Connect with us

Infosecurity

Dr Jessica Barker: Three Critical Pitfalls That Undermine Security Awareness

Published

on

Dr Jessica Barker: Three Critical Pitfalls That Undermine Security Awareness

Cyber Security Awareness Month has just wrapped up, and the headlines were filled with massive breaches—from Yahoo’s historic data loss to the Dyn DDoS attack. While the month succeeded in sparking conversations about threats, a deeper question remains: what is the real goal of security awareness? Without a clear answer, many organisations fall into dangerous traps that actually worsen employee behaviour.

Dr Jessica Barker, a sociologist turned cybersecurity consultant, warns that awareness-raising done poorly can cause more harm than good. She identifies three core security awareness pitfalls that leaders must address to create lasting change: fatigue, fear, and false flags.

1. Security Fatigue: When Too Much Awareness Backfires

The first pitfall is security fatigue, a phenomenon documented by NIST. Their research found that employees become overwhelmed by constant warnings—”watch out for this, watch out for that”—and eventually tune out. One participant admitted, “I think I am desensitized to it.”

This is the opposite of what awareness campaigns intend. Instead of engaging people, poorly designed training exhausts them. NIST recommends limiting the number of security decisions users must make and simplifying the path to the right action. Dr Barker adds that training must be engaging and innovative, not a list of don’ts. The key is to explain why a behaviour matters, helping employees connect the threat to their own reality. When people understand how an attack actually unfolds, they are far more likely to adopt safer habits.

2. Fear: Scaring People the Wrong Way

Cybersecurity professionals often rely on fear—showing worst-case scenarios to motivate action. But Dr Barker argues this is a critical security awareness pitfall. When people are simply scared, they retreat into denial (“I won’t get hacked”) or avoidance (“I’ll just stop using the internet”). Neither response leads to better security.

Drawing on psychology and sociology, she explains that fear must be delivered in a supportive context. Effective training acknowledges the threat but immediately offers actionable, achievable steps. For example, if you ask employees to use complex passwords, you must also provide a password manager. If you want them to enable two-factor authentication, walk them through the setup. Awareness that scares without empowering fosters helplessness, not vigilance.

As Dr Barker puts it: “If you are asking people to have more complicated and unique passwords, how are you going to recommend they manage those passwords?” The answer lies in support, not shock.

3. False Flags: The Danger of Misidentifying Insider Threats

The third pitfall involves raising awareness about malicious insiders. When training profiles a “typical” insider—disgruntled, working late, accessing unusual files—employees may start seeing patterns where none exist. This is similar to the Baader-Meinhof phenomenon, where new knowledge makes us notice it everywhere.

The result? Innocent colleagues get falsely accused, creating HR nightmares and eroding trust. Meanwhile, the flood of false reports desensitises security teams, so when a real threat emerges, it may be ignored—the classic “boy who cried wolf” scenario. Dr Barker stresses that awareness must include context: fitting a profile does not equal malicious intent. Training should teach employees to report suspicious behaviour without jumping to conclusions, and security teams must treat every report seriously while avoiding bias.

How to Avoid These Security Awareness Pitfalls

Avoiding fatigue, fear, and false flags requires a strategic shift. Instead of checking a compliance box, organisations should design awareness programmes that inform, support, and empower. This means investing in engaging content, providing practical tools, and fostering a culture where security is a shared responsibility—not a burden.

For more on building effective cybersecurity cultures, read our guide on how to build a cybersecurity culture and explore security awareness training best practices.

As Dr Barker concludes, remembering the three Fs—fatigue, fear, and false flags—can help organisations turn awareness into action. The goal is not to scare people into compliance, but to equip them with the understanding and tools they need to protect themselves and their organisation.

Continue Reading
Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

Infosecurity

Will AI and Machine Learning Define the Future of Your Company?

Published

on

Will AI and Machine Learning Define the Future of Your Company?

Artificial intelligence and machine learning are no longer futuristic concepts. They are actively reshaping how companies operate, compete, and innovate. At a recent Microsoft event in London, industry leaders gathered to discuss the Fourth Industrial Revolution—a wave of automation, data exchange, and intelligent systems that promises to redefine business as we know it. But what does this mean for your organization? Is AI and machine learning truly the future of your company, or just another tech buzzword?

This article breaks down the key insights from the conference, explores real-world applications, and offers practical steps for embracing this transformation. Whether you’re a CEO, IT manager, or security professional, understanding these trends is essential for staying competitive in a rapidly evolving landscape.

How AI and Machine Learning Are Driving Digital Transformation

Digital transformation is more than just adopting new technology—it’s a strategic shift. Microsoft UK CEO Cindy Rose emphasized that the company itself is not immune to change. With cloud computing and AI, Microsoft aims to lead customers toward new opportunities. She noted that digital business now focuses on engaging employees, optimizing operations, and transforming products to cause market disruption.

Ryan Asdourian, UK director for Windows and Devices, demonstrated this with Cortana. The digital agent could recommend local restaurants based on audience demographics. This shows how AI can personalize experiences and streamline decision-making. Asdourian argued that digital transformation started years ago and is now standard practice. It’s become more strategic and fundamental to business success.

Building on this, Microsoft Cambridge scientist Chris Bishop revealed three core ambitions: reinvent productivity and business processes, create more personal computing, and build an intelligent cloud platform. These goals are not about replacing people but empowering them to achieve more. For example, AI helps the RAC alert customers about breakdowns and assists radiologists in identifying tumor sizes. The technology saves time and enhances human capabilities.

Real-World Applications of Machine Learning in Business

Machine learning is already transforming industries. In healthcare, AI analyzes medical images to locate kidneys or plan treatments. This doesn’t replace doctors—it complements their expertise. Similarly, in customer service, AI-powered helpdesk agents use keywords and multilingual support to resolve issues faster. Bishop stressed that AI should be trustworthy, inclusive, and respectful.

Another example comes from the financial sector. Companies like Viewpost are implementing agile cybersecurity strategies to support business innovation. At an upcoming conference in Boston, experts will discuss how to build dynamic security frameworks that enable growth. The goal is to move from fear to transparency, as Toni Townes-Whitley from Microsoft’s public sector division explained. She called cloud the engine and data the fuel for the Fourth Industrial Revolution.

Furthermore, the National Cyber Security Centre’s Ian Levy highlighted the need for deliverable metrics. Transparency builds public trust, which is crucial for widespread AI adoption. This approach helps businesses avoid pitfalls while reaping benefits like improved efficiency and customer engagement.

Addressing Ethical Concerns and Job Displacement

As AI becomes more prevalent, ethical questions arise. Cindy Rose asked what bots mean for jobs, privacy, and income equality. These issues require urgent attention to determine the benefits of change and avoid negative consequences. However, history shows that fears about machines replacing humans are as old as machines themselves. The key is to focus on augmentation, not replacement.

Chancellor Philip Hammond echoed this sentiment. He believes the UK can lead in tech innovation, citing pioneers like Alan Turing. He emphasized that the tech industry is the future of the British economy. With proper planning, AI can future-proof the economy post-Brexit. The question is not whether to adopt AI, but how to do so responsibly.

For businesses, this means investing in employee training and ethical guidelines. Companies should explore internal linking strategies to connect AI initiatives with broader goals. For example, learn more about cybersecurity strategies that support digital transformation. Another resource is our guide on business innovation tools that integrate machine learning.

Preparing Your Company for the AI-Driven Future

So, how can your company prepare? Start by assessing your current digital maturity. Identify areas where AI can add value, such as customer service, data analysis, or supply chain management. Pilot small projects to test feasibility and measure impact.

Next, build a culture of agility. As the conference highlighted, transformation requires strategic thinking. Encourage cross-department collaboration and invest in cloud infrastructure. Data is the fuel for AI, so ensure your systems can collect and process it effectively.

Finally, stay informed. The future is happening now, and businesses that hesitate risk falling behind. Consider attending events like the upcoming Boston conference on agile cybersecurity. There, leaders will share insights on implementing dynamic security strategies that support innovation.

Will AI and machine learning be part of your transformation strategy? Have you considered how this will shape your job going forward? The answers will determine your company’s success in the years ahead.

Continue Reading

Infosecurity

The Mirai Botnet and the IoT Awakening: Why Security Can No Longer Be an Afterthought

Published

on

The Mirai Botnet and the IoT Awakening: Why Security Can No Longer Be an Afterthought

The Mirai botnet IoT security wake-up call arrived with brutal clarity in October 2016. When attackers leveraged thousands of poorly secured connected devices to launch a 1 Tbps DDoS attack against DNS provider Dyn, they didn’t just take down major websites—they exposed a fundamental truth: the Internet of Things had finally become real, and it was dangerously vulnerable.

For years, the concept of IoT remained an abstract promise. Routers, thermostats, TVs, and kitchen appliances were theoretically connected, but their collective power was rarely demonstrated at scale. Then came Dyn. The attack harnessed the computing power of these everyday devices, turning them into a weapons-grade botnet that disrupted access to platforms like Twitter, Netflix, and Reddit. Suddenly, IoT wasn’t just a buzzword—it was a threat vector.

How Mirai Turned IoT into a Weapon

The Mirai botnet operated by scanning the internet for devices with default or hardcoded credentials. It targeted routers, IP cameras, and other embedded systems that users never reconfigured. Once compromised, these devices became part of a massive distributed attack force.

This incident taught the cybersecurity community two critical lessons. First, collectively, IoT devices are remarkably powerful. Second, users overwhelmingly fail to change default configurations. As a result, the attack surface for enterprise and consumer networks expanded dramatically overnight.

According to Bruce Schneier, a cryptography legend and CTO of Resilient, governments must step in. In his analysis, he argued that “governments need to play a larger role: setting standards, policing compliance, and implementing solutions across companies and networks.” He also noted that “security engineers are working on technologies that can mitigate much of this risk, but many solutions won’t be deployed without government involvement.”

Three Paths to Securing IoT Devices

Addressing the Mirai botnet IoT security challenge requires a multi-pronged approach. As I see it, there are three main options:

1. Awareness Campaigns

Educating users to update security settings and change default passwords is a logical first step. However, human nature often favors convenience over caution. People choose ease and low cost over safety, as Mark James, security specialist at ESET, pointed out. “The divide between usability and security is hard to get right at the early adoption stage,” he said. “People like ease, sadly the average user will very often choose ease over security and if offered cheaper or safer, will choose cheaper every time.”

2. Security by Design

Building devices with security embedded from the outset is a more robust solution. Manufacturers must stop treating security as an afterthought. James emphasized this: “IoT device manufacturers have to design security into their products from day one; it has to stop being an afterthought or sadly in some cases no thought.”

3. Regulation and Standards

Interestingly, government regulation seems the most likely path forward. Setting mandatory security standards, enforcing compliance, and coordinating across companies could create a baseline of protection that market forces alone haven’t achieved. This is not just theoretical—it mirrors how other safety-critical industries operate.

The Growing Demand for Cybersecurity Skills

In the wake of attacks like Mirai, the job market is responding. Research by Gemalto found that the UK is experiencing a surge in demand for IoT-related skills. Cybersecurity vacancies have increased by 73% over the last 12 months, while 43% of companies are looking for professionals who can build security architecture. Demand for security engineers has risen by 9%, and the median salary for data managers has grown by 7%.

Nicolas Chalvin, vice-president of IoT Solutions and Services at Gemalto, called this growth “encouraging.” He explained: “Growth in smart cities is building interest in IoT but in order to get ahead, companies need to be looking for a range of skills, not just one, to set them apart from their competitors. As a result, we’re starting to see new roles such as IoT Architect and IoT Engineer being introduced to the market.”

Building on this, Chalvin added: “As more IoT projects go live, keeping these secure is vital to ensuring consumer confidence in their usage, protecting confidential data and making them a success.”

What Businesses Must Do Now

For enterprises, the implications are clear. Every new connected device—whether a smart thermostat, a security camera, or an industrial sensor—increases the attack surface. With smart grids and physical security systems also coming online, convenience often trumps security.

Therefore, organizations must conduct thorough risk assessments for all IoT deployments. They should enforce strict credential policies, segment IoT devices on separate networks, and monitor for anomalous behavior. Learn more about building an IoT security strategy for your organization.

Additionally, the industry needs to foster a culture where security is everyone’s responsibility. As James put it: “If we stop buying insecure products and force the manufacturers to make better and safer products, things will have to change.”

Conclusion: From Wake-Up Call to Action

The Mirai botnet demonstrated that Mirai botnet IoT security is not an optional add-on—it is a foundational requirement. If we did not consider IoT a concern before October 2016, the reality of connected devices hit us directly where it hurt. How we recover, repair, and prepare to prevent similar attacks is the defining challenge for business and IT security in the connected era.

To stay ahead, companies must invest in skilled personnel, advocate for regulation, and demand secure products. The future of IoT depends on it. Explore the latest cybersecurity trends to understand what’s next.

Continue Reading

Infosecurity

EU Cybersecurity Rules: Why Global Regulators Must Act Now on Digital Resilience

Published

on

EU Cybersecurity Rules: Why Global Regulators Must Act Now on Digital Resilience

The European Union’s landmark agreement on cybersecurity rules has sent a clear signal to the world: protecting critical infrastructure is no longer optional. These EU cybersecurity rules, finalized in late 2016, mandate that companies in energy, transportation, health, and banking must fortify their systems against attacks and report significant breaches. This move marks the first time the EU has directly legislated on cybersecurity, reflecting the exponential rise in cyber incidents.

What makes this regulation so significant? For one, it acknowledges that cyber threats now have physical consequences. As software and control systems become deeply integrated, a single breach can disrupt power grids, halt trains, or compromise patient data. The EU, as one of the world’s largest economies, is setting a precedent that others must follow.

The Urgent Need for Digital Resilience

Building digital resilience requires more than just identifying key operators and raising their security standards. The EU cybersecurity rules rightly emphasize notification of incidents, but reporting a breach is often too late. The real goal must be to reduce overall risk to public safety through preventive measures.

Therefore, regulators must mandate controls across the full spectrum—prevention, detection, response, and recovery. This includes requiring vendors of critical infrastructure to embed security from the ground up. Trust must be stamped into hardware and software from inception, with systems hardened and encrypted where appropriate.

Lessons from the EU for Global Cybersecurity Cooperation

The interconnected nature of digital networks means a threat to one nation is a threat to all. This is why the EU cybersecurity rules offer a positive example of what can be gained through closer alliance. However, the challenge lies in implementation. The internet was never built for security, and the field of cybersecurity law is still evolving.

As a result, any new regulations must walk a tightrope: they need to be robust enough to force action but flexible enough to keep pace with technology. For instance, the EU’s rules began as a proposal in 2013 and will only become law this year. In that time, computing power has more than doubled, according to Moore’s law. This lag highlights the need for agile regulatory frameworks.

Preventive Technologies: The Core of Cyber Threat Prevention

Effective cyber threat prevention goes beyond compliance. It requires a holistic approach that integrates cybersecurity operations with national and global regulations. Governments and companies must anticipate both current and upcoming rules, adapting them to specific needs—from executive oversight to procedural controls and technological implementation.

Moreover, reporting a security breach is only part of the battle. We need to protect the confidentiality and integrity of entire systems with preventive technologies. Should an incident occur, the response must be swift enough to remediate vulnerabilities before adversaries exploit them.

What Other Regions Can Learn from the EU

Countries in the GCC and beyond should watch the EU’s unfolding regulations closely. These rules enhance security not just for EU nations but also for trading partners. For example, DarkMatter advocates for truly integrating cybersecurity with global regulations, a stance that aligns with the EU’s approach.

In addition, regulators must consider that the internet is less than 30 years old and was never built for security. It’s only in the last two decades, as it became a platform for global commerce, that this became a fundamental concern. Therefore, the time to effect these changes is now.

To explore more on this topic, read our guide to cybersecurity trends or learn about critical infrastructure protection strategies.

Ultimately, the EU cybersecurity rules are a vital step. But they must be implemented with precision, ensuring that technology advances do not outpace the laws meant to protect us.

Continue Reading

Trending