EDITOR ’ S question
CHRISTIAAN BEEK , SENIOR DIRECTOR THREAT ANALYTICS , RAPID7
robust defence against social
A engineering requires a comprehensive strategy that strikes the right balance amongst people , processes and technology . To do so , a culture of security is key . This is where security becomes entrenched in the dayto-day functioning of a business to create a domino effect in encouraging individuals to understand their security responsibilities and by adopting a collective responsibility towards security .
The primary focus must lie in developing awareness amongst individuals regarding the intricacies of social engineering , in terms of how it operates and unfolds . This should be done through fostering a culture of security . Leadership must set the tone and implement a trickle-down effect by exemplifying security consciousness and communicating regularly about potential and emerging threats .
A Chief Security Officer ( CSO ) who is both aware and visible is vital in furthering this cultural shift . It needs to be made known that it is okay for staff to have gaps in their knowledge , and asking questions should be encouraged to help establish an environment conducive to security
Leadership must set the tone and implement a trickle-down effect by exemplifying security consciousness and communicating regularly about potential and emerging threats . consciousness . We all have to be aware that we ’ ll make a mistake at some point , so encouraging openness should be key . This human element has to be recognised as crucial in defending against social engineering . Individuals must align with and buy into the technological measures implemented . The efficacy of security measures is wholly dependent on the collective commitment , vigilance and understanding of the organisation .
Education is an exercise which needs to be under constant review to make sure it is kept up to date . Annual training sessions – a staple in many organisations – must be regularly updated to keep pace with the dynamic threat landscape .
Annual training must sit alongside proactive measures such as phishing simulations to keep a workforce alert to potential social engineering risks . Creating a culture of security is reliant on productivity and a consistently vigilant workforce . This training must be upheld by a robust reporting mechanism . Heightened awareness should be complemented by a system that aids the reporting of suspicious activities . Simplicity and repetition play a key role here so that security measures stay top of mind for all individuals within the organisation without alienating staff . Good security equates to simple security . This comparison is seen by deploying a button that can be pressed whenever a suspicious threat is noticed , rather than enforcing email-based reporting which causes inefficiency and confusion .
Striking a balance between stringent security measures and user-friendly practices is paramount . A holistic defence against social engineering encompasses the continuous integration of education , a culture of security , technological fortifications and strategic leadership . This is vital in organisational resilience and boosting an organisation ’ s ability to navigate evolving cyberthreats .
28 WWW . INTELLIGENTCISO . COM