At the end of May, a fake telegram appeared on the PAP website, which was soon revealed by the state services as the result of a hacker attack on the agency. Since then, the topic of cyber security has boomeranged in the media. This is not surprising – state institutions, private companies and we ourselves as individuals are equally exposed to cyber attacks. And the consequences of leaking confidential data can be catastrophic.
That’s why it’s so important to ensure that all employees are properly prepared to work in the online environment, especially in the context of remote work, which is still extremely important. However, as the authors of the new report “Identifying Cyber Risk Factors in Hybrid Workforce Environments,” prepared by Kozminski University, note, many companies still ignore digital threats.
A report by the European Union Agency for Cybersecurity (ENISA) shows that only 7 percent Polish companies give priority to cybersecurity issues. This is a much weaker result than the average for the entire European Union, which according to ENISA is 32 percent.
Read also: The government has decided to liquidate the Cybersecurity Center. This is the result of the Ministry of Justice’s control
Companies and employees ignore the issue of cybersecurity
Employees also follow the risky approach of employers. According to the findings of researchers from Kozminski University up to 52 percent Poles are not careful online when working remotely or in a hybrid way. Furthermore, from this group it is necessary to distinguish 19%, the percentage of people who knowingly expose their employer to cyber threats. Does this mean that we have a specific cybersecurity problem in our country?
– We believe that Poles are no different from other nations in this regard. We have at our disposal the same technology that the French, Canadians and Americans use. However, people differ from each other. Our research shows that there are four profiles of employees based on their approach to digital threats – said Dr. Karolina Małagocka in an interview with Wirtualnemedia.pl.
These four groups include: risk-seeking workers (19%), careless workers (33%), cautious workers who are not aware of the risk (16%) and people who use the Internet wisely and consciously (32%).. The group that is potentially dangerous for employers therefore includes more than half of those surveyed. However, according to the researchers, this should not lead us to the conclusion that all the blame for a possible cyberattack lies with employees.
– It’s been a while we try not to treat employees as the “weakest link in the chain” and the source of problems. We want the technology around us to be a friendly environment, so that no one feels that the human-computer relationship is failing. However, there is also the other side of the coin. For it to work this way, employees must be equipped with appropriate knowledge and tools. Often these opportunities are missed. Either no one has trained them or no one has told them how it works and what the threat really is – explains Dr. Karolina Małagocka.
– It is obvious that the two most vulnerable groups stand out the most. However, there are actually more than 65% of people who need to be educated. From the point of view of proper management of employees during remote work, this is actually an optimistic conclusion. These people need to be equipped with the right tools or simply expand their knowledge. We can do a lot in this regard not only through training, but also, for example, through VPNs. We must remember that there are many employees in the market who do not need to interact with a computer on a daily basis. Sometimes body-centric thinking dominates, but… 99.8 percent Polish companies are micro, small and medium-sized enterprises – notes Zofia Przymus, MA.
Security leaders and extreme risk takers
Researchers from Kozminski University do not hide the fact that lumping all employees into one basket is a serious problem and, contrary to what it may seem, contributes to the creation of an environment prone to threats. In reality, people are very different and require a slightly different approach. Proper identification will help us not only identify the most responsible employees who can be leaders, but also identify those who have the riskiest behavior and require additional monitoring.
– There are people who have a natural tendency to ignore various types of warnings. I’m not talking about saboteurs or people who knowingly act to the detriment of their employer. I’m talking about people who have an attitude called: “This risk doesn’t concern me.”. I’m not saying they should be restricted, but they should be aware that they are being constantly monitored. If they expose the company to costs related to a cyberattack or even behave in an extremely risky way, the employer will find out, adds Dr.
The identification process itself, especially in companies where IT work is not the main area of activity, can be difficult and require the collection of a huge database. That’s why researchers have created a validated tool to help you with this process. – This is a survey completed by the employee. We compare its results to special indicators developed by our research team. This way, we can determine which group the employee belongs to. It goes like this: we enter the company with an audit, we ask employees to fill it out, only we know who belongs to which group. Companies, in turn, find out which group is most represented – describes Zofia Przymus.
How to protect companies against cyber attacks?
As Dr. Małagocka points out, the four groups of employees identified during the research need a slightly different approach when it comes to security. The so-called “risk takers”, as already mentioned, require constant monitoring. Furthermore, after proper identification, some of the available activities should be blocked. The researcher also suggests applying measures that are used in banks and financial institutions, i.e. periodic IT audits, to them.
However, equally rigorous enforcement will not necessarily have a positive effect on employees outside this group. Among other strategies for detecting errors in employee behavior, Dr. Małagocka also mentions the so-called fake phishing attempts, VPN technology, two-factor authentication. People with less awareness of the situation should also have access to additional support programs.
Read also: Scams are one of the biggest threats on the Internet. How can you protect yourself against them?
On the other hand, it is also worthwhile to equip people with additional knowledge who are already aware of the threats and therefore act with due caution. – They are very valuable units in the organization. If we equip them with knowledge, send them to an interesting industry event related to cybersecurity or give them access to current threat information, we have the opportunity to turn them into “ambassadors of good behavior”. They then teach other employees how to behave – explains Dr. Małagocka.
However, no company should block everything in advance or scare employees that they will suffer financial consequences if they make mistakes.According to an expert from the Leon Koźminski Academy, this did not bring the desired results for the entire team and, moreover, made technology the enemy of efficiency and good work, which is a path to nowhere. – Today, companies are more exposed to downtime caused by a cyberattack than by a random event like a fire. That is why we must treat cybersecurity as an occupational health and safety issue. We need to break the spell of technology and the idea that people who use it consciously have almost magical skills – summarizes the researcher from the Koźminski University.
Types of online risk behavior
During in-depth interviews with cybersecurity experts, Polish scientists identified 26 risky online behaviors. Then, based on quantitative research conducted on a representative group of Polish employees, they divided them into three categories of threats. The first of these includes situations resulting from human behavior, for example, clicking on suspicious links or postponing software updates. These are the ones that pose the greatest risk.
Next, we have threats arising from the environment in which the employee performs his or her duties, for example, viewing confidential documents in a public place or participating in video conferences containing important information without using headphones. The third group is related to access data, that is, creating very simple passwords, repeating the same passwords, logins and PINs in different places or lack of two-factor authentication.
