Magazine menu Close Magazine menu

Cybersecurity training

Latest stories

Report: Three steps to superior cybersecurity

  • min read
    • The threat of cybersecurity weighs heavily on enterprises now more than ever. Technology researchers Gartner say new ransomware models alone are the biggest emerging risk organizations face today — bigger than the pandemic and supply chain disruption. But new research from Kaspersky in association with Longitude, a Financial Times company, shows enterprises are not prepared. Less than one in 10 are very well prepared to deal with cyberattacks by professional cybercriminals (9  percent,) lone hackers (7 percent) and nation states (6 percent.) The research surveyed 750 leaders at enterprises around the world about their approach to cybersecurity. Respondents, representing companies from many regions and industries of at least 1,000 employees, were those who knew their organization's cybersecurity strategy. Enterprises unprepared for cyberattacks "Most people are completely unprepared," says Shawnee Delaney, CEO of US-based insider threat specialist Vaillance Group. "Every day, something changes: There's a newer, better virus, a new technique, a new modus operandi. It's impossible to keep up with everything, and that's frightening for everyone." Delaney is more prepared than most, with her company's security credentials and her background at the Defense Intelligence Agency conducting clandestine intelligence operations around the world. According to Kaspersky's research, the main reason companies are not prepared is reliance on legacy technology vulnerable to today's threats. They also lack financial resources to recruit or consult skilled security professionals. The risk is real, and companies are not prepared. What can they do? Kaspersky's research shows three things they can change for better security outcomes. Step 1: Make cybersecurity teams more diverse Diversity and inclusion is high on the business agenda, thanks partly to movements like #MeToo and Black Lives Matter. There's also a strong business case for it. Research by management consultancy McKinsey & Company shows companies in the top quartile for gender diversity on executive teams were 25 percent more likely to have above-average profitability than those in the bottom quartile. Businesses expect cybersecurity to benefit from diversity too. In Kaspersky's research, most enterprises (62 percent) believe creating a more diverse and inclusive cybersecurity team will be important in the next two years. They're right to focus on this because there's a long way to go. Figures from the UK National Cyber Security Centre show 85 percent of professionals working in cybersecurity are white and 66 percent are male. Kaspersky's research finds cybersecurity teams benefit from being more diverse and inclusive. A fifth (20 percent) of respondents strongly believe they're actively improving diversity and inclusion in their cybersecurity teams. The data shows this small group, which Kaspersky calls the Diversity Leaders, is much better prepared to deal with a range of cybersecurity attacks. Kaspersky's Diversity Leaders have also been quicker to learn from the pandemic. They are more likely than others to be planning for a major crisis through real-world cyberincident training (68 percent of Diversity Leaders versus 54 percent of the rest.) There are more than three million unfilled positions in cybersecurity globally, according to cybersecurity professional organization (ISC)². Darren Argyle, group chief information security risk officer at international bank Standard Chartered, believes improving diversity on teams can help fill vacant spots. In 2021 Standard Chartered launched its Cyber Acceleration Programme (CAP.) About 50 women have participated so far. A 'skill-up and scale-up' program, CAP provides junior and mid-level women with self-paced modules on cybersecurity and leadership. On top of the learning modules, groups of up to ten women are assigned to senior cybersecurity leaders and undergo a 12-week mentoring program. "We're creating a leadership framework that women can engage with," says Argyle. "They work with role models in the bank, who are predominantly women, on areas they might want to develop." Step 2: Closely integrate the C-suite with cybersecurity teams C-suite (senior management) leaders have broad and high-level remits, while cybersecurity professionals focus on the details of cyberthreats. They are not obvious partners. But Kaspersky's research shows that when enterprises build strong links between the two, they experience better security outcomes. A quarter (26 percent) of respondents believe strong integration between the C-suite and cybersecurity teams will be very important in the next two years. The data shows this small group, which Kaspersky calls the Integration Leaders, is better prepared to deal with cyberattacks. UK IT giant Softcat closely aligns its C-suite and cybersecurity teams. Responsibility for risk — including cybersecurity — ultimately rests with its CEO, Graeme Watt. "I am the key stakeholder for security within the board. I have a Chief Information Officer (CIO) who reports directly to me, and the information security team sits under them," he says. "I am the person the board looks to on cyber risks, but I don't do all the reporting myself. I bring the CIO into the board meeting when we're talking about cybersecurity risk." The company faces scrutiny of its cyber risk status from many sources. As a public company, it is subject to external audit. It has its own internal audits. As an IT company that offers security products and services, its reputation among customers depends on its own security standards. Watt works closely with its cybersecurity team to ensure standards are met, but elsewhere in the Softcat C-suite other leaders also have responsibility for cybersecurity. Indian manufacturer Shriram Pistons and Rings takes a similar approach and keeps its security expertise close to the C-suite. 'Shop floor' digitization is a priority for the company, and it plans to use the internet of things (IoT) extensively across its facilities. Its chief digital officer Prashant Khairnar, hired to drive digitization from 'shop floor to top floor,' explains that the leadership team takes security seriously. "When we do risk assessments, cybersecurity is always the top concern," he says. "Of course, I am not a cybersecurity expert, but the person who handles this area is, and he reports directly to me. I take a more strategic view, and he focuses on day-to-day security and the technical issues." Cybercrime is increasing rapidly. Data from technology market analysts Canalys shows 30 billion data records were stolen globally in 2020 – more than the previous 15 years combined. Evgeniya Naumova, executive vice president of corporate business at Kaspersky, says the rise in cybercrime has made the C-suite wake up to the threat. "I think the importance of information security was highlighted to the C-suite and top management during the Covid-19 pandemic," she says, suggesting the increased security risks of remote working captured leaders' attention. "There was a switch — a really obvious switch — in their minds. They understood that it's not just something to observe from afar — it needs to be top of their minds." Step 3: Invest in high-quality cybersecurity training It's no secret that a skilled cybersecurity team is essential to fighting cybercrime. But with four million unfilled vacancies in cybersecurity globally, there is a major skills shortage. A third (34 percent) of companies in Kaspersky's research believe the shortage will get worse in the next two years. Skills and training programs help fill this gap. But to stay relevant, these schemes must be kept up to date. The Kaspersky research identifies a very small group of companies, eight percent, that strongly believe their cybersecurity training programs can keep pace with the evolving threat landscape. The data shows this group, which Kaspersky calls the Skills Leaders, has better security outcomes. Continuously updating skills and training programs eventually helps to make security part of the company's culture. This is essential, according to Vaillance's Delaney. And she thinks continuous training on basic cybersecurity principles is a good place to start. She continues, "Employees need to keep their software up to date, understand what the VPN is and how to use it and not use public Wi-Fi, for example. These are general cyber hygiene best practices critical to maintaining security." Kaspersky's Skills Leaders are more likely to innovate around their training. Two-thirds of Skills Leaders (67 percent) believe it will be very important to carry out immersive cybersecurity training in the next two years, compared with just 49 percent of the rest. The Skills Leaders are also more likely to embed cybersecurity awareness into their recruitment and onboarding process. Another innovative way to fill the skills gap in cybersecurity teams is to recruit from competitors, according to Standard Chartered's Argyle. But to do this, companies must adapt how they work. "If you look at the skills we want to try to attract into organizations around cybersecurity and technology, a lot of those skills don't necessarily sit in another bank," he says. "They sit in fintechs, technology organizations and cloud companies. So we need to be able to offer the same working environment as a large technology company like Google, Amazon or a fintech. And that's a very different way of working." Kaspersky's Naumova says security is every employee's responsibility. "We offer educational courses on how to change the behavior of everyone in the company," she says. "It's not just something the information security team should care about. It's the responsibility of everyone." She adds that companies must take a top-to-bottom approach to security, so everyone learns. "Some companies have an information security director or similar on their board," she says. "They promote them there because they understand they can lose business in a single day if security isn't done properly." The three steps create a virtuous cybersecurity circle Kaspersky's research shows enterprises are better prepared against cyberattacks if they increase diversity in cybersecurity teams, improve collaboration between the C-suite and cybersecurity teams, and invest in quality skills programs. But developing these in isolation is not the answer. The research shows each factor complements one another. For example, Kaspersky's Skills Leaders are more likely to create diverse and inclusive cybersecurity teams and integrate their C-suites and cybersecurity teams more closely. It's a virtuous circle that increases cybersecurity preparedness. The threat landscape is evolving quickly, and cybercriminals are becoming increasingly sophisticated. Businesses have no choice but to match sophistication with extreme preparedness.
identity theft university

How one university’s stolen student IDs caused a crime wave

  • min read
    • Cybercriminals see education as an amazing opportunity. But they're not taking classes or gaining qualifications – they target universities and other educational institutions for the wealth of personal information they hold. In Tomorrow Unlocked's video The Backdoor into Campus, Royal Holloway, University of London cybersecurity experts talk about how a major identity theft incident on campus happened and how they're working to keep students and staff safe in future. How educational institutions are attacked Universities and colleges often have many people using their systems, like staff, students and visitors. They also offer many kinds of services online. Mike Johnson, Chief Information Officer at Royal Holloway, University of London, describes a recent security incident. "A staff member's credentials were stolen and used to send convincing offers of part-time work to students. Some students undertook the work and were paid. But they were overpaid, then asked to return some of the money. It was money laundering on a significant scale." Why cybercriminals love stealing identities "Commonly, we find those who try to attack us are looking to harvest identities," says Johnson. "When they've got them, they'll try to harvest more until they're sure they can attack us in the way they want to." Education can stop attacks on education It's all about authentication, says Keith Martin, Professor of Information Security at Royal Holloway, University of London: Knowing the person trying to access something online is the person they say they are. "Imagine a front door. Whoever has the key can open it. To breach that, you need to get hold of the key. Entering a country is more high security: Border control looks at credentials like a passport and the person submitting it." Professor Martin continues, "In cyberspace, it's a bigger problem because we can't see who's asking for access. The most popular authentication is a password, but passwords are like keys – easily copied or stolen. So we need to use the passport model – asking for multiple things to gain access." That's called multi-factor authentication. You'd need more than a password to gain access, such as a code sent by SMS or biometrics, like a fingerprint. Senior security researcher at Kaspersky, Noushin Shabab, says for the best security, multi-factor authentication should combine biometrics like facial recognition with another credential. Developing 'cyber common sense' in education Professor Martin says the most important thing anyone can do to keep their identity safe is to develop 'cyber common sense.' "Hesitate before doing anything in cyberspace – if you're sent a link or a message asking for information, ask, why do they want this?" Johnson feels education institutes are perfect places to learn cybersecurity awareness. "We've got to be willing to have a conversation with students about digital security and what protecting their identities means. We're educators – we're well placed to help people operate in an environment they'll operate in for a long time."
financial times report cybersecurity skills

Why successful companies invest in cybersecurity skills

  • min read
    • Arming your cybersecurity team with the right skills and experience is a crucial first step in facing down threats. In partnership with Longitude, a Financial Times company, Kaspersky surveyed 750 leaders at enterprises around the world about their approach to cybersecurity. The research found a small group of companies strongly believe their cybersecurity training programs can keep pace with the ever-changing threat landscape. Dubbed the Skills Leaders, these businesses have better security outcomes. About three-quarters (74 percent) say they're prepared for employees accidentally creating a cybersecurity threat – such as falling for a phishing scheme – compared with only half (49 percent) of the rest. This is good news, because cybersecurity skills are in short supply. In 2021, Microsoft announced the US is facing a cybersecurity skills crisis, citing that more than one in 20 of all open jobs in the country require cybersecurity skills. In the same year, research by Information Systems Security Association (ISSA) and industry analyst firm Enterprise Strategy Group (ESG) found 95 percent of cybersecurity employees globally believe the skills gap has not improved in recent years. Our research found one-third (34 percent) believe this shortage will get worse in the next two years. But the Skills Leaders are a small group — just eight percent of the research sample. How can more organizations follow their lead? Three ways to upskill your workforce in cybersecurity 1. Train everyone, not just IT It's not just the cybersecurity team that should be on constant alert for threats. Employee-wide updates and reminders help make security part of company culture. "People need to keep their software up to date, understand how to encrypt their internet traffic and not use public Wi-Fi," says Shawnee Delaney, CEO of US-based insider threat specialist Vaillance Group. "These are general cyber hygiene practices, and they're critical. Reducing human error is crucial. Technology researchers Gartner predicts that by the end of 2025, more than 99 percent of cloud breaches will arise from preventable user misconfigurations or mistakes. One way to reduce these errors is to introduce cybersecurity 'tests' to see how employees respond to threats and increase training for those who fail them. This is what Ricardo Lafosse, Chief Information Security Officer (CISO) at Kraft Heinz, does. "It's probably one of our best ways to see whether a malicious actor could mislead our employees and get into our organization using phishing techniques," he says. 2. Update your coaching techniques Training must also move with the times to keep up with the evolving threat landscape. The Skills Leaders identified in the research seem to understand this. They're more likely to be forward-thinking with their training. About two-thirds (67 percent) say it will be very important to carry out immersive cybersecurity training (gamification and simulations to recreate real attacks) in the next two years, compared with less than half (49 percent) of the rest. "Cybersecurity training is often perceived as a formality, but one-off training is not enough," says Evgeniya Naumova, Executive Vice President of Corporate Business at Kaspersky. "Behavioral change won't appear with the wave of a magic wand. It takes commitment and practice for acquired skills to become habit. Continuous learning is especially important for enterprises to prepare teams for the evolving threat landscape." Staying up to date also means being able to change strategy fast. To combat new threats as effectively as possible, Kraft Heinz's Lafosse prioritizes agility and flexibility in his cybersecurity team. 3. Put cybersecurity at the heart of recruitment Upskilling in cybersecurity will inevitably involve addressing the skills gap. And that could force companies to take an innovative approach to recruitment, like hiring candidates with non-IT backgrounds. The research found the Skills Leaders are more likely to embed cybersecurity awareness in their recruitment and onboarding processes, stressing the need for high cybersecurity standards from the start. Enterprises with a multinational presence must ensure they approach cybersecurity consistently across their global operations. It only takes one cyber threat in one region to potentially wreak havoc across the whole organization. The skills gap is a big challenge for enterprise cybersecurity teams. To be protected against the full range of evolving threats, enterprises must do all they can to fill it. That means expanding recruitment, preparing their existing workforces by keeping them abreast of changes and training them right from the start.
women who shaped computing

We should all know about these women who shaped cybersecurity

  • min read
    • The UK's National Health Service (NHS) asks, "Is cyber a man's world?" It's a provocative statement to promote cybersecurity careers to women, but why should we be asking this question today? Surely cyber and computing careers are for everyone. So why are many women tuning out? Today's working wisdom is that diversity benefits teams, but there's slow progress in getting more women to join technology-led careers and keeping them on board. Human computers: The first data scientists The word 'computer,' coined in 1613, was first used for humans who performed computation. Many of the best were women: Nicole-Reine Etable de la Brière Lepaute helped predict Halley's Comet's return in 1758. A century later, Maria Mitchell plotted the planet Venus's motion, earning an astronomy professorship. When the US Civil War ended in 1865, war widows needed to support themselves. Women were hired as human computers. Agnes Meyer Driscoll, known as 'Madame X,' led the decoding of Japanese ciphers and manuals for the US during both world wars. Women solved the ultimate Enigma Britain's Alan Turing is famed for cracking the Nazi's 'Enigma' code during World War II, but it wasn't the work of a lone genius. Of Bletchley Park's codebreaking team, 75 percent were women. Turing's colleague Joan Clarke worked out how to speed up decoding double-encrypted messages, but unlike many of her male colleagues, her technique wasn't named after her. Clarke's job title didn't match her expertise – there was no 'senior female cryptanalyst' role, so she was given the job title 'linguist.' Painstaking calculation devalued as 'kilo-girls' The dominance of women as human computers cloaked an inconvenient truth. Their work was on average better, and they were cheaper than male counterparts. The Harvard Computers, mockingly called "Pickering's harem," supported Edward Pickering at Harvard Observatory in the 1880s, doing work men and scholars found tedious, unpaid or at a fraction of what men earned. The term 'kilo-girl' came about in the 1940s to describe complex calculations seen as 'women's work.' We measure computing power in gigabytes or terabytes, but they measured kilo-girl hours – one kilo-girl was a thousand hours of painstaking calculations. The kilo-girls work was far from trivial: In the 1950s, Gladys West's calculations for the US Naval Weapons Laboratory led to GPS's development. Computing becomes a man's world By the 1960s, human computing had given way to machines. In the 1940s programmers were mostly women, but by the end of the 1960s women made up 30 to 50 percent. Women were still paid less and few were promoted to leadership. The perception computing is for men and boys started at home. A 1984 report showed 1 in 5 girls used a computer at home, compared with 1 in 2 boys. Female computer science graduates peaked in 1984 at 37 percent, before steadily declining. Academic Wendy Hall says by the 1990s, men led professional computing and computers "were sold as toys for boys." Ten women from computer history to know Ada Lovelace invents the first algorithm Publishing the first algorithm in 1843, Ada Lovelace is said to be the world's first computer programmer. She realized Charles Babbage's Analytical Engine could do more than calculation: Combining mathematics and analysis. Ada Lovelace Day celebrates women's achievements in science, technology, engineering and maths (STEM) and encourages young women to follow her path. Hedy Lamarr averts the Cuban Missile Crisis 1940s Hollywood actress Hedy Lamarr co-invented a frequency-hopping method to control torpedoes remotely without the risk of signal tracking or jamming. Naval ships were using the technology by the 1962 Cuban Missile Crisis. It later became part of Bluetooth and Wi-Fi. Grace Hopper invents new ways to code Grace Hopper created the first compiler for a programming language. She programmed and wrote a comprehensive manual for an electro-mechanical computer based on Babbage and Lovelace's Analytical Engine, Harvard Mark I. She wasn't credited for this but is widely miscredited for coining the term 'bug' when a moth caused her computer to malfunction. She later developed computer programming language COBOL (common business-oriented language) and invented new symbolic ways to write code. Margaret Hamilton took us to the moon The 1969 moon landing wouldn't have happened without Margaret Hamilton, who programmed Apollo's flight software.It needed more 'human computing:' After Hamilton's programming, seamstresses hardwired the code by threading copper wire through magnetic rings. Elizabeth "Jake" Feinler organized the internet At Stanford University in 1969, Elizabeth "Jake" Feinler created the first internet directory, ARPANET, alongside mostly female staff. By the early 1970s, they'd put together the first WHOIS directory of web domain ownership. Feinler suggested categorizing domains by where the computer was, like .edu domains for educational institutions. Women who built new audiences for technology Organizing, building relationships and human factors – often thought of as female traits – are critical in computing projects' success and creating demand for new services. Joan Ball set up the first computer-aided dating service in 1964. In 1988, Stacy Horn started a community in New York, the East Coast Hang Out (ECHO,) where users could chat online. Game designer Brenda Laurel's research showed girls wanted to play more interactive character computer games. In the 1990s, her company Purple Moon developed a best-selling game series inspired by that research. In the 1970s, Joan Margaret Winters researched how software should consider human factors for IBM's SHARE project. When you see the iconic trash symbol on your Apple Mac, thank Susan Kare. She worked with Steve Jobs to design its original icons. Today's influencers for women in cybersecurity When young people see people who look like them succeed in a career, they're more likely to choose it. For women considering going into cybersecurity, there's no shortage of inspiration. Parisa Tabriz, the self-styled "Security Princess" (official title: Director of Engineering,) runs Google's security testing labs. Eva Galperin, Director of Cybersecurity at Electronic Freedom Foundation (EFF,) fights for digital privacy, security and civil liberties. Eva Galperin helps women secure their devices against stalkers and spying ex-partners. Rebecca Bace's threat intrusion detection work at the US National Security Agency contributed to famous hacker Kevin Mitnick's arrest. The cybersecurity community nicknamed her 'Den Mother' for her vital mentorship and advice and posthumously inducted her into the 2019 Cyber Security Hall of Fame. Dr. Anne-Marie Imafidon MBE creates skills training and certification to encourage young women to pursue cyber careers through her company Stemettes. Jane Frankland, security entrepreneur and author of InSecurity: Why a failure to attract and retain women in cybersecurity is making us all less safe, helps the C-Suite (senior management) attract and retain women in cybersecurity. Attracting and retaining more women in IT careers In the UK, the proportion of women in IT has stayed at 16 percent for the past decade. But in many countries, such as those in Central Asia, women make up nearly half of the IT workforce. It's the gender-equality paradox: In countries with less gender equality, educated women seek careers with more income security, while in countries with better gender equality, women avoid careers said to discriminate against women. There are green shoots of progress. Kaspersky's 2021 Women in tech report surveyed women in four global regions. Encouragingly, 57 percent say gender equality is improving in their organization. Despite this, 44 percent think male colleagues progress faster. COVID-19 has brought one step forward: 1 in 2 think remote working has improved gender equality – but 60 percent say they're now doing "most" of the housework and homeschooling. In the report, Dr. Ronda Zelezny-Green, Co-Founder and Director of Panoply Digital, says change is slow because "too much activity around gender equality in IT focuses on one-off gimmicks and band-aid solutions that can be spotlighted in the press, instead of focusing on female employees and actions that will make a sustained difference in their professional lives." Dr. Zelezny-Green thinks we should entice more women into the industry by creating new products and services for women. Widely-reported diversity problems with Artificial intelligence (AI) could be seen as an opportunity: "There's huge potential in telling the stories of Timnit Gebreu and Joy Buolamwini, black women leading the charge for more ethical and inclusive AI design. These stories make inroads in IT and tech roles where women are currently underrepresented." In a prosperous future, we won't need to ask, "Is cyber a man's world?" or "Where are the women in cyber?" They're not hiding under the desk. They're making change, but in another industry. We're on the right path, but it's a long journey ahead. With more women, we can better create products that represent users and benefit from a gender-equal computing industry.
security awareness behavioral psychology

If your cybersecurity training isn’t changing employee behavior, here’s what to do

  • min read
    • By 2021, cybercrime may be costing the world six trillion US dollars annually. Few industries are immune. A single data breach costs enterprises on average of 1.4 million US dollars. What will your business do? You can and should upgrade your cybersecurity, but when you do, there will always be holes no technology can fix. They're called 'human factors:' The normal vulnerabilities of normal people. Cybercriminals are adept at finding and exploiting human weaknesses. Businesses report careless or uninformed staff cause 46 percent of cybersecurity incidents. One in two companies say their employees are the weakest link in their cyber defenses, and 44 percent said their employees don't follow IT security policies properly. Kaspersky's report, The human factor in IT security: How employees are making businesses vulnerable from within lays out more evidence on the scale of the problem. Knowledge isn't enough to change behavior Given the added security risk brought by the rapid shift to working from home, cybersecurity training for all employees should come to the front of the queue. The goal is to change their IT habits permanently. They need to understand potential threats, gain IT skills and take care of their devices at work and at home. Use behavioral psychology to make change Why don't employees immediately change their habits after taking a security course? This is where the psychology of behavior change comes in. To turn learning into habit, people need consistent, repeated and reinforced messages over time. They need to know the consequences and what they should do to prevent them, and have the chance to embed each small habit, one by one. In other words, microlearning: Receiving bite-sized, frequent lessons, simulations and tests. These should come through several channels, like face-to-face or online learning sessions, email reminders and visual cues. It takes time, but it brings results. Cyberawareness each day keeps the cybercriminals away When it comes to industrial safety training, people are motivated to learn because they understand the danger – wearing a hard hat protects you from a serious head injury or worse. Misconceptions can make employees feel powerless against cybercriminals. Some movies, for example, suggest ordinary people can't stop cybercrime. It's better to think of avoiding falling victim to cybercrime as like being chased by a bear. You don't have to outrun the bear. You just need to be faster than someone else. In other words, you don't need to be smarter than cybercriminals. Your business needs to act more smartly than others in its cyber hygiene. Part of Kaspersky's cybersecurity awareness training works with misconceptions about cybercrime and turns them into positive actions. After completing it with a trainer or self-study online, employees are more interested in cybersecurity and want to change their habits. Effective structure for cybersecurity learning Before starting training, we need to know the goal: To change behavior. To change behavior, we must motivate people to learn, know what they should learn (by testing them to find out what they already know and what they must improve upon,) teach them, then reinforce their knowledge and skills. Gamification is great for motivation. Examples include Kaspersky Interactive Protection Simulation (KIPS) – a 2-hour team simulation game that helps players connect business efficiency and cybersecurity. You can also gamify assessing their knowledge, which helps employees feel more relaxed and more vividly demonstrates the problems they'll come across. Casino mechanics are fun and show the trainer how confident learners are in their answers. After we know what to learn, we start learning. Learning should be informative and divided into small pieces to make it more digestible and comfortable. Make it interactive (not just reading slides) and applicable to their work by using situations they will face, and give clear feedback. 'Polish' their new knowledge and skills with tests and simulated phishing attacks. Now the day-by-day learning starts. Some participants may see repetition and periodic testing as 'boring,' but it's vital to reinforce behaviors, creating instinctive habits. Adaptive methodology can make learning more relevant and effective. It's like having a one-to-one personal tutor at scale, so every learner has their own path based on their initial knowledge, abilities and learning targets. It delivers hands-on, practical activities with tests that give immediate feedback. One example of this kind of learning is Kaspersky Adaptive Online Training (KAOT). Evolving technology brings new threats and ways of attacking. Businesses must keep upskilling their people to meet these challenges head-on. You can persuade your employees to improve their cybersecurity habits with education, if it's well-structured and -delivered. Learning turns into action when it's given in bite-sized pieces, repeated and reinforced.
Stemettes STEM training

Young women may be the answer to cybersecurity’s skills gap

  • min read
    • If there's a regular path into tech, Dr. Anne-Marie Imafidon MBE didn't take it. A child prodigy, she was the youngest girl ever to pass A-level (high school) computing. At 20, she graduated UK's Oxford University with a Masters in Maths and Computer Science. Anne-Marie's inspiration to turn her hand to social enterprise came from a stark realization. Attending a work conference in the US, she decided she wanted to change things for women who came after her. "It turned out to be a massive 'women in tech' conference. I had a bit of an epiphany. I'd always been a girl and had always been into tech, and had never noticed that was something strange," she explains. "So I started Stemettes as a response to that, to ensure my unborn daughters could be what they want to be, and thrive, because society depends on it." What Stemettes is changing Stemettes work across the UK, Ireland and beyond to inspire and support young women into science, technology, engineering and math (STEM) careers. It includes a content platform full of inspiration, free events and programs such as mentoring, school holiday programs and regular clubs – provided online in the age of COVID-19, in person at other times. "Our ethos across is it's always free, always fun and there's always food," Anne-Marie adds. The idea the tech industry needs more women and girls might seem a little old-hat in 2020. Much has been achieved, but women make up only 10 percent of the global cybersecurity workforce. The cybersecurity skills gap shows there's no room to let any interested young person go without the chance to get more involved. Stemettes has created cybersecurity courses and opportunities for young women where schools aren't yet catering for their interests. Along with British tech skills training provider QA, they've developed certification academies so young women between 17 and 25 can gain professional cybersecurity qualifications over half-term. The skills gap is more complex than you think Anne-Marie thinks there are a few elements to the cyber-skills gap problem across the industry. Understanding them can help inform where and how teaching skills to girls can have most impact. First, there's a lack of focus on basic digital skills across the board. Second, many more people need expert cyber-skills to build the industry and meet its demand. Third, there needs to be more focus on cybersecurity services for small- to medium-sized businesses (SMBs) using digital technologies. "There's a gap in not just cyber-awareness for SMBs, but also cybersecurity services and advice aimed at and priced for them. When I was younger, there were a lot of people, and social media agencies, who'd go to their local high street and say, "Hey, barber, pay me each month and I'll run your Facebook and your Instagram." There's a cottage industry around that, but we don't have that for cybersecurity. We've ended up having a lot of vulnerabilities because people aren't following basic cyber-hygiene." It's bigger than just SMBs turning their businesses digital, though. Anne-Marie says, "There's so much in building systems, even just for us to be able to vote electronically in the future. There's a lot that needs to be developed in the cyberspace just to keep us safe. We don't have enough people with these skills to work in these companies and run these start-ups." Why teaching girls can be the solution In creating the Stemettes Certification Academy, Anne-Marie saw an opportunity for girls not only to be better trained in cyber-skills, but be able to jump into the profession armed with expertise and qualifications. "We spotted from the girls we work with that the provision in the normal education system for anyone who wants to be in computer science is patchy. So academically, they're not able to pursue things they're interested in, or getting blocked from being able to develop skills they'll need when working," Anne-Marie explains. "These girls are learning from real trainers who teach and work professionally in cybersecurity. They're doing real adult qualifications in cyber to learn the basics, but also to understand their options in cyber." For Anne-Marie, Stemettes is playing a role bigger than just filling the current skills gap. "We're skilling up with real certifications and a generation of new young women who can work in cyber, but even if they choose not to, they take cyber-knowledge into medicine, architecture or other parts of life they touch." How should businesses get involved? Stemettes is proving there's a high impact from its focus on sharing, upskilling and awareness-raising. What does Anne-Marie think corporates working with technology could be doing? "They should fund any kind of cyber-awareness, or cyber-skills, programs around them. They need to invest in future skills and skills of their people. They should also open their doors and do as much sharing in the community around them. I get that if you make money from your cyber-knowledge, giving it away for free isn't the easiest. Still, much is already public in skills frameworks, so they can be part of information dissemination to society. That would be amazing." Stemettes is just one organization supporting routes for girls and women into technology. Kaspersky partners with Girls In Tech, a STEM organization for women, and Cyber Starts, its EU campaign to support early talent women which has hosted events in London, UK and Boston, USA with inspiring female industry speakers. It also hosts the Women in cybersecurity Facebook group to support those entering and working in the field. It might seem like Anne-Marie is asking a lot, but the need for a long-term approach in investing in cyber-skills is ever more pertinent in 2020 as the world demands more, better, faster technology. As she puts it: "It ultimately makes their job easier."
by Innovating leaders.
Innovative tech.
About Secure Futures

Secure Futures magazine is your go-to business guide for opinions, trends and insight into the world of technology and cybersecurity. We help your business to bring on the future. Brought to you by Kaspersky, the global cybersecurity experts.

  • For all other countries