NZ businesses increase spend on cybersecurity in wake of COVID-19
Despite organisations cutting spending in many areas during 2020 due to the impact of COVID-19, security remains a consistent area of increased investment.More
Story image
Infrastructure-as-code, and how it can secure the cloud
Bridgecrew recognised IaC early on as one of the best ways for modern teams to delegate security ownership to individual contributors while distributing it across existing frameworks within CI/CD pipelines. This attribute meant that IaC was invaluable in securing cloud-native environments.More