Analytics
11/18/2013
12:29 PM
Dark Reading
Dark Reading
Products and Releases
50%
50%

KnowBe4 Says Lack Of Security Training Equals Serious Legal Liability

Although the number of cybercrime victims declined in 2013, the cost per victim has increased 50 percent

(Tampa Bay, FL) November 18, 2013--Cybercrime has been branded the number one threat to United States security--although the number of cybercrime victims declined in 2013, the cost per victim has increased 50%, bringing the global total to a staggering $113 billion (1). As the costs of data breaches continue to skyrocket--and businesses expose themselves to potential class-action lawsuits on behalf of third parties--Internet security awareness training firm KnowBe4 (http://www.knowbe4.com/) warns small and medium-sized enterprises (SMEs) to effectively arm themselves against cyber-attacks before litigation ensues; KnowBe4 says that security awareness training triples the chances of an organization being able to decrease its phishing problems.

Recent studies show that over the past four years, cybercrime costs have climbed by an average of 78%, while the time required to recover from a breach has increased 130%:

● In the United States alone, the annual cybercrime cost seen by the 60 businesses studied ranged from $1.3 million to more than $58 million and averaged $11.6 million per company--an increase of $2.6 million from 2012.

● The average cost of cleaning up after a single successful attack was $1 million (2).

But the costs of correcting data breaches are no longer the only cause for concern--the legal consequences, such as class-action lawsuits on behalf of third parties affected by such cyberattacks, are a growing worry of business owners. Businesses--specifically those that guard individuals' personal information, such as banks and data brokers--have become a likely target for consequential litigation in the aftermath of security breaches.

Case in Point:

Identity thieves posed as customers to steal more than 160,000 consumer records from data broker ChoicePoint. After the information theft was publicly announced, ChoicePoint paid out some $45 million as a result of the breach, and in the process effectively created a new source of liability for organizations nationwide (3).

Stu Sjouwerman, founder of KnowBe4, maintains that businesses can effectively bypass the financial burden of data breaches by implementing Internet security awareness training (http://www.knowbe4.com/) designed to teach employees to recognize and avoid potential "hack-attacks."

"Antivirus software cannot keep up with the sophisticated tactics of professional hackers, and should not be depended upon as a reliable means of defense," Sjouwerman said. "Internet security training has proven to work by lessening the chances of a successful cyberattack."

Sjouwerman says that the best defense is to think like a hacker, as phishing and social engineering tactics become increasingly sophisticated and difficult to detect. KnowBe4 collaborated with Kevin Mitnick, once known as the "World's Most Wanted Hacker," to develop Kevin Mitnick Security Awareness Training (http://www.knowbe4.com/products/kevin-mitnick-security-awareness-training/), a product designed to help organizations defend against even the most advanced network security breaches.

But even as cybercriminals constantly refine their techniques, KnowBe4 recently announced that an upgraded Kevin Mitnick Security Awareness Training program is in the beginning stages, and will be unveiled in 2014. The program is interactive and web-based, with case studies, live demonstration videos and short tests.

Sjouwerman's authority was confirmed by a study conducted by Osterman Research, which specializes in conducting market research for IT and technology-based companies. Sjouwerman classified five types of security awareness training that organizations commonly implement:

1. The Do-Nothing Approach: The organization conducts no security awareness training.

2. The Breakroom Approach: Employees are gathered during lunches or meetings and are told what to look out for in emails, web surfing, etc.

3. The Monthly Security Video Approach: Employees are shown short videos that explain how to keep the organization safe and secure.

4. The Phishing Test Approach: Certain employees are pre-selected and are sent simulated phishing attacks; IT determines whether they fell prey to the attack; and those employees receive remedial training.

5. The Human Firewall Approach: Everyone in the organization is tested; the percentage of employees who are prone to phishing attacks is determined; and then everyone is trained on major attack vectors. Simulated phishing attacks are sent to all employees on a regular basis.

The research found that KnowBe4's security awareness training (http://www.knowbe4.com/products/kevin-mitnick-security-awareness-training/) program, categorized as a "human firewall approach, not only increased confidence in employee capability to distinguish phishing attempts and malware, but also nearly tripled the chances of an organization decreasing its phishing problem."

KnowBe4's client base is comprised of over 300 customers, 42% of whom are banks and credit unions, and all of whom have successfully reduced the rate of employees clicking on spear-phishing links by up to 80% or more.

For more information about KnowBe4 and its services, contact KnowBe4 online at www.knowbe4.com.

About Stu Sjouwerman and KnowBe4:

Stu Sjouwerman is the founder and CEO of KnowBe4, LLC, which provides web-based Security Awareness Training to small and medium-sized enterprises. A data security expert with more than 30 years in the IT industry, Sjouwerman was the co-founder of Inc. 500 company Sunbelt Software, an award-winning anti-malware software company that he and his partner sold to GFI Software in 2010. Realizing that the human element of security was being seriously neglected, Sjouwerman decided to help entrepreneurs tackle cybercrime tactics through advanced security awareness training. He and his colleagues work with companies in many different industries, including highly-regulated fields such as healthcare, finance and insurance. Sjouwerman is the author of four books, with his latest being Cyberheist: The Biggest Financial Threat Facing American Businesses Since the Meltdown of 2008.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Security Operations and IT Operations: Finding the Path to Collaboration
A wide gulf has emerged between SOC and NOC teams that's keeping both of them from assuring the confidentiality, integrity, and availability of IT systems. Here's how experts think it should be bridged.
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.

Dark Reading Radio
Archived Dark Reading Radio
In past years, security researchers have discovered ways to hack cars, medical devices, automated teller machines, and many other targets. Dark Reading Executive Editor Kelly Jackson Higgins hosts researcher Samy Kamkar and Levi Gundert, vice president of threat intelligence at Recorded Future, to discuss some of 2016's most unusual and creative hacks by white hats, and what these new vulnerabilities might mean for the coming year.