Debtset – Bailiff-Sheriff Aust MEMBER Login
C-suite executives must have ICT security education
MANADATORY breach notification legislation came into effect in Australia on February 22 – yet most business leaders seem to be unaware of its organisation-wide ramifications.
Recent research by Kaspersky Lab internationally revealed only 12 percent of employees know or understand their information security policy – and Australian ICT security group Aleron’s experience shows the situation may be even more acute in Australian businesses. In Australia, the main targets for cybercriminals using phishing scams, now, are C-suite executives and business leaders.
“When 88 percent of an organisation doesn’t even know what’s required of them to help keep the business secure, this indicates a significant problem,” Aleron director Alex Morkos said. 
“Even more worrisome, around a quarter of employees surveyed for the same report said they believe their organisation doesn’t even have any established security policies. This means either these organisations are trusting their continued ability to operate to luck, or their employees are simply unaware of what the organisations are doing to stay safe from cyberattacks.”
Mr Morkos said the most effective way for an organisation to comply with this new legislation was to ensure its security processes and tools were strong enough to prevent hackers from gaining unauthorised access to customers’ personal information.
“Since human error is a huge contributor to successful cyberattacks, this low level of awareness should prompt all Australian organisations to revisit their approach to the awareness of their security policies and communicate clearly to employees regarding what is expected of them,” he said.
“Employees have always been the top security risk factor in organisations. A business can have the most advanced security technology in place but if its employees don’t abide by security policies and processes, it will be easy for malicious hackers to get around the technology barriers.
“All it takes is for an employee to click on a suspicious link, provide their password to a third-party, or insert an infected USB stick into their laptop and the entire organisation could be compromised.”
Mr Morkos said cybercriminals were increasingly targeting top-level executives using social engineering schemes also known as phishing. These phishing attacks are becoming more sophisticated and hard to detect at first glance. 
For example, the CEO might receive an email that looks like it is from a reputable source, asking the CEO to re-enter their password. Once that’s done, the hacker now has all the credentials they need to enter the network and steal information, sabotage operations, or set the stage for a future attack.
High-ranking executives are major targets for cybercriminals because they are more likely to possess valuable information or have access to mission-critical systems and information. However, many C-level executives resist the suggestion that they need training and education to avoid such attacks. This can often be because they are busy with operational concerns or because they don’t believe they would fall victim to an attack.
“This is a risky approach because of the increasing frequency, prevalence, and sophistication of these attacks,” Mr Morkos said. “All senior business leaders must insist on receiving appropriate training to avoid the nightmare scenario of accidentally compromising their entire business.
“With the consequences of attacks being far-reaching and, potentially, expensive, security is no longer an IT-only concern. Rather, it’s now a boardroom issue that demands attention at the highest levels.
“Good corporate security culture starts from the top and trickles down. C-level executives and other business leaders must show their teams they are committed to security,” Mr Morkos said.
“They must then invest in ongoing education for themselves and their staffs to keep the organisation safe. This issue has never been more urgent as the threat landscape continues to expand and worsen. Companies must act now.”
ends
