nVisium released the findings of their recent research
which explores the current state of cybersecurity awareness and security
training initiatives within today's remote workforce. The research reveals that
only 35% of respondents classify security awareness training as a ‘top
priority' while working remotely, and nearly half say that their DevOps teams
are not experts in understanding how to protect at home wireless networks.
Approximately 250 responses were analyzed and the results
revealed that many organizations do not fully comprehend the critical need for
implementing continuous security training initiatives, particularly during a
time where corporate network attack surfaces are increasing and being exposed
to millions of new endpoints. As remote working continues in prominence, IT
teams must also have the skills and ability to implement the appropriate
security measures to support this. However, nVisium's research reveals that
only 18% of respondents deliver company-wide standard monthly reports on the
latest security breaches and exploits, while a startling 40% say that their
organization's developers are not experts in cybersecurity.
Some other key findings from nVisium's research include:
- Nearly 60% of
respondents say that their organization's cybersecurity training investment
costs have either decreased or stayed the same since the start of remote
working.
- Less than 30% of
respondents say that integrating security tools and processes throughout the
DevOps pipeline is a top priority.
"Our research highlights and proves the current gaps in
security training initiatives, which exist across organizations globally," said
Jack Mannino, CEO at nVisium. "To be truly successful at security,
organizations must implement training programs that focus on building the
skills needed to secure the full development lifecycle and keep pace with
emerging trends and best practices. Achieving optimum security is a continuous
journey, not a destination."
"Most vendors offer courses on working securely away from
the office, and many have updated their training content to specifically
address the working from home challenges of COVID-19,"
said Lisa Plaggemier, Chief
Strategy Officer at MediaPro. "However, training is
just one piece. To raise awareness, use articles in the company
newsletter, infographics, and messaging on company social channels."
Plaggemier continued, "Also, be mindful of the tone of your communications.
With the pandemic, we're all in an incredibly stressful situation, and many
employees are working more hours than ever before. They've proven
incredibly resourceful at getting their jobs done in the face of numerous
personal and business obstacles. So when providing employees security advice,
be positive. Be informative, not dictatorial. Provide advice on what they
can do to protect themselves and the organization, not just a list of what not
to do."
"The best
security policies are under constant review and take into account ongoing
feedback," added Steve Durbin, managing
director of the
Information Security Forum. "Archaic policies are quickly retired. Success lies in
explaining how a policy can benefit both the enterprise and the
individual. Awareness programs that fail to do this are destined to end
badly. In this age of hybrid working, employers need to re-assess
security risks at the personal access level and keep the following areas under
constant review:
- Mobile devices
- Internet connected devices
- Cloud access and storage
- Third party providers
By helping
staff understand how vulnerabilities can lead to poor decision making and
errors, organizations can better manage security risks. To make this happen, a
fresh approach to information security is required which goes far beyond simple
policies. A human-centred approach to security can help organizations to
significantly reduce the influence of cognitive biases that cause errors. By
discovering the cognitive biases, behavioral triggers and attack techniques
that are most common, tailored psychological training can be introduced into an
organization's security awareness campaigns. Technology, controls and data can
be calibrated to account for human behavior, while enhancement of the working
environment can reduce stress and pressure."
To learn more about nVisium's training solutions or request
a demo of the DevSec Mentor platform,, please visit: https://nvisium.com/