Staying cybersecure in the workplace

By Kevin Curran, IEEE senior member and professor of cybersecurity at Ulster University

The internet is an essential tool for organisations and individuals within almost every industry. This year has seen a huge acceleration in digital transformation, with many of us having to utilise technology more than ever before. Although this has been a positive in many ways, it means that many of us are now more vulnerable to data security breaches. Recent research1 has shown that many network breaches are caused by email phishing, which has increased by 350 percent in just one year. Another huge concern for companies is ransomware. Further research2 has found that in Q3 of 2020, there was a 50 percent increase in the daily average of ransomware attacks, compared to the former half of the year. 

Cybercrime is a global threat, and cybercriminals are rapidly becoming more organised and savvier towards consumer behaviours. Cybercrime units have been created to carry out a variety of roles which most would typically associate with legitimate businesses. The departments in these units include partner networks, associates, resellers, and vendors. There are, of course, sophisticated methods such as encryption, dark web forums and other private networks in place, which allow them to remain anonymous. With franchises that enable other hackers to replicate botnets and vectors of compromise and cybercrime recruit in place, it is safe to say that cybercrime has become an industry of its own. It is inevitable that organisations will start to address cybercrime more seriously by ensuring the correct measures are in place, both for remote and office working.

Keeping employees in the know

It is an employer’s duty of care to ensure members of staff are trained on a variety of security practices. These include recognising email phishing, data sharing best practices, keeping software updated and understanding the importance of strong passwords. If employees are educated on the dangers at hand, companies are at a far lower risk of being targeted. Some companies undergo a movement whereby fake phishing emails are sent to employees, containing links. When these are clicked and activated, they lead to a site telling employees about their mistake. This method can be eye-opening but does not count as nearly enough sufficient training. Employee training is absolutely essential, especially if the company holds personal information and finance or health data.

Cybersecurity by design

A quick fix for any organisation could be a ‘cybersecurity by design’ framework. This could act as a holistic set of pragmatic guidelines on the full remit of protective processes that deals with cyber threats. By incorporating ‘cybersecurity by design’, a number of core principles are provided within the business, ultimately making detection of threats much easier. With this framework implemented, businesses can collect all relevant security events and logs, design simple communication flows between components and detect malware command and control communications. All of this will make it difficult for attackers to detect security rules through external testing and react to the abnormal traffic more rapidly.

Data protection in the workplace

All aspects of data protection need to be considered in the workplace. For example, companies need to ensure they are analysing the security of locations employee access such as data storage and backups, network security, compliance, and recovery procedures on all internet of things (IoT) devices. Software can easily be forgotten about or neglected, but it is essential that it is audited regularly and followed by a security architecture survey. By incorporating this, it will form a larger risk analysis of a company’s infrastructure. In addition, senior IT management staff should have a more holistic approach to cybersecurity as an organisational-wide risk issue and ensure there is enough focus on legal implications while identifying which risks to avoid, accept and mitigate.

A collective concern

Last year, the IEEE conducted a global survey3, whereby chief information officers (CIOs) and chief technology officers (CTOs) were questioned on what they considered to be the top priority or concern for their business following the pandemic. This was carried out across five geographic regions, including the United Kingdom, the United States, Brazil, China, and India. In total, the IEEE collected responses from 350 CIOs and CTOs. While the survey outlined a number of key issues, there was one which remained a priority for all respondents – cybersecurity. Across every region, 11 percent of respondents agreed it was the biggest challenge to overcome. The data from this survey suggests employers will soon implement serious measures around cybersecurity in the workplace. 

As we delve further into 2021, security software will remain an essential tool within every workplace. Now is the time for companies to ensure those who use security software fully understand how to utilise it and why it is needed in both the short and long term. It is more crucial than ever for activity-monitoring tools to be implemented, so threats are detected before any serious damage is done.