Employees Prove to be the Best Firewall Against Cybercrime

Posted by Selina Coen on Tue, Sep 5th, 2023

The old saying "one for all, and all for one" captures the importance of working together as a single unit. It's common knowledge that if everyone pulls together, even the most difficult tasks can be made easier. A collaborative effort is also essential in cybersecurity. The notion of a "human firewall" has gained popularity as traditional firewalls struggle to contain human-centric cyber-attacks. Here, TitanHQ explains why our employees are a vital resource in the fight against cyber-attacks and how security awareness training will help build a human-powered firewall.

Why are Humans at the Center of Cyber-Attacks?

Scams and psychological tricks have been part of human life as far back as historical records. Frank Abagnale, one of the most infamous human-centric hackers, made famous by the film "Catch Me If You Can," used human behavior to trick his victims into doing what he wanted. Modern cybercriminals do the same thing, except they use technology, such as emails, to manipulate people.

As technology has become integrated into everything we do, digital systems have had to adapt to human operators. As part of this adaptation, the human-computer interface (UI/UX - user interface and user experience) has become more intuitive. System designers have modified computer interfaces to move towards a more seamless UX by making navigating devices, apps, and the internet more accessible. Methods such as the "1-click to buy," made famous by Amazon, changed the expectations of how we should interact with computer interfaces. This has imbued an "urge to click" that cybercriminals take advantage of when they send out phishing emails. Other behaviors, like the fear of missing out (FOMO), concern and worry, and wanting to do a good job, are also manipulated by fraudsters. The result is a tsunami of human-centric cyber-attacks.

The statistics speak for themselves. Human-centric cyber-attacks are so effective that social engineering and phishing are now the most common attack methods and vectors. Research from IBM's X-Force Threat Intelligence Index 2023 found that phishing is the top initial access vector, being involved in 41% of incidents, and 62% of those were the more targeted form, spear phishing. Other research, such as the Verizon 2023 Data Breach Investigation Report (DBIR) that focuses on data breaches, bears out these figures. The DBIR found that social engineering has doubled since the previous year and that 74% of attacks involve human interaction, such as errors, misuse of access, etc.

The results of human manipulation and trickery are financial losses, data theft, and ransomware. Business Email Compromise (BEC), whereby a scammer poses as a high-level executive, has been called the "The $43 Billion Scam" in the USA by the FBI.

The reasoning behind making your employees the best firewall comes from these findings. Fighting fire with fire means a business must empower its employees with the know-how to thwart cyber criminals who would otherwise exploit their behavior.

How Can Your Employees Become Your Best Firewall?

Security awareness training provides the baseline to encourage and reward positive security practices. However, fear tactics have been shown to turn employees off training. The UK's National Cyber Security Center (NCSC) has this to say about developing a favorable security position: "A positive cyber security culture is essential because it's people that make an organization secure, not just technology and processes."

Creating this positive cybersecurity culture comes from a deep understanding of how people, including cybercriminals, behave. Some tips for creating effective and positive security practices that build a human-centric firewall include the following:

Carrot Not Stick

One of the most comprehensive studies into incentivizing behavior in the workplace found that only 8% of employees did not improve their behavior with incentives. Therefore, reward, do not punish, is the name of the game in practical cybersecurity awareness training. Use a reward system that recognizes positive behaviors that lead to reduced cyber threats. Find incentives that work for your company and your employees that demonstrate a job well done. 

Gamify to Engage

Even as adults, people love to play: Boring, 'click next' security awareness content is less likely to result in behavioral changes. A better way to help security awareness education stick is to make it fun and engaging. As your employees move through gamified training material, their knowledge of how cybercriminals operate will improve, and their understanding of preventing an incident will become more effective. 

Phish to Learn

Phishing simulation platforms should be used to drill down on the tricks of the phishing trade. Advanced phishing simulation platforms will use automation and AI to create phishing and Smishing simulations that reflect your employees' roles and the attacks they are likely to encounter. This focused and individualized training will be more effective in creating a cohesive, well-informed team of employees who understand how phishing emails and messages are used to manipulate behavior.

Use Behavior-Driven Security Awareness Training

Remember to underestimate the power of people. A behavior-driven approach to security awareness uses human psychology to adapt learning materials to changing behavior, helping to improve that behavior over time. Advanced security awareness training solutions adjust as employees learn, providing in-training feedback that allows the trainee to understand where to make positive changes. As the training continues, employees see how it makes a real difference in their ability to identify security risks. This is one of the most cost-effective ways to improve the overall security posture of an organization and one that cements the human firewall.

Inspire Your Employees to Work Together to Stop Cyber-Threats

Using a security awareness training solution that employs modern behavior-driven techniques to empower employees, your organization will imbue your people with the knowledge to stop cyber-attacks. The tone for change must come from the top. Often at the forefront of a BEC attack, senior executives must encourage and promote employee education around cyber risks. Working together, the entire company will have the deep know-how about how cybercriminals operate to stop them in their tracks, acting as a collaborative unit and being the best type of firewall.

SafeTitan is a behaviour-driven security awareness training solution that helps employees to become part of a cohesive team to fight cyber-attacks. Book a free demo of SafeTitan to see how to build a human firewall.