First, it's important to highlight cyber hygiene. It's easy to say that staff is the weakest link because they click on links in phishing emails, but I take the opposite view. Staff can and should be your first line of protection. Every organization should have employee training programs that are interesting and easy to use. With an alert set of employees, you can avoid many of the attacks that try to get into your environment. Fortinet has free NSE training to help people recognize the social engineering tools and techniques that are successfully used by cybercriminals.
When people talk about security, they usually focus on technology, but it's also a question of psychology. It's essential to get everyone to realize that they are potential victims of cybercrime at any time. Then they can recognize suspicious activity and emails more readily. I liken it to being aware when you're traveling in an unfamiliar location. If you're smart, you don't go waving your cash around for every criminal to see. You're discreet and aware of your surroundings.
Of course, organizations also need to set up a technology barrier. Most ransomware enters the environment via email. Even if you have staff trained to recognize social engineering, it's still possible that some form of phishing or, more likely, spear-phishing email can get through. Spear phishing is more difficult to spot because it looks like something from someone you know. Organizations should invest in email protection to back up staff and act as a solid second line of defense.
Ricardo: CISOs should be holistic in their security posture, meaning that processes and people should be a major focus of the information security program. Almost half of the organizations that are hit by ransomware and pay the ransom, are hit again. Not only does paying a ransom encourage copycat crimes, but there’s no guarantee of a swift return to business-as-usual. Cybereason found that in nearly half (46%) of cases, the victim organization regained access to data following payment, but some or all of it was corrupted. This datapoint highlights that there was little change to the process and technology that led to the original compromise.
Another key aspect is to deploy socio-behavioral principles to introduce cybersecurity. Gartner suggested that by 2025, 40% of programs will deploy socio-behavioral principles (such as nudge techniques) to influence security culture across the organization, up from less than 5% in 2021.