Human errors cause almost 90% of data breaches.

So, even if you have a robust cybersecurity infrastructure in place, such as a Next Generation Firewall, the lack of skilled cybersecurity professionals can leave a significant gap in your cybersecurity initiatives. This gap can then be easily exploited by cybercriminals to carry out a data breach or other cyberattacks. And with cybersecurity attacks getting more sophisticated by the day, the need to have a skilled cybersecurity team becomes even more critical, says Sonit Jain, CEO of GajShield Infotech.

With almost three decades of industry experience, Jain has been working in the area of Information Technology since 1993. In a free-wheeling chat with The Indian News, Editor, Jayashankar Menon, the experts shares more information on the cyber security arena. Excerpts:

TIN: Can you throw light on data breach and its ramifications with a case study?

SJ: Take the case of Equifax, for instance. The U.S. Department of Homeland Security’s Computer Emergency Readiness Team (CERT) notified Equifax about a vulnerability affecting certain versions of Apache Struts. They sent them an e-mail notification regarding the same. The organization’s IT team, however, failed to identify and fix the vulnerability. This vulnerability was exploited by a hacker who gained access to Equifax’s system for more than a month. If the organization had a skilled cybersecurity team, the vulnerability could have been fixed at the earliest, saving them from the incurred damages.

TIN: So, how do you identify and close the cybersecurity skills gap currently present in your organization?

SJ: The answer is to not only have a state of the art cybersecurity solution but also to have a human firewall in place.

TIN: Can you elaborate on how to build a strong human firewall and have a unified defence mechanicm in place to take on the cyber security threats?

SJ: Having the right cybersecurity technologies, such as a data security firewall, and providing employees with cybersecurity awareness and training, can help build a unified defence against cyberattacks. Building a strong human firewall can be divided into three components:

Assessing Employees

The first component for bridging the cybersecurity skills gap and building a strong foundation for a human firewall is assessing the employees’ current cybersecurity awareness. You can carry out this process by conducting baseline testing. Baseline testing involves simulating phishing and other types of cyberattacks to see how employees respond to them. This will help you discover the employees’ strengths and weaknesses and give you a clear idea of what areas need improvement. Until you have a clear understanding of the gaps in your current cybersecurity protection, you won’t be able to take the correct future steps.

Providing Training

Now that you have a clear understanding of the gaps that exist, you need to provide training to your employees. An effective training plan should first include imparting knowledge to the employees regarding various cybersecurity aspects, such as the different types of cybersecurity threats, what a data security firewall is, and how the IT infrastructure enables protection against cyber-attacks.

TIN: What kind of training that needs to be provided to the employees?

SJ: Next, you need to provide training to the employees by simulating real-life scenarios that the organization is likely to face. The training should provide detailed information about the necessary steps to be taken in case of a cybersecurity lapse. To increase the effectiveness, the training program should have interactive, scenario-based content that encourages active participation from the employees. It should involve demonstrations and exercises that can help drive behavioural change in employees and eliminate the cybersecurity skills gap in your workplace. The cybersecurity training programme, ideally, should end with an examination. This helps give an idea about which employees need further training and assistance. You can then create short training courses focusing on the weaknesses of such employees.

TIN: How do the management monitor and measure changes?

SJ: After the cybersecurity training procedure has been completed, periodic monitoring and measuring changes is mandatory. Behaviour changes vary from person to person. Thus, you need to continually monitor and measure the cybersecurity programme’s outcome to make systematic changes over time. This helps curate a cybersecurity training programme that is best suited to your organization. The cybersecurity training programmes also need to be updated regularly to reflect new risks and technologies. In addition to monitoring and measuring changes, you will also need to provide assistance and feedback to employees to help improve their cybersecurity practices.

TIN: How do the management take additional steps to build strong internal security protocols?

SJ: While the above-mentioned steps can significantly strengthen the cybersecurity measures, taking additional steps will add that extra security layer. These other steps build upon the existing strong foundation of a strong human firewall to further enhance cybersecurity. There are various ways to impliment this. One way of doing this is to use multi-factor authentication. This apparently provides an extra layer of security when employees fall for a cyberattack. For instance, in a typical scenario, if cyber-criminal get access to an employee’s credentials, they can easily carry out a data breach. However, with multi-factor authentication, they will need additional information, such as one-time passcode/password, to access the network or data. In addition to one-time passcodes/passwords, other multi-factor authentication methods too are available, including biometric verification, device verification, and security questions verification. This helps improve the cybersecurity of the organization as this information is hard to obtain. Employees must, therefore, be made aware of the benefits of using MFA and make that a standard practice at the organization.

Another step is to provide employees with company-issued devices. Personal devices are not the best medium to access business-critical information. These devices are easy to hack and could already have been infected with malware without the user’s knowledge. Using such devices for business purposes might as well increase the chances of a data breach. Enterprises must, therefore, provide employees with a separate device specifically for professional use. They should ensure that all business communication, including data exchange, upload, and download, is done only through the authorized device. Furthermore, the management needs to install the right security tools to ensure that the traffic from these devices is routed through the enterprise’s security infrastructure to protect against any illicit attempt.

TIN: What are the advantages of building a strong human firewall in order to bridge?

SJ: Building a strong human firewall to bridge the cybersecurity skills gap requires a lot of training and practice, which can cause organizations to abandon the process midway. However, when done correctly, a strong human firewall can empower employees and make them more proactive in ensuring that the organization is safe from cyberattacks. All these firms need are the right kind of programme and sound teaching methods to make your employees aware of the importance of cybersecurity and how employees play an equal, important role in maintaining it.