- Security TWENTY
- Women in Security
Most companies assign their own Tech Support Department to train company employees in matters of IT security, rather than hiring outside IT consultants or security professionals. This is according to the B2B International and Kaspersky Lab, Global Corporate IT Security Risks 2013 survey
IT security training for employees is a key component of any strategy to combat cyber threats, Kaspersky claims – according to the survey, four out of five of the most common internal security incidents recorded in the past 12 months were directly linked to staff actions:
· 32 per cent of respondents reported accidental leakages of confidential data
· 30 per cent of respondents reported employees losing corporate mobile devices with critical data stored on them
· 19 per cent of companies encountered intentional staff-facilitated data leakages
· 18 per cent of companies had dealt with incidents when confidential data got into the wrong hands due to the improper use of mobile devices (via a mobile email client, text messages, etc).
Research repeatedly shows that unintentional staff errors are behind a significant proportion of critical data leaks and IT security incidents. The key to addressing this challenge lies in ensuring that end users are adequately informed of IT security risks – and how best to avoid them.
While this clearly illustrates the importance of employee education in IT security, the question remains: who should provide that training?
Most companies say that an organisation’s in-house IT department should train company employees in IT security matters — even though staff education is not one of the key functions of IT. This additional workload affects performance: respondents noted that IT departments have other important tasks and typically do not have time to educate their co-workers. Obviously, this can have a negative impact on the quality of training. A better outcome Kaspersky suggests can be delivered by commissioning a third-party IT consultant with the requisite training expertise. However, only 12 per cent of respondents reported having done so.
HR is involved in employee training at 8 per cent of the companies that took part in the survey. A similar number of companies delegate this matter to an Employee Training and Development Department. Roughly three per cent of respondents reported that they commission an outside corporate training provider.
These figures are more or less the same across regions, with some minor differences: for example, the highest percentage of companies assigning IT security training to their in-house IT Departments are countries located in the Middle East (73 per cent), Japan (72 per cent), and North America (71 per cent). External IT consultants are most often hired to train company employees in South America (16 per cent) and Asia-Pacific.
In general, the importance of employee education in IT security is acknowledged by the overwhelming majority of companies — only four per cent of survey respondents stated that their companies do not train their staff in IT security at all. However, the quality of corporate education is open to question; after all, employee awareness about cyber threats has a direct impact on the extent to which a company’s IT security policies are followed and, as a result, on the overall degree to which a company is protected against cyber threats. Presently, the extent to which policies are being enforced is relatively low, with approximately 39 per cent of survey participants indicating that company employees do not always respect or diligently adhere to corporate IT security rules.
Incidentally, no matter how alert and well-informed the staff, the risk of a successful cyber-attack against a company remains high, and the use of advanced corporate IT infrastructure security solutions is critical.
Kaspersky Endpoint Security for Business
Another technology offered in Kaspersky Endpoint Security for Business that works to prevent incidents stemming from employee errors: Dynamic Whitelisting. This technology prevents malware from launching. Whitelisting solutions are based on the program’s own database of trusted applications, and permit the operating system to launch only those programs included in the Whitelist database. This makes it difficult to launch a successful attack against a company even with highly complex malicious programs that might not yet even be known to antivirus solutions.
At the same time, it is crucial that the Whitelisting database in the solution is large enough to encompass the maximum number of applications used by a company without creating problems for legitimate programs. For example, Kaspersky Lab’s Dynamic Whitelisting database contains over 700 million unique files, and is regularly updated with new files.