L&D - Importance of Cyber Security Training.
As technology continuously advances, the requirement to safeguard from cyber threats also increases rapidly.
An analysis from CIPD emphasizes the importance of
cyber security. Refer to facts and figures from the analysis below.
A KPMG study
showed that a third of all UAE organizations suffered cyber security breaches
in 2015 and Oxford Economics reported that the average large business loses
£120m (US$156m) when it is hit by a hacking attack.
(Reference: CIPD, 19th Jul 2017)
Another important aspect is training employees who do
not come from an IT background. Regardless of the employees’ IT knowledge, every
employee in the brokerage firm is exposed to cyber security threats. Therefore,
HR has a duty to protect employees without IT knowledge by educating them on cyber security protocols. In addition to above mentioned duty, HR needs to
ensure brokerage companies employ the right candidate to mitigate cyber
security risks.
(Reference: CIPD, 19th Jul 2017)
Refer below video on Cybersecurity in financial services to get an understanding of the growing requirement for cybersecurity.
Ransomware.
Cyber security protocols act as a shield against Ransomware.
Mainly in ransomware attacks what happens is access to a system or important
document is blocked by the hacker until a sum of money is paid.
Phishing email is a medium that brokerage and finance
companies receive cyber security attacks. Therefore, educating employees on phishing emails and how to recognize a phishing email is much more important to the brokerage industry as the brokerage company is liable for the asset that holds on
behalf of the end client.
HR needs to emphasize the employee’s importance of updating
security software and be extra vigilant about the e-mails received and avoid becoming
a victim. Some financial companies do have a contact point to report phishing incidents that employees come across. The report phishing function helps
to make aware other employees of the phishing attempt and take action against
it by the cyber security team.
Furthermore, HR should advise employees to refrain
from office log-in to office devices/laptops/mobile phones/Tabs using public
networks as sometimes public devices are not secured. Brokerage companies
should always have backup plans and encryption for sensitive data.
In addition to all the above duties, HR needs to
educate employees on the case studies on cyber attacks and cyber security protocol
failures from the industry in order to proactively protect from same-natured
attacks.
JPMorgan Chase scandal.
Refer below video to have an insight into the actual cyber-attacks that happened to a giant in the financial service industry.
Proactive Exercises
Some financial institutions conduct exercises to identify loopholes in cyber security protocols proactively. Sometimes main regulators from the financial services industry initiate cyber security exercise drills in order to identify the loopholes and identify how resilient the financial service industry is to cyber-attacks. The below extract indicates an interesting approach from the Bank of England towards enhancing Cyber security.
The report shows that considerable progress has been
made since the previous exercises in 2011 and highlights areas which could be
further improved. Waking Shark II was organised by the
Securities Industry Business Continuity Management Group which drew on
extensive cyber expertise to design a scenario in which a cyber-attack caused
disruption to wholesale markets and the financial infrastructure supporting
those markets. It involved participants from investment banks, financial market
infrastructure, the financial authorities and the relevant government agencies.
The exercise tested the communication between firms, between firms and the
authorities, and aimed to improve understanding of the impact of a cyber-attack
on the participants and wider financial sector.
(Reference: bankofengland, 05th Feb 2014)
References.
“Analysis: It’s Time for HR
to Get Serious about Cyber Security.” CIPD,
www.cipd.org/en/about/news-archive/analysis-cyber-security/. Accessed 25 Nov.
2023.
Bank of England
Publishes Report into Cyber-Resilience Exercise,
www.bankofengland.co.uk/-/media/boe/files/news/2014/february/boe-publishes-report-into-cyber-resilience-exercise.
Accessed 25 Nov. 2023.
“Cybersecurity in Financial
Services.” YouTube, 28 June 2018,
youtu.be/x1tSXW2GBto?si=Doyx6sC-6ArxM4It.
“Feds Probe Cyber Attacks
on JPMorgan Chase.” YouTube, 29 Aug. 2014,
youtu.be/0Mwy747X7eA?si=j9DU1-7gNePngeQd.
I was particularly interested in the blog post's discussion of the role of technology in learning and development. As noted by Rosenbaum et al. (2017), technology can be used to deliver personalized and engaging learning experiences that meet the needs of individual employees. This can lead to more effective training and improved employee outcomes
ReplyDeleteThank you Lakma, for your view on cybersecurity learning. Agreed on the fact that cybersecurity learning comes with technological tool usage and personalized learning.
Delete