Latest / Tech Talks With Kinsoft / Enhancing Cybersecurity Through Effective Awareness Training

Transcript

Enhancing Cybersecurity Through Effective Awareness Training · Tech Talks With Kinsoft

• 0:00
  Welcome to Tech Talks with Kinsoft. We're here
• 0:02
  to help you cut through the noise and really
• 0:04
  get to the heart of what matters in this fast
• 0:07
  -paced world of tech. Today, we're tackling a
• 0:10
  topic that, well, it often gets overlooked, but
• 0:12
  it's arguably the most critical piece of cybersecurity.
• 0:15
  We're talking about the human element. That's
• 0:17
  exactly right. We hear so much about, you know,
• 0:20
  these super sophisticated cyber attacks, right?
• 0:22
  Complex stuff. But the surprising truth and what
• 0:25
  we're going to dig into today is that the biggest
• 0:28
  vulnerability often just, well, walks right in
• 0:30
  the front door. Or maybe more often now, logs
• 0:33
  in from home. We'll be exploring why people are
• 0:35
  both a company's greatest asset and its biggest
• 0:38
  cybersecurity risk. Yeah. And we've gathered
• 0:40
  some really fascinating insights for you. We
• 0:43
  looked at cybersecurity experts, industry reports,
• 0:45
  even some government guides. So our mission today
• 0:48
  is to unpack those. honestly startling statistics
• 0:52
  behind human error and data breaches, and then
• 0:55
  crucially show you how organizations are trying
• 0:58
  to flip that script, turn people from, you know,
• 1:01
  potential weak links into their strongest defense.
• 1:04
  Get ready for maybe some aha moments that might
• 1:07
  just change how you think about digital security.
• 1:09
  So let's unpack this a bit. You might invest
• 1:11
  in the absolute latest firewalls, the best antivirus
• 1:14
  software, but what if the biggest threat isn't
• 1:17
  some, you know, shadowy hacker collective, but
• 1:19
  just A single misclick. Is it really that simple
• 1:22
  sometimes? It's not just simple. It's overwhelmingly
• 1:25
  the case. The data is quite stark, actually.
• 1:28
  Study after study, sources like InfoSecurity
• 1:31
  magazine and others, they consistently show that
• 1:33
  a staggering 90 to 95 percent of cybersecurity
• 1:36
  breaches, they're tied back to human error. 95
• 1:38
  percent. Yeah. I mean, this isn't just a small
• 1:40
  factor. It's the dominant cause. Wow. So it's
• 1:43
  almost always involved. Pretty much. Think about
• 1:45
  almost any major breach you read about. Chances
• 1:49
  are there was a human moment, an error, right
• 1:52
  at the core of it somewhere. When we talk human
• 1:54
  error, I guess the classic example comes up,
• 1:56
  right? Fishing. And here's where it gets really
• 1:59
  interesting for me. The Verizon Data Breach Investigations
• 2:02
  Report, year after year, points to phishing as
• 2:05
  the number one threat. Number one. It's so common
• 2:09
  that apparently one in three employees are likely
• 2:11
  to click links in phishing emails. And maybe
• 2:14
  even more worrying, one in four actually admit
• 2:17
  they've clicked on one at work. Think about that
• 2:19
  for your own team. Right. And it's not just about
• 2:21
  the clicking, is it? Our sources show that about
• 2:23
  one in eight employees might actually go further
• 2:25
  and share information if the phishing email asks
• 2:28
  for it. Oh, wow. Yeah. And think about this.
• 2:30
  Nearly half, 45%, admit clicking suspicious emails
• 2:33
  just in case it's important. That FOMO, the fear
• 2:35
  of missing out. Exactly. That fear or just missing
• 2:38
  a critical work thing, it's a huge psychological
• 2:41
  lever for attackers. And add to that, a similar
• 2:44
  number never reports suspicious messages to IT.
• 2:46
  That's, well, it's a massive blank. spot. It
• 2:49
  really is. It means these things can just spread
• 2:51
  undetected. And leads to real consequences. Like
• 2:54
  one stat mentioned 74 % of U .S. orgs had a successful
• 2:58
  phishing attack leading to a data breach just
• 3:00
  in the last year. 74%. That's huge. And attackers
• 3:04
  are getting smarter too, right? They're not just
• 3:05
  sending generic spam anymore. Oh, definitely
• 3:07
  not. They're getting incredibly sophisticated.
• 3:09
  They leverage human psychology using those emotional
• 3:12
  triggers, urgency, fear. Like those urgent account
• 3:16
  issue. emails precisely or impersonating brands
• 3:19
  you trust or even colleagues they use publicly
• 3:22
  available info sometimes to make it look incredibly
• 3:25
  real and the attachments the links they look
• 3:27
  totally legitimate makes it really hard not to
• 3:29
  click sometimes and now there's ai getting involved
• 3:32
  yeah that's the uh the newer, perhaps more concerning
• 3:35
  development. We're seeing the rise of AI -generated
• 3:38
  phishing attempts. As of, well, fairly recently,
• 3:41
  March 2025, the data suggested AI is about 24
• 3:45
  % more effective than humans at actually crafting
• 3:47
  these messages. 24 % more effective. Because
• 3:50
  they can often bypass the traditional filters,
• 3:53
  they're grammatically perfect, contextually appropriate.
• 3:56
  You know, all those little telltale signs we
• 3:58
  used to look for, the weird phrasing, the typos.
• 4:01
  Yeah, they're gone. Pretty much gone. Which means
• 4:03
  recognizing the really subtle cues, understanding
• 4:06
  the context, just having that slightly heightened
• 4:09
  sense of vigilance. It's more vital than ever.
• 4:12
  That gut feeling becomes more important. It really
• 4:14
  does. That smell test because the obvious flags
• 4:17
  are just disappearing. Okay. So with these external
• 4:21
  attacks getting so clever, exploiting our psychology,
• 4:24
  using AI. It really shines a light on another
• 4:27
  critical area, doesn't it? The insider threat.
• 4:31
  And this isn't just like spies or disgruntled
• 4:34
  employees planting bombs, right? It's broader
• 4:35
  than that. Exactly. It's much broader. CISA,
• 4:38
  the Cybersecurity and Infrastructure Security
• 4:40
  Agency, their guide defines an insider pretty
• 4:44
  clearly. It's basically any person who has or
• 4:47
  had authorized access or knowledge of an organization's
• 4:50
  resources. Resources meaning? Meaning personnel.
• 4:54
  Facilities, information, equipment, networks,
• 4:57
  systems, everything. These are people the organization
• 5:01
  explicitly trusts. Employees, sure, but also
• 5:04
  former employees, contractors, vendors, anyone
• 5:08
  inside that trust boundary. Okay. And the threat
• 5:11
  isn't always malicious intent, is it? You mentioned
• 5:14
  a key distinction. Right. Accidental versus intentional.
• 5:17
  That's crucial. It's not always someone plotting
• 5:19
  something nefarious. So what does an accidental
• 5:21
  threat look like? Well, look, even the best employee,
• 5:24
  the most careful person can make a mistake. It
• 5:26
  could be simple, like mistyping an email address
• 5:29
  and sending sensitive data, maybe a customer
• 5:31
  list out to a competitor by accident. Ouch. Yeah.
• 5:34
  Or, you know, they get a really convincing phishing
• 5:36
  email. It slips past their training and they
• 5:38
  click the link. Or even something physical, like
• 5:40
  not shredding sensitive documents properly. And
• 5:43
  curiosity. That's a big one. Finding a USB drive
• 5:46
  in the parking lot. Someone plugs it in just
• 5:48
  to see what's on it. Exactly. And an attacker
• 5:50
  might have left it there precisely for that reason.
• 5:53
  So these accidental things, you can't completely
• 5:56
  prevent them, maybe, but you can definitely mitigate
• 5:59
  the impact with the right procedures and awareness.
• 6:02
  Right. But then there are the intentional threats.
• 6:04
  Those seem scarier. What drives those? It really
• 6:08
  varies. Sometimes it's for personal gain, like
• 6:10
  maybe trying to advance their career by stealing
• 6:13
  intellectual property to take to a new job. Financial
• 6:16
  pressure is a big one. Or grievances, feeling
• 6:18
  underappreciated, passed over for promotion,
• 6:21
  unfairly treated. Personal motives, mostly. Often
• 6:23
  personal, yeah. Sometimes it's ego, wanting recognition.
• 6:27
  Occasionally it's even a misguided belief they're
• 6:29
  doing something noble, like whistleblowing inappropriately.
• 6:32
  It's complex human stuff, rarely simple. You
• 6:35
  mentioned a case in American Energy Tech Company.
• 6:37
  That sounded pretty severe. Oh, it was. A really
• 6:40
  stark example. This company lost over a billion
• 6:43
  dollars in shareholder equity. Nearly 700 jobs
• 6:46
  gone. A billion. Because their head of automation
• 6:49
  engineering secretly downloaded proprietary source
• 6:52
  code. Just hooked it. Then passed it to a foreign
• 6:54
  competitor. This was back in 2011. But the legal
• 6:57
  fight dragged on until 2018. Even when they got
• 7:00
  a court order for, I think it was $59 million.
• 7:03
  It sounds like a lot, but compared to the billion
• 7:05
  lost and the jobs, it's a hollow victory. Shows
• 7:09
  the devastation an intentional act can cause.
• 7:12
  Absolutely devastating. And then there was that
• 7:13
  other case, the water reclamation plant employee.
• 7:16
  That seemed driven by something else entirely.
• 7:18
  That's right. Very different motivation. In that
• 7:21
  case, the employee deliberately disabled critical
• 7:23
  systems, caused about $60 ,000 in damages. His
• 7:27
  motivation seemed to stem from financial problems
• 7:30
  mixed with unaddressed depression. And what's
• 7:34
  really key there is that apparently there was
• 7:35
  a pattern beforehand. Increased stress, some
• 7:38
  concerning behaviors. Warning signs were missed.
• 7:40
  Exactly. It just highlights how severe the consequences
• 7:43
  can be when those signs are missed and why organizations
• 7:45
  need ways to support people and address issues
• 7:47
  respectfully. Personal problems can be - become
• 7:50
  security risks. And it's not always just one
• 7:53
  person acting alone, right? You mentioned collusive
• 7:55
  threats. Yeah, that's another layer. Collusive
• 7:58
  threats are where insiders actively work with
• 8:00
  external attackers, often cyber criminals. For
• 8:04
  what purpose? Usually fraud or stealing intellectual
• 8:07
  property. These are tough to spot because the
• 8:10
  external folks are often good at covering tracks
• 8:12
  and the insider provides the crucial in. Makes
• 8:14
  sense. And then there are third -party threats.
• 8:16
  This involves your contractors, your vendors,
• 8:20
  anyone external you grant access to your systems.
• 8:23
  Okay. They might cause harm. directly, maybe
• 8:27
  if they're malicious, but more often it's indirect,
• 8:29
  like their systems get compromised, and that
• 8:31
  gives attackers a way into your network. The
• 8:33
  supply chain risk. Precisely. And those attacks
• 8:36
  are way up. Some reports show supply chain attacks
• 8:38
  jumped like 431 % between 2021 and 2023. It really
• 8:44
  hammers home that your security is only as strong
• 8:46
  as the weakest link in your whole extended network.
• 8:49
  Okay, so given all these risks, Accidental clicks,
• 8:52
  sophisticated phishing, intentional insiders,
• 8:55
  compromised vendors, it feels significant. What
• 8:59
  does this actually mean for strengthening security?
• 9:01
  It sounds like that cybersecurity awareness training
• 9:04
  isn't just a nice -to -have IT thing anymore.
• 9:07
  It feels like a core business necessity, more
• 9:10
  than just checking a box for compliance. Absolutely.
• 9:12
  It's fundamental. It's really about shifting
• 9:14
  the mindset, transforming your team from, you
• 9:18
  know, potential liabilities into your actual
• 9:20
  strongest line of defense. And effective training,
• 9:22
  it's got to go way beyond just don't click bad
• 9:25
  links. It's about building security habits into
• 9:27
  the daily routine, empowering people. Right.
• 9:30
  So if an organization is looking to build out
• 9:32
  or improve their training, what are the really
• 9:34
  key areas sources point to? Well, obviously,
• 9:37
  phishing and email security is foundational.
• 9:38
  Teaching people how to spot those scams, the
• 9:40
  suspicious links. the social engineering tactics.
• 9:43
  But then there's password management. And the
• 9:45
  insight here isn't just use a strong password
• 9:47
  because people hate that. Yeah, the complex ones
• 9:51
  you forget instantly. Exactly. It's more about
• 9:53
  enabling strong security. So encouraging things
• 9:56
  like good password managers and pushing multi
• 9:59
  -factor authentication, MFA. These tools actually
• 10:02
  reduce the friction for users while boosting
• 10:04
  security. Makes it easier to be secure. Okay,
• 10:07
  makes sense. What about just... everyday web
• 10:10
  surfing and devices that's safe internet usage
• 10:12
  and device security so guidance on avoiding risky
• 10:15
  websites being careful with unsecured wi -fi
• 10:18
  huge when people work remotely or travel and
• 10:21
  securing all devices not just the work laptop
• 10:24
  but personal phones if they access work stuff
• 10:26
  strong passcodes encryption also keeping software
• 10:30
  updated those patches often fix critical security
• 10:33
  holes right the updates we always click Remind
• 10:36
  me later on. Ah, yeah, those ones. Then there's
• 10:38
  data protection itself. This isn't just reciting
• 10:40
  regulations like GDPR. It's teaching practical
• 10:43
  steps, how to handle sensitive data, how to classify
• 10:46
  it, maybe understanding the real world impact
• 10:49
  if it leaks, instilling that sense of responsibility
• 10:51
  for the data. Got it. And physical stuff, too.
• 10:53
  You mentioned USBs earlier. Yep. Removable media
• 10:56
  security. highlighting the very real risks of
• 10:59
  plugging in unknown USBs, even those promotional
• 11:02
  giveaways you get at conferences. Good training
• 11:04
  often includes practical demos showing just how
• 11:07
  easily a system can be compromised by one of
• 11:09
  those. Makes it stick. So it's blending the digital
• 11:12
  and physical environment awareness. Precisely.
• 11:15
  Which leads to things like a modern clean desk
• 11:17
  policy. Not the old rigid rules, but adapted
• 11:21
  for today's workplaces, home offices, open seating.
• 11:25
  It's about making secure habits routine, like
• 11:27
  securing sensitive papers quickly, maybe using
• 11:30
  subtle nudges or reminders, not just rules. In
• 11:33
  minutes, not hours, as one source put it. Yeah,
• 11:35
  exactly. And finally, environmental security.
• 11:38
  Just being aware of those low -tech physical
• 11:40
  threats right there in the office. Things like
• 11:42
  tailgating someone slipping in the door behind
• 11:45
  you without badging in. Or shoulder surfing someone
• 11:47
  literally looking over your shoulder at your
• 11:49
  screen or keyboard. Simple but effective if people
• 11:52
  aren't vigilant. Okay, so there's a lot to cover.
• 11:54
  But it's not just what you train on. It's how,
• 11:56
  isn't it? I imagine those generic hour -long
• 11:59
  once -a -year videos don't really cut it. Oh,
• 12:01
  they really don't. The delivery is absolutely
• 12:03
  key to making it effective. It has to be personalized.
• 12:07
  It has to be engaging. Think about that mandatory
• 12:10
  training, boring video, tedious quiz. People
• 12:14
  just click through. The results are forgettable.
• 12:17
  The best approaches, the best platforms, they
• 12:19
  adapt. They look at the employee's role, their
• 12:22
  current skill level, how they learn best. Keeps
• 12:24
  everyone challenged but not overwhelmed or bored.
• 12:27
  That personalization is vital because people
• 12:29
  have different tech skills, different priorities
• 12:32
  day to day. It needs to feel relevant to their
• 12:34
  job. Exactly. And that's where we get into behavioral
• 12:37
  science, isn't it? Right. This isn't just about
• 12:39
  knowing stuff. It's about changing what people
• 12:42
  actually do. Habits. Precisely. And that's the
• 12:45
  real aha moment for a lot of organizations. Security
• 12:48
  isn't just knowledge, it's ingrained habits.
• 12:51
  So using behavioral science techniques, that's
• 12:53
  changing the game. Things like immediate feedback
• 12:56
  loops and training simulations, gamification
• 12:58
  elements making it a bit competitive or fun,
• 13:01
  and micro -learning, breaking down big topics
• 13:03
  into small, practical, digestible chunks. Easier
• 13:06
  to remember. Yeah, it helps fight that forgetting
• 13:08
  curve, you know, where we naturally forget most
• 13:10
  of what we learned shortly after learning it.
• 13:12
  So training... needs to be concise, continuous,
• 13:15
  maybe integrated into the workflow somehow, not
• 13:18
  just a big annual dump of information. That's
• 13:21
  how you get real lasting behavior change. And
• 13:24
  leadership has to buy in, right? It can't just
• 13:26
  be an I .T. initiative push from the side. Absolutely
• 13:29
  essential. Leadership has to champion this stuff.
• 13:32
  They need to set the expectation. Cybersecurity
• 13:35
  is everyone's job. From the top down. Walk the
• 13:38
  walk. Exactly. Model the behavior and crucially,
• 13:41
  find ways to acknowledge and maybe even reward
• 13:44
  good security practices and compliance, not just
• 13:47
  punish mistakes. That positive reinforcement
• 13:49
  can massively boost motivation and morale. It
• 13:52
  builds a culture where people feel safer reporting
• 13:54
  things, even their own mistakes, without fear.
• 13:57
  Okay, that makes sense. Fostering a positive
• 13:59
  security culture. Now, technology can help too,
• 14:02
  right? We hear about tools like user activity
• 14:04
  monitoring, data loss prevention. They definitely
• 14:06
  play a supporting role. Yeah. Tools like user
• 14:09
  activity monitoring, UAM that helps flag unusual
• 14:13
  employee behavior that might signal. a threat,
• 14:15
  internal or external. And data loss prevention,
• 14:19
  DLP, those tools are designed to stop sensitive
• 14:22
  data leaving the company through unauthorized
• 14:24
  routes. They can absolutely help detect anomalies,
• 14:27
  but, and this is the critical point, they only
• 14:30
  enhance human capabilities. They don't replace
• 14:32
  them. They need people to interpret the alerts.
• 14:34
  Exactly. You need skilled analysts to look at
• 14:37
  the data, understand the context, decide if it's
• 14:40
  a real threat or false alarm, and figure out
• 14:42
  how to respond. And these tools work. work best
• 14:45
  when employees know they're there and importantly,
• 14:47
  understand why they're there for collective protection,
• 14:50
  not just Big Brother watching. So they supplement
• 14:52
  human judgment. They don't substitute for it.
• 14:54
  Perfectly put. They supplement. They don't replace
• 14:56
  human vigilance. Human judgment remain key. So.
• 15:01
  Just to summarize, really, while the threats
• 15:03
  keep evolving, getting more sophisticated hackers,
• 15:05
  insiders, AI phishing, all of it, the human element,
• 15:09
  it's still absolutely central to your security
• 15:11
  posture. By investing in smart, engaging, continuous
• 15:14
  training, you really can transform your employees.
• 15:16
  Turn them from that potential weak link into
• 15:19
  your most resilient, most adaptable defense.
• 15:21
  It's a holistic approach. Prevention, protection,
• 15:24
  mitigation. Yeah, and that really shifts the
• 15:26
  perspective, doesn't it? It's not just about
• 15:28
  ticking that compliance box anymore. truly embedding
• 15:31
  security into the culture, into the fabric of
• 15:33
  the organization, building a place where everyone
• 15:35
  understands their role, their responsibility
• 15:38
  in protecting critical assets takes ownership.
• 15:41
  Precisely. And the goal isn't about assigning
• 15:43
  blame when something goes wrong. It's about empowerment,
• 15:47
  empowering every single person to spot potential
• 15:50
  threats, to report them, fostering that safe,
• 15:53
  secure environment. And also understanding, you
• 15:55
  know, that journey from trusted insider to potential
• 15:57
  threat. It's often a process that might be observable
• 15:59
  signs, behavioral patterns. If those are recognized
• 16:02
  early, maybe intervention is possible before
• 16:05
  a breach happens. Right. Prevention over reaction.
• 16:07
  Now is the goal. So as we wrap up this Tech Talks
• 16:10
  with Kinsoff. discussion, maybe here's something
• 16:12
  to think about. If, let's say, 95 % of breaches
• 16:16
  involve human error and attackers are getting
• 16:19
  better and better at exploiting our psychology
• 16:21
  using AI, consider this. What seemingly innocent
• 16:24
  or just routine digital habit are you, or maybe
• 16:27
  the people around you, doing every single day?
• 16:29
  Could that be the next subtle yet significant
• 16:31
  gateway for a cyber attack? That's definitely
• 16:34
  something to ponder until next time on Tech Talks
• 16:36
  with Kinsoft.