You may never find yourself exchanging phone numbers with a Saudi prince, but CEOs and business leaders swap contact details all the time. For Jeff Bezos at Amazon, this was just another routine step along the path that led to a massive breach of his security. After a personal connection, what is more natural than accepting social media contacts?
Today, companies are under ever increasing pressure to ensure their business processes are robust enough to withstand a cyberattack. Firewalls and anti-virus software are installed, patches applied and staff required to change their passwords on a regular basis. Access to files is restricted to those who need them for particular aspects of their work, processes are put in place for staff who leave and user access to the computers they use is restricted to ensure they don’t do something stupid.
Yet at the same time, we see a rise in the number of possible attack vectors open to the criminals. Social media channels offer new ways to get past the watchdogs and security measures in place. Staff are making great use of cloud-based storage to share documents and larger files. Everyone in your business has a smartphone that’s capable of wreaking havoc yet we regularly let staff ‘bring their own device’ and companies like it because there’s more appeal for staff to work late or on weekends if they do so remotely.
All of this creates more opportunity for the bad guys and more risk for organisations, and especially for business leaders. Because while security restrictions are usually put in place vigorously across the company, the one person who should have extra layers of protection tends to demand fewer.
The boss tends to get the special treatment which allows him or her to have greater access to files and services. They may receive more leniency around passwords and security protocols, and have a hands-on role with their marketing team when it comes to a presence on social media including Twitter, Snapchat and WhatsApp, even if company rules prohibit such activity for others.
Jeff Bezos’s (and other high-profile business and political leaders) Twitter use demonstrates CEOs and organisational leaders are willing to live by a different rule to the rest of the team, and that leaves the organisation open to some serious challenges.
How do you tell the boss that he or she shouldn’t have admin rights on their laptop? That they shouldn’t give out their contact details to everyone they meet, no matter how royal? What about insisting they don’t use their work phones for personal use, such as social media, even when they use social media to talk with customers and represent the company?
It’s a minefield for the security team because, of all the staff in the organisation, those at the top are more likely to be targeted by criminals trying to harvest information and access sensitive information. ‘Spear phishing’, where criminals attempt to pass off communications as being from the CEO or financial department, is a growing area of concern. Having senior leaders who are active on social media, and use it interchangeably with email and other more formal channels of communication, makes life doubly difficult for the security team.
So in light of Jeff Bezos’s breach, here are five tips about cybersecurity for CEOs:
Private vs company
If you do want to share your contact details, use a cut-out service. A phone number that you only use for those instances or an email address that your executive assistant (EA) manages. Keep some distance, and keep it ring-fenced so if there is a problem, it’s limited.
Security isn’t optional
Boring but true. Talk to your cybersecurity leads about how best to handle your specific needs. Routine sweeps of your accounts and devices might be required – especially if you travel overseas a lot – so be prepared for some hassle and annoyance. It’s not their fault – it’s good that they nag.
Set the boundaries for staff
Make it clear how you’ll communicate with the rest of the company. You might use a social media account to talk about the company publicly but you won’t use it to message the CFO at midnight to make an urgent transfer of money, for instance. That way if you are hacked it shouldn’t lead to the company running into financial strife.
If in doubt, there is no doubt
Be suspicious of every communication you receive. If a competitor suddenly wants to share files with you, if a new supplier sends you something directly via an unusual channel, if someone offers to invest large amounts of money out of the blue, be suspicious and if in doubt, check in with your cybersecurity team.
Less is more when travelling
Sure, you might need a laptop and a phone when you’re travelling but you’re also more vulnerable to an attack. Talk to your cybersecurity teams about risk mitigation when on the road and how best to handle that. You should back everything up before you go. You may also be advised to take a ‘travel-only’ laptop (and, depending on the country you are travelling to, perhaps a tablet only) and a phone that can be wiped when you return.
The best defence against cyberattacks is both preparation and planning. Consider the risks, and plan and anticipate the consequences of a breach in terms of your company, your business and you personally. Doing these things means you’re in a better place to manage any potential attack. And remember that we all suffer from ‘optimism bias’ – “why would anyone target me?” Don’t rely on having never been attacked as proof that you won’t be. Just ask Jeff Bezos how that worked for him.
David Eaton is Associate Director of Cyber Security for Datacom.
By Fiona Monks – Strategist, CX and Innovation at Datacom
Capitalism as we know it is getting shaky. There’s a wave of pressure coming from consumers, particularly our younger generations, demanding that businesses deliver more than just goods and services. They must regenerate the plant and empower our communities too.
And it’s not a fad or a movement that’s going to go away
anytime soon. The reality of our planet’s finite resources will ultimately
force the change in how businesses operate and how people consume. Now is the
time for our corporate CEOs to lead from the top and show us this new way
forward.
… capitalism has to purge its narrow
fixation on financial capital and embrace at least five other capitals –
natural, social, human, cultural and technological – with finance becoming only
a mechanism to facilitate those, rather than an end in itself.
In New Zealand the Government’s response to the UN
Sustainability Development Goals has been through the Living Standards
Framework and the release of the Wellbeing Budget. Aotearoa has the chance to
lead globally on ‘capitalism reimagined’ by leveraging our highly connected
communities and embracing these goals through a Te Ao Māori lens.
So what is the CEO to
do? And what about the majority of us who aren’t CEOs? How can we craft this
switch from a focus on the bottom line to a focus on the greater good? While
the path for everyone will be different here are a few suggestions on where to
start.
Embrace your inner activist. Now is the time to connect with your personal and company values and stand up in the public eye for what you believe in. The audience is ready and waiting.
Don’t try to solve everything yourself. At Datacom this is a big one for us, as we see the incredible value that’s generated when organisations come together to solve common problems. We’re part of the #TheBigShift, a movement that’s rethinking how we resource and deliver change in communities. It is a radical shift in how community impact is realised and we exist to build a collaborative multi-sector movement that creates and accelerates impact.
Open your mind to new ways of thinking. You don’t need to become a subject-matter expert, but increasing your awareness of systems thinking and circular economies will put you in good stead to better identify the opportunities available to your organisation. Going Circular can lead to new business lines, more robust and diversified business models and greater customer engagement.
Empower your employees, colleagues and networks. The best ideas come from all levels of your business. It’s why we’re so keen to educate all of our Datacom team on Circular as part of Datacomp 2019. We want to enable everyone at all levels to spot opportunities to work differently and deliver multifaceted outcomes.
Decades of resource extraction, consumption, pollution and
waste, have had a devastating cumulative impact on our planet and our people. Globally,
a growing number of people realise this cannot continue and they are taking to
the streets in protest.
At Datacom we believe if
we are to make a significant, urgent and meaningful impact, we need to examine
our world-view and make fundamental changes.
Internationally the
United Nations is doing just that. Through its Sustainability Development Goals
(SDGs), it has called for countries to look beyond just economic measures of
success. They are asking countries and businesses to look at social, environmental,
and cultural wellbeing, as well.
Locally, the New Zealand
Government has redefined what success means for New Zealand. Our Government believes
that to be successful Aotearoa New Zealand needs to build a productive,
sustainable and inclusive economy, which improves the wellbeing and living
standards of all New Zealanders.
At Datacom we ask ourselves
how do we add value and enable a unified view that prioritises genuine wealth
and holistic wellbeing for all life?
We believe it is
possible for businesses to genuinely embrace, a new set of performance measures
for businesses. We believe these measures must place an increased importance on
positive contribution to the preservation and regeneration of society, culture
and the environment.
We are testing this
thinking in two ways;
By mobilising our people and
partners to look at areas where they could embrace doing better socially,
environmentally and culturally.
And by shaping up a way for
business to easily report on their impact and wellbeing.
Datacomp
Datacomp is our annual
innovation activation. It brings together 350 – 430 people of diverse
background and experience to solve gnarly challenges. This year we’ve
challenged our participants to embrace Circular Design to reimagine how
advanced tech can reinvent, reframe and reuse for the good of people, the
planet & business.
Underlying this
challenge is a not so subtle question we are also asking ourselves;
‘what if we bring together a
single, multi-stakeholder conversation about value creation, not value
extraction?’
Datacomp 2019 – Circular
is both our experiment to test this but also our start to think and act
differently ourselves.
Today’s CIOs are expected to drive business innovation, yet many are grappling with limited IT staff, resources and budgets. In a rapidly evolving landscape, leveraging the right tech is key to overcoming those obstacles and freeing up your team to focus on what matters – growth.
At Datacom, we partner with Aruba Networks – a leading provider of next-generation network access solutions – because it enables organisations to take advantage of a cost-effective mobile-ready network without sacrificing business-class performance, security or reliability.
Our Business Development Manager, Tom Cook, regularly sees the following common obstacles cropping up in the market – here’s how utilising Aruba’s networking solutions can help to overcome these issues to accelerate business growth.
Lack of network visibility A survey by the Ponemon Institute polled some 3,866 IT and IT security practitioners in Asia-Pacific, Europe, the Middle East, Africa and North America and found that more than half (63 per cent) highlighted the importance of network visibility – the need for availability and capacity to monitor traffic on their network.
With Aruba Central, everything from setting up the network to monitoring and maintaining it is streamlined. Whether managing one site or a thousand remote locations, full visibility and control over all network traffic is possible via one enterprise-grade portal.
Slow response times to issues Many organisations lack the capability to quickly diagnose and rectify network issues before they halt operations, or, worse still, allow a security breach.
Aruba’s connectivity health functionality provides the proactive monitoring and analysis required to address issues in all phases of the connection process, including association with access points, network authentication, address assignment and domain name service accessibility. Detailed drill-downs also help isolate problems and identify rogue devices quickly and easily
Lack of capital to upgrade One of the most common obstacles to growth for small and mid-sized businesses is a lack of capital to invest in new systems or infrastructure, no matter how archaic the current set-up may be.
Thanks to the value of the cloud, the cost of implementing high-performing networks has come down significantly. Aruba offers enterprise networking solutions at a consumer-grade price. And the benefits your business can reap from an upgraded solution – in productivity, increased customer engagement, sales growth and more – means you quickly achieve a return on investment (ROI).
Additionally, you can choose a subscription option that fits your business today and scale up or down as needed, so you don’t have to justify a huge Cost of Capital (COC) from the outset.
Security concerns With such rapid developments in both technology and cyber-crime, Tom regularly speaks with practitioners who believe some of their organisation’s existing security solutions are outdated and inadequate.
Aruba offers the option for integrated and automated security controls to protect business data from malware and unauthorised users, and intrusion detection and prevention to safeguard infrastructure. Aruba’s Instant Wi-Fi also includes a built-in firewall and smart application handling for granular visibility and control to make it even more secure.
Lack of centralised control of the network Disjointed or incomplete network control capabilities are some of the leading causes of inefficient or insecure network management for businesses of all sizes. Aruba’s comprehensive dashboard provides a streamlined overview of the network, along with client and application performance monitoring views.
Simplified monitoring and control of headend and branch gateways through integrated software-defined WAN (SD-WAN) management is also provided. Intelligent workflows provide the ability to look into specific device, policy or circuit configurations to ensure performance aligns with business and user expectations.
If you’d like to learn more about how Datacom and Aruba can help you achieve better visibility, control and performance of your network, get in touch with a Datacom team near you.
People often scoff at phishing attack victims and put the blame on them. It needs to be recognised that this “blame culture” contributes to the real issue of slow reporting of phishing compromises which has a direct and material effect on organisations.
Studies collectively show, falling for phishing email is far from rare and the number of victims is growing. The real question is how to mitigate it? This article covers the discussion around the “carrot and stick” approach. They are not mutually exclusive and are most effective when used together to best suit your business.
Carrot
The consensus in
the awareness training domain is not to blame the users. We should encourage
them to report any suspicious activities, particularly if they are the
originators of the breach.
Since a hacker only
needs one person out of the whole organisation to click on a single malicious
link, it is impractical to achieve zero click rate. However, if we have one
person that reports the incident, it allows the security and the IT team to
review and quickly stop the phishing campaign from spreading and causing
further damage.
The Cyber Security Breaches Survey published by the UK government (Department for Digital, Culture, Media and Sport, 2019) found that the most disrupting attacks were more likely to be spotted by employees than by software, which is the case for 63% of businesses. This also aligns with previous years findings. Hence, we should realise the importance of staff vigilance and to understand the power of empowering employees.
Stick
Another school
of thought is to enforce punishment when people repeatedly fall for phishing
attacks. For example, Paul Beckman, CISO at the Department of Homeland Security
considered a policy to remove employees’ clearance if they repeatedly fail an anti-phishing
test. Needless to say, this is a controversial idea and received a lot of criticism.
One study showed that the perceived severity of consequences did not predict behaviour (Downs,
Holbrook, & Cranor, n.d.).
Studies also show that training focused on prohibition of behaviour or attitudes can often have the opposite effect whereas training that emphasises positive effects can and do change behaviour (Robinson, 2011).
What is your mix?
This table outlines the differences between the two approaches. It is essential to understand your business to pick the right mix.
Be mindful about leaning too heavily on the “stick” approach. The ripple effects can put a strain on employees’ morale, leading to a sense of anxiety and distrust. In the worst case, it can lead to grudge attacks. Reports show that internal threats in cybersecurity are prevalent and cause more grave damage than external attacks (Tripwire, 2017).
It is our advice to develop an approach that balances the carrot and the stick. Taking into account the responsibility of the role and its importance in your organisation will help you to determine the appropriate balance. For example, an IT admin would be expected to be much more vigilant to phishing than a clerk our your logistics desk. It may well be appropriate for the IT admin as part of their employment agreement to agree to a policy where there is a sliding scale of consequence for phishing breaches, whereas that would not be appropriate for the clerk.
Food for thought
Regardless of what stance you take on the approaches. It is important to consider the following:
– Ask your HR, legal and management to contribute
What are the legal or contractual requirements?
What is the company’s policy on rewards and penalties?
What culture is the company trying to build?
– Be consistent with your approach
For example, if enforcement is going to be implemented, senior management need to follow the policy as well. They need to be role models
– Understand that people make mistakes and don’t blindly blame your staff
As discussed, aiming for zero click-rate is unreasonable. Therefore, we need to acknowledge honest mistakes can happen.
– Ensure that you have an incident-handling process in place. For example, who/how to report them.
Your staff needs to know the proper process to be compliant with the company’s policies
We can see how modifying habits can help to combat phishing attacks from the part 1 of this trilogy: “From awareness to habits”. However, it is unrealistic to expect no-one to click on a malicious link by only changing people’s email behaviour. In fact, some argue that a “Zero Click” goal is harmful (Spitzner, 2017). It doesn’t matter how much training is provided; people will make mistakes.
This is evident from many of our phishing simulation reports, where a few people would ignore the education page after they fell for a simulated phishing email. They realised their mistake as soon as they clicked on the link and would immediately close whatever popped up as a reflex act. This doesn’t in itself show that awareness training is futile; like many other defensive tools, awareness training should be used to reduce risk even though it is not possible to completely eradicate it.
The three pillars
Let us not forget about the three pillars of cybersecurity, namely people, process and technology. Using them together is like building a 3-legged stool. If any of the legs are too short, it will cause an imbalance.
Google recently announced that none of their
85,000+ employees have been phished since early 2017 (Krebs, 2018). What is their secret? Google requires all staff to use security keys to
log in. This security key is an inexpensive USB-based device that adds to the
two-factor authentication. That is, the user logs in with something they know
(their password) and something they have (their security key). This is called
“2-factor authentication”. It is a perfect example for aiding a person with technology and process measures,
or as the security experts like to call it – defence in depth.
The guidance splits the mitigations into four layers:
Layer 1: Make it difficult for attackers to reach your users
Layer 2: Help users identify and report suspected phishing emails
Layer 3: Protect your organisation from the effects of undetected
phishing emails
Layer 4: Respond quickly to incidents
Take layer 1 as an example, here is how we can defend ourselves from all three angles:
Many controls can be placed into your organisation at different layers. To holistically implement counter-measurements, we need to consider your organisation’s constraint and what is suitable for your employees. At Datacom, we look at how to help customers reduce risks from all six areas. Importantly though:
Don’t wait until it’s too late and don’t rely on just one defence mechanism.
To click, or not to click, that is the question. How do people make that decision?
Behavioural economics states that we think with both an intuitive mind and an analytical mind. Most of the time we rely on our intuitive mind to make those “quick and dirty” decisions such as fight or flight. If we see a tiger coming from a distance, we don’t need our analytical mind to list all the pros and cons before we know to quickly run away.
This also applies to cybersecurity, and with phishing specifically:
1) We have difficulty perceiving a threat. We may not see the tiger unless we’re aware it could also be in plain sight
2) many of us haven’t harnessed our intuitive thinking to create a habit of spotting and reporting phishing emails
While traditional security training tries to improve our analytical mind’s capacity, it doesn’t focus on sensing and handling dangers intuitively. The difference between what we know – and what we feel, can lead us to make a wrong decision.
Awareness
Greater phishing awareness from employees can help prevent phishing attacks. One study confirms that those with a deeper understanding of the web environment and how to correctly interpret URLs are less vulnerable to phishing attacks. But the perceived severity of consequences doesn’t predict behaviour. This suggests that education efforts should be trying to increase intuitive understanding, rather than just warning about risk (Downs, Holbrook, & Cranor, n.d.).
Since New Zealand is far away from the rest of the world geographically, we like to think we are better shielded and safer from any physical or virtual attacks. There is also a sense that because we are a smaller ecosystem, the chances of us becoming a target are reduced. Let’s not forget though, we are only ¼ second away from anywhere in the world online!
This illusion may make us even more ill-prepared when disaster strikes. The truth is that we are aligned with the rest of the world when it comes to phishing attacks, which includes our susceptibility, phishing as the primary data breaching method and damage impact of attacks.
Security mindsets are not natural for people, which is why an alarming percentage of employees still fall for a highly effective phishing scam just months after they were trained to watch for it.
Once people are aware of phishing dangers, it is time to build safe email/internet browsing behaviour into habits. We need to harness our intuition and be able to quickly and effortlessly handle most of the phishing attempts.
Habit formation is a powerful means to behavioural change. Scientists have found that habits are formed and operated separately from the part of the brain responsible for memory (Duhigg, 2012). Studies confirmed that we make unconscious choices without having to remember anything about decision making.
Our brains are constantly looking for new ways to form automatic routines. For example, riding a bike or driving a car requires over a dozen separate actions, but we do them daily without a second thought.
How can we leverage habits to avoid phishing attacks with our intuitive mind? By repetition. When we repeat an action enough times, a process known as ‘chunking’ will take place where the brain converts a series of conscious actions into an automatic routine.
The habit process:
1. Cue. A trigger that tells your brain to go into automatic mode and which routine to use.
2. Routine. A physical, mental, or emotional behaviour that follows the cue.
3. Reward. Positive feedback to tell your brain that the routine works well and is worth remembering.
How to form the habit of defending against phishing
Let’s look at the case of checking emails and how we could tweak a routine to protect ourselves.
Security is a vast field. Often, it is mysterious, difficult and confusing. Frequent use of industry jargon among experts and in reports creates a barrier for people to discuss and understand. What is a SOC? What is a botnet? What are the different types of malware we should actually pay attention to? And why are we spending so much money and effort on something that may or may not happen?
Interestingly, people do know about phishing. They may not understand the logic behind it or the term itself, but most are familiar with those annoying emails asking for their details to claim a big prize.
These emails have been around for a long time. One of the first popular phishing emails was the Love Bug in 2000. All around the world, people received emails titled “ILOVEYOU”. https://en.wikipedia.org/wiki/ILOVEYOU
The email body only had a one-liner: “Kindly check the attached LOVELETTER coming from me”. Many were eager to find out whom their secret crush was and opened the attached file. The attachment unleashed a worm which overwrote the victim’s image files and sent a copy of itself to all contacts from the victim’s Outlook address book.
Since the Love Bug phishing almost two decades ago, the tactic and delivering of phishing remains fairly similar. People know all about it, yet still fall for it.
Phishing continues to be one of the most common and effective cybersecurity threats. It accounts for more than 50 per cent of the Office 365-based threats in 2017 (Microsoft Security, 2018). In New Zealand, there was a 55 per cent increase in phishing and credential harvesting in the fourth quarter of 2017 (CERT NZ, n.d.), 76 per cent of organisations say they experienced phishing attacks in 2017 (Wombat Security, n.d.) and, by the end of 2017, the average user received 16 malicious emails per month (Symantec, 2018). These scams cost organisations $676 million in 2017 (FBI, 2017). This begs the question:
How is this still a thing?
We will look at this issue from three angles; what motivates the attackers, why victims fall for it and how organisations perceive their own security programmes.
What motivates attackers:
Phishing is cheap, scalable and easy to carry out. Attackers favour this type of “low-hanging fruit”. An attacker can easily send phishing emails to 10,000 people and even if just 1 per cent click a link, their attack would be successful with 100 people.
A successful phishing campaign is generally the entry point for other attacks. Verizon reported that 92.4 per cent of malware is delivered via email (Verizon, 2018).
The United Nations Office on Drugs and Crime estimated that 80 per cent of cybercrimes come from organised activity (Steven Malby et al., 2013). Most organisations can’t expect employees to compete with organised criminals and be vigilant 100 per cent of the time.
Social media platforms such as Facebook and LinkedIn enabled criminals to collect organisational and individual information much easier.
Verizon research found that 92.4 per cent of malware was delivered via email
Why victims fall for it:
There is still often a lack of awareness of phishing as a vector of compromise (Downs, Holbrook, & Cranor, n.d.).
Today’s ubiquitous technology creates constant interruption and leads to habitual multitasking. Both behaviours are linked to more frequent risky behaviours (Murphy & Hadlington, 2018). Especially for jobs that are multitasking in nature such as call centre staff.
Clicking on links provided in emails is part of everyday behaviour. Some may require us to log in with credentials. By targeting this process, legitimate looking phishing attacks often catch us when we are not fully paying attention (CERT NZ, n.d.).
Spotting phishing emails is not always a straightforward task, especially when it comes to the well-researched and targeted “spear-phishing” email.
It is no longer about spotting bad grammar and spelling mistakes. Instead, malicious emails are often polished, even exceeding employees’ copywriting skills. They would look like they are from an organisation or person that you trust and recognise.
We are optimistic. The optimism bias is an age-old human trait essential to our well-being. The optimism bias in cybersecurity, however, causes problems. For example, the mentality of “no one is interested in attacking me”. Due to the optimism, we tend to underestimate risks and engage unnecessarily in overly risky behaviours. When we receive emails designed to infect our machine with malware, we don’t necessarily treat them with the suspicion and wariness they deserve.
Here’s why organisations fall for it:
This same optimism bias also applies at the organisational level.
One PwC (2018) report found that executives were overconfident in the robustness of their security initiatives. Some 73 per cent of North American executives believed their security programmes were effective.
Organisations often opt for a “tool-first” approach. While tools are necessary, investing in technology before people can be troublesome. Spending millions on technology can certainly make you feel safe. However, cyber threats often aren’t technological driven but are a result of how human brains work. Our curiosity, ignorance, apathy, and hubris are often our vulnerabilities (Dante Disparte & Chris Furlow, 2017). So balancing technological measure with human-centred defences is crucial to preparing and preventing future cyber-attacks.
Investing in people could be more ambiguous than investing in tools. A sceptical executive could ask reasonably what the ROI on developing a training programme was – and question the value of taking people out of their regular jobs to get trained.
Phishing on steroids today
Email continues to be the most common vector (96 per cent) for phishing attacks (Verizon, 2018). Recently, the scam has spread to social media, messaging services and apps.
With the rise of social media, phishing attacks are now on steroids, since it has become so much easier for attackers to harvest personal information and compose more legitimate or tailored email (spear-phishing). Social media also becomes a phishing channel.
People are more likely to click on a link from their friends or families. It means that when an attacker harvests one social network credential, they can easily reach out to new “friends and families” and compromise even more accounts through the wonders of the network effect.
Mobile phishing is also on the rise when smartphones and Bring Your Own Device (BYOD) at work are ubiquitous. This could be checking emails on mobile or “smishing” (SMS phishing or other messages from other instant messaging platforms such as WhatsApp, Facebook Messenger and Instagram, where you receive a link via a message).
There is an 80 per cent increase every year since 2011 of people falling for phishing attacks on mobile devices (Lookout, n.d.). Our devices are often connected outside of traditional firewalls and so have less protection. Lookout reported that 56 per cent of its users received and tapped on a phishing URL while on a mobile device. Attackers will no doubt continue to leverage new and popular services as they become available to break this human defence line.
Building a “human firewall”, making New Zealand digitally safe
Datacom’s goal is simple – to make New Zealand digitally safe.
The National Plan to Address Cybercrime clearly states that New Zealand businesses, other organisations and the overall economy would be affected if our nation fails to develop the capability to address cyber-attacks (Department of the Prime Minister and Cabinet, 2015).
Experts believe we are experiencing the beginning of the next “cyber-arms race”. While continuous investment in defensive security, e.g. protecting our strategic infrastructure and electricity grid, is undeniably important; the overall growth of cybersecurity awareness among every one of us is equally critical for our national cyber defence. After all, we’re connected now more than ever – each of us is either part of the problem or part of the solution. The worst-case scenario would become even worse when we start living in smart cities with self-driving cars, surrounded by a myriad of Internet of Things devices. We cannot slow down the rate of technological innovation, and so we must speed up our collective preparedness.
In this series, we look at strengthening the “human firewall” from three different perspectives :
In part 1, we explore the “Why”. Why do we fall for phishing attacks from a psychological perspective, and how could we form and change our habits to protect ourselves and our organisations?
In part 2, we look at the “What”. Given the difficulties around defending against phishing from the human perspective alone, what are the components of a multi-layered defence system that can increase organisational resilience?
In part 3, we investigate the “How”. Specifically, how could we effectively run user awareness training and phishing simulations, and how do we balance “the carrot and stick”?
Murphy, K., & Hadlington, L. (2018). Is Media Multitasking Good for Cybersecurity ? and Everyday Cognitive Failures on Self-Reported. Cyberpsychology, Behavior, and Social Networking, 21(3), 168–172. https://doi.org/10.1089/cyber.2017.0524
By Brett Roberts, Associate Director, Digital, Customers & Collaboration
How’s the culture in your company? Does it enable you to thrive? Or are you simply surviving? Worse yet, is it toxic?
While the world of work is changing rapidly, people still sit at the very heart of it. How do we get the best out of these people? And how do we ensure they get the best out of their roles?
A critical factor in this discussion is the concept of psychological safety in the workplace. If you as a leader can create an environment in which even the newest hire feels safe to voice their thoughts and opinions, then you are far more likely to get the best ideas out of your staff. This is incredibly important given that one of the underpinning requirements of an innovation culture is ideas and creativity.
Linda Hill, a Professor at Harvard Business School, is an expert on managing for collective creativity, and firmly believes that getting the best out of people requires a safe environment. She also comments that innovation is not about solo genius, rather it’s about collective genius and it’s collaborative and messy. Pixar took a very collaborative approach to the development of their first full length CG (computer graphics) movie, Ratatouille. It took nearly 20 years from inception to release, but CG films have really taken off since then!
Innovation requires imagination, but imagination can be stifled in a negative workplace. People can’t innovate in an environment where they feel fear (of embarrassment, of ridicule, of not being heard), so it’s crucial that business leaders foster an environment where people feel entirely safe to speak up. New junior staff members are sitting at the bottom of the pile, but giving them a platform to speak their mind in safety will help grow them – and quickly.
Professor Hill’s research concluded that leaders needed to stop giving answers, or providing solutions. They needed to look to people at the bottom of the pyramid, the young sparks, those that were closest to the customers as an often untapped source of innovation. Organisations need to invert the pyramid, transfer growth to lower levels, and unleash the power of many by loosening the stranglehold of the few.
Workplaces need to create an environment where there is a marketplace of brainstormed and debated ideas, and where it’s ok to have strong – yet constructive – views. Asking good questions, actively listening and advocating for their point of view are also critical skills for leaders and others to foster.
Psychological safety and teams
Google’s Project Aristotle showed that psychological safety is the number one determinant of highly effective teams. A culture of psychological safety enables everyone in the group to contribute regardless of hierarchy, role, or expectations. In this instance, we can draw upon the total collective intelligence of the group.
Author Dr Amy Silver commented that “If we don’t have psychological safety, we use fear to mediate our contributions to a team. We are not able to contribute whatever’s in our heads as we limit ourselves through the fear of judgment, the fear of being ridiculed, the fear of being discounted, or the fear of going against expectations. Without psychological safety, we don’t have collective intelligence. We have fear-based intelligence.”
Creating psychological safety through hackathons
Datacom has been using hackathons for the last seven years as a way to create environments where people from different backgrounds and experiences feel safe to ideate, experiment and create.
There are many ways in which we create a sense of safety during a hackathon, such as rituals around welcoming which leads to greater levels of understanding amongst team members, many of whom may never have met before. There is a strong need to take the time to meet, greet and understand each other as this fosters a sense of safety and empathy which ultimately leads to better outcomes. Having seen it many times, we also understand the need to support those people who feel strongly about a topic or issue. Having support around them is what makes their dream reality.
We’re seeing real examples of how psychological safety impacts on how people participate in hackathons. Just this year we had a number of tertiary students join our main internal hackathon. They felt so safe that two of them got up and pitched an idea to an audience of hundreds only a short time after arriving. In a regional hackathon we were involved in earlier in the year, one of the businesses brought along several of their own staff but instructed them to go into separate teams.
Datacom might not be experts in the science of psychological safety – we’ll leave that to Professor Hill and Doctor Silver – but we are huge believers in its importance and ability to fundamentally influence organisational culture and innovation not to mention improving employee engagement and retention.
Today, every company is thinking about and investing in workplace safety measures. The benefits are obvious and the downsides of not doing so are clear. We believe the same applies to the concept of psychological safety and would encourage your organisation to do the same if you’re not doing so already. The benefits are too clear to ignore.
By Kerry Topp, Associate Director, Transformation and Innovation
We can’t slow down the rate of technological change, change is rapid and all around us. The skills cycle, the rate at which skills are needed, is rapidly increasing both globally and in New Zealand.
We are at the crucible moment where leaders in Aotearoa New Zealand need to be proactive and responsible in the “right-skilling” or retraining of their workforce. For right-skilling, organisations need to have a strategic plan for talent to make the shift. Any good talent strategy should focus on retaining and training existing talent, as well as acquiring new workers.
In this context, what can we do as leaders to ensure our organisations, society and above all, our people, are future-fit and ready, now? In this post we will look at why we believe it is crucial for corporate leaders to increase their investment in employees’ skills today so New Zealand Aotearoa is able to increase the prosperity, wellbeing and capability of our people, organisations and country, tomorrow.
The Skills Revolution Is Here!
Recently Manpower, a global leader in contingent and permanent recruitment workforce solutions, asked 18,000 employers in 43 countries across six industry sectors how they expect technology will impact their business in the next two years, and how they are ensuring their workforce has the right skills and is ready to adapt – specifically, they looked at:
The likely impact of automation on headcount in the next two years,
Which functions will be most affected,
The strategies they are adopting to ensure they have the skills they need for technological advances.
“We are seeing the emergence of a Skills Revolution — where helping people upskill and adapt to a fast-changing world of work will be the defining challenge of our time.“– Jonas Prising | Chairman & CEO | ManpowerGroup
What Manpower found was that more than 90 percent of employers expect their organization to be impacted by digitisation in the next two years. In addition, on average, by 2020, more than a third of the desired core skillsets of most occupations will be comprised of skills that are not yet considered crucial to the job today.
The World Economic Forum identified that skills cycles are shorter than ever before and some 65 percent of the jobs Gen Z will perform do not even exist yet. They also found that up to 45 percent of the tasks people are paid to do each day could be automated with current technology. We have of course adapted to the evolution of the labour market before — from tellers to customer service representatives, typists to word processors and personal assistants — disrupting, destroying, redistributing and recreating work is nothing new. The difference now is the life cycle of skills is shorter than ever and change is happening at an unprecedented scale.
“On average, by 2020, more than a third of the desired core skill sets of most occupations will be comprised of skills that are not yet considered crucial to the job today.” – World Economic Forum
The Conclusion Is Widespread
It is not just Manpower or The World Economic Forum that are drawing similar conclusions. The evidence of a skills revolution is also coming through loudly from the likes of the Big Four and research organisations, like McKinsey & Co, Gartner, PWC as well:
51 percent of all activities can soon be done without humans, impacting and changing 60 percent of current jobs [McKinsey, Future of Work 2017].
The future of the workforce will be dominated by those born between 1980-mid 90s. And what they want from work is different. A strong sense of alignment on values and purpose, over profit, is the main goal. According to PWC’s Managing tomorrow’s people: The future of work to 2020 report, 88 percent are looking for alignment on corporate social responsibility, with their personal values.
According to PWCs Workforce of the Future study, 74 percent of global employees are now actively up-skilling themselves to take advantage of the new economy.
A study by Mavenlink found that given the opportunity, 65% of workers would pursue contract work. Whilst it’s not a new addition to hiring trends, it’s still worth calling out that flexibility is key, with the option to work remotely influencing the likelihood of accepting a position for 68% of new workforce entrants. There are many more ways to ‘work’ emerging and becoming main-stream. Which opens up new and creative ways for organisations to run their HR budgets, and individuals to design a career with more flexibility.
Those With The Right Skills Will Thrive
Based on this research, it is clear, those with the right skills will increasingly be in the driving seat, create new opportunities and have the choice and flexibility to work where, how, and when they like. Those lacking the right skills will increasingly be left behind and the outlook for the future for them is not rosy. There is a continued polarisation of the population that is playing out right in front of all our eyes and it will, if not rapidly addressed, be costly for society and business.
How Do We Ensure NZInc Has The Right Skills To Thrive?
At Datacom, we believe that now is the time for company leaders to be responsive and responsible! We cannot slow the rate of technological advance or globalisation, but we can invest in employees’ skills to increase the resilience of our people, organisations but also society. I contend that we are seeing the emergence of what World Economic Forum calls, the Skills Revolution.
Yes, individuals absolutely need to nurture their ‘learnability’: their desire and ability to learn new skills to stay relevant and remain employable; but leaders in New Zealand need to take immediate action to fast track the upskilling and reskilling of existing employees to ensure New Zealand Aotearoa has access to a workforce with the skills required for the future.
So, let’s have a look at what we are doing to support the resilience of our people.
In a recent McKinsey survey, 75 percent of executives said they believed reskilling would fill at least half of their future talent needs, given the war for talent and hiring difficulties. The survey highlighted that people working in IT and customer-facing roles are likely to see the greatest increases in demand, but they also anticipated rapid growth in demand across almost all industries and geographies for data analysts required to make sense of big data, and for specialised sales, product and commercial managers to commercialise new digitised offerings.
At Datacom we firmly believe that from learning comes creativity and from creativity comes innovation. One of the activations we have in this space is Datacomp, our annual innovation hackathon, which has been running since 2012 and is designed to keep our people sharp and give them an opportunity to trial and test new skills and experiences in a safe environment.
One of the benefits of Datacomp is that every year each person in our business gets the chance to take part in a significant learning and development opportunity. Our goal in providing the program – called Datacomp StayingSharp – is simple, to add to our peoples’ C.V.s! Not because we want them to go, but rather, because we want them to stay.
Over the last seven years that Datacomp has been running we have seen over 1,000 people trained in lean canvasing, design thinking, presenting and pitching, plus get ongoing exposure to the latest technology and insights.
Having The Opportunity And Feeling Safe Are Important
Our view is that giving our people the opportunity to keep up-to-date with the latest trends, ways of working and tech is positive and inspiring for all – most importantly, our people and customers. We aim to give our people a safe environment to experiment and try new things, things that they don’t necessarily have the opportunity to do in their day job.
Winning team from Datacomp 2018
We don’t do this lightly. We are actively and deliberately seeking to lead our own people and also other organisations to keep up with the ever-demanding skills cycle.
“Remember, you’re not in charge. You are responsible for those in your charge.” – Simon Sinek | Founder | Visionary | Author | Speaker
As Simon Sinek, internationally acclaimed speaker and author, said leaders are not responsible for the job. Leaders are responsible for the people, who are responsible for the job.
If we accept that the pace of technological change has accelerated us to a crucible moment where leaders in Aotearoa New Zealand need to invest in employees’ skills today to increase the prosperity, wellbeing & capability of our people, organisation & country, tomorrow, then as a leader, I encourage you to ask yourself: what are you doing to deliver a brighter future for your people?
