Analytics
11/18/2013
12:29 PM
Dark Reading
Dark Reading
Products and Releases
50%
50%

KnowBe4 Says Lack Of Security Training Equals Serious Legal Liability

Although the number of cybercrime victims declined in 2013, the cost per victim has increased 50 percent

(Tampa Bay, FL) November 18, 2013--Cybercrime has been branded the number one threat to United States security--although the number of cybercrime victims declined in 2013, the cost per victim has increased 50%, bringing the global total to a staggering $113 billion (1). As the costs of data breaches continue to skyrocket--and businesses expose themselves to potential class-action lawsuits on behalf of third parties--Internet security awareness training firm KnowBe4 (http://www.knowbe4.com/) warns small and medium-sized enterprises (SMEs) to effectively arm themselves against cyber-attacks before litigation ensues; KnowBe4 says that security awareness training triples the chances of an organization being able to decrease its phishing problems.

Recent studies show that over the past four years, cybercrime costs have climbed by an average of 78%, while the time required to recover from a breach has increased 130%:

● In the United States alone, the annual cybercrime cost seen by the 60 businesses studied ranged from $1.3 million to more than $58 million and averaged $11.6 million per company--an increase of $2.6 million from 2012.

● The average cost of cleaning up after a single successful attack was $1 million (2).

But the costs of correcting data breaches are no longer the only cause for concern--the legal consequences, such as class-action lawsuits on behalf of third parties affected by such cyberattacks, are a growing worry of business owners. Businesses--specifically those that guard individuals' personal information, such as banks and data brokers--have become a likely target for consequential litigation in the aftermath of security breaches.

Case in Point:

Identity thieves posed as customers to steal more than 160,000 consumer records from data broker ChoicePoint. After the information theft was publicly announced, ChoicePoint paid out some $45 million as a result of the breach, and in the process effectively created a new source of liability for organizations nationwide (3).

Stu Sjouwerman, founder of KnowBe4, maintains that businesses can effectively bypass the financial burden of data breaches by implementing Internet security awareness training (http://www.knowbe4.com/) designed to teach employees to recognize and avoid potential "hack-attacks."

"Antivirus software cannot keep up with the sophisticated tactics of professional hackers, and should not be depended upon as a reliable means of defense," Sjouwerman said. "Internet security training has proven to work by lessening the chances of a successful cyberattack."

Sjouwerman says that the best defense is to think like a hacker, as phishing and social engineering tactics become increasingly sophisticated and difficult to detect. KnowBe4 collaborated with Kevin Mitnick, once known as the "World's Most Wanted Hacker," to develop Kevin Mitnick Security Awareness Training (http://www.knowbe4.com/products/kevin-mitnick-security-awareness-training/), a product designed to help organizations defend against even the most advanced network security breaches.

But even as cybercriminals constantly refine their techniques, KnowBe4 recently announced that an upgraded Kevin Mitnick Security Awareness Training program is in the beginning stages, and will be unveiled in 2014. The program is interactive and web-based, with case studies, live demonstration videos and short tests.

Sjouwerman's authority was confirmed by a study conducted by Osterman Research, which specializes in conducting market research for IT and technology-based companies. Sjouwerman classified five types of security awareness training that organizations commonly implement:

1. The Do-Nothing Approach: The organization conducts no security awareness training.

2. The Breakroom Approach: Employees are gathered during lunches or meetings and are told what to look out for in emails, web surfing, etc.

3. The Monthly Security Video Approach: Employees are shown short videos that explain how to keep the organization safe and secure.

4. The Phishing Test Approach: Certain employees are pre-selected and are sent simulated phishing attacks; IT determines whether they fell prey to the attack; and those employees receive remedial training.

5. The Human Firewall Approach: Everyone in the organization is tested; the percentage of employees who are prone to phishing attacks is determined; and then everyone is trained on major attack vectors. Simulated phishing attacks are sent to all employees on a regular basis.

The research found that KnowBe4's security awareness training (http://www.knowbe4.com/products/kevin-mitnick-security-awareness-training/) program, categorized as a "human firewall approach, not only increased confidence in employee capability to distinguish phishing attempts and malware, but also nearly tripled the chances of an organization decreasing its phishing problem."

KnowBe4's client base is comprised of over 300 customers, 42% of whom are banks and credit unions, and all of whom have successfully reduced the rate of employees clicking on spear-phishing links by up to 80% or more.

For more information about KnowBe4 and its services, contact KnowBe4 online at www.knowbe4.com.

About Stu Sjouwerman and KnowBe4:

Stu Sjouwerman is the founder and CEO of KnowBe4, LLC, which provides web-based Security Awareness Training to small and medium-sized enterprises. A data security expert with more than 30 years in the IT industry, Sjouwerman was the co-founder of Inc. 500 company Sunbelt Software, an award-winning anti-malware software company that he and his partner sold to GFI Software in 2010. Realizing that the human element of security was being seriously neglected, Sjouwerman decided to help entrepreneurs tackle cybercrime tactics through advanced security awareness training. He and his colleagues work with companies in many different industries, including highly-regulated fields such as healthcare, finance and insurance. Sjouwerman is the author of four books, with his latest being Cyberheist: The Biggest Financial Threat Facing American Businesses Since the Meltdown of 2008.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
5 Security Technologies to Watch in 2017
Emerging tools and services promise to make a difference this year. Are they on your company's list?
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7445
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

CVE-2015-4948
Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

CVE-2015-5660
Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

CVE-2015-6003
Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

CVE-2015-6333
Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio
Archived Dark Reading Radio
In past years, security researchers have discovered ways to hack cars, medical devices, automated teller machines, and many other targets. Dark Reading Executive Editor Kelly Jackson Higgins hosts researcher Samy Kamkar and Levi Gundert, vice president of threat intelligence at Recorded Future, to discuss some of 2016's most unusual and creative hacks by white hats, and what these new vulnerabilities might mean for the coming year.