RAISE AWARNESS ABOUT CYBERSECURITY

The number of cyber-attacks is exploding, exploiting the fear generated by the Covid-19 crisis. Never has it been so important to educate users about cybersecurity when it has rarely been so difficult to reach them, often isolated by teleworking.

Taking into account this particularly difficult context, we develop here the notion of benevolent awareness.

People are the most important part of a cybersecurity strategy.

It is humans who use the IS.

It is humans who make the decisions about how to classify and protect information.

Humans react or not to incidents

However, while it has probably never been so important to educate users, it has rarely been so difficult to reach them.

We are indeed living in an unprecedented situation. The health crisis follows an economic crisis of which we agree that the worst is in front of us.

Many employees work from home. They have to adapt to a new organization, maybe temporary, working. More isolated, they find themselves having to adapt in a particularly anxiety-provoking context. They are worried about their health and that of their loved ones. They are also often worried about their jobs and their economic future. This situation, where apprehension and frustration dominate, is not the most favorable to listening to employees, especially in terms of cybersecurity.

Cybercriminals, on the other hand, have understood the advantage they could derive from this situation. The attacks keep increasing. Thus the publisher Barracuda Networks reports a 667% growth in phishing attacks in March. We know that a phishing attack is all the more effective when it is based on the springs of fear and urgency. The current situation constitutes a favorable ground for scams and attacks of all types. Attacks exploiting this fear of disease take a wide variety of forms.

We are therefore faced with a dilemma and a difficult equation to resolve. The need for awareness has never been greater even though reaching out to users and getting their messages across has never been so difficult.

This is how it becomes necessary to introduce the notion of benevolent awareness.

This benevolent awareness must be based on a few simple principles:

Give meaning - explain the issues: explain why we are raising awareness, why it is essential to adopt the principles of digital hygiene, what the threat is and what the consequences may be, giving examples, 'a successful attack.

Explain that the requested behaviors aim to protect them, at the same time as their business. Indeed, the psychological consequences of a social engineering attack on the person who is the victim, can be serious. In this type of attack, it is the person who is the target who is the first victim even before the target company.

Proximity, personal use: You have to stick as much as possible to the situations that employees encounter. It is therefore necessary to decline the messages according to their respective situations. For employees working from home, in a setting where the workplace becomes home, it can be useful and appreciated to explain to them how to strengthen the security of their digital home.

Empower them: we must explain to them that they must become the strong link in cybersecurity. It is indeed because each of them will be an actor that the company will be protected.

Thank: You should never hesitate to thank employees for their participation and commitment to keep their company safe from cyber-attacks.

Give feedback: whether before, during or after awareness campaigns, you have to give feedback to users. You have to give them the feeling of participating in a general impetus.

Create a network - rely on “champions”: this is all the more true as participation in awareness campaigns is low. Tell yourself that in this case, it means that those who participate feel all the more concerned. Lean on them.

 By doing this, we will be able to move users out of the fear zone where many of them find themselves into a learning zone from which they will evolve towards a real cybersecurity culture.