The price of poor cybersecurity training is measured in millions of dollars

The 24^th of November 2014 began like any other day at Sony Pictures. Until staff switched on their computers.

When they did, they were greeted by a cartoon image of a grinning red skeleton and a warning: “This is just a beginning.”

The company had been hacked by a group calling themselves ‘Guardians of Peace’, and the attackers had a list of demands. Fail to comply, and they would leak unreleased films, private emails, and confidential salary and performance data. They did all of this anyway.

What followed was one of the wildest stories of cyber crime in recent history, unfurling into a geopolitical crisis involving North Korea, the FBI, Barack Obama, cancelled movie premieres, and the loss of millions of dollars. 

Malware had plunged the company into the pre-digital age. Eventually, Sony’s own employees started to sue for damages.

But what had allowed the hackers access in the first place? 

Several follow-up investigations identified phishing emails and social engineering targeting employees as the route in. Two of the oldest tricks in any hacker’s manual. 

Better cyber awareness might have made it a lot harder for the hackers to infiltrate so deeply.

Employees are the most important line of defence

There aren’t many people out there who haven’t had an email from a Nigerian prince with cash that needs safekeeping. 

But just because you can spot the advances of a lazy scammer, doesn’t mean you won’t one day fall victim to a more sophisticated ploy. It can, and does, happen to anyone. 

The Sony hack is just one of the big stories that made the headlines. Thousands of attacks are launched every single day. 

Small businesses are the target of 43% of cyber attacks, with damages stretching into the hundreds of thousands of dollars. 

These companies are typically targeted precisely because they will be less equipped to deal with an attack, lacking the resources to employ full-time IT staff or to secure and back-up their valuable data.

In such cases, employees can be the first, best, and sometimes only line of defence.

Most cyber attacks are preventable

A staggering 88% of data breaches are a result of human error. While you can never completely remove the chance that someone will make a mistake, you can certainly lower your odds. 

With the right education – training that is regularly updated, accessible, well-structured, and brings to life the very real consequences of a cyber attack – it’s possible to minimise your chances of being breached.

The Sony hack has become an ugly (and expensive) footnote in the company’s history. The fallout is still being felt today.

But the event also marked a turning point in cyber awareness, and has provided valuable lessons that businesses of all shapes and sizes can learn from. It’s no longer an option to ignore the warnings.