teissLondon2023: Can data science help monitor and improve cyber security behaviour?

Can organisations accurately measure the changing attitudes of their workforce towards cyber security and monitor behavioural changes using data science? If so, how can advanced metrics provide users with the right information at the right time, and how can security programmes help meet the challenge?

To understand the role of data science in measuring behavioural change towards cyber security, The European Information Security Summit hosted Rebecca Massey, Cyber Security Awareness Specialist, Pinsent Masons; Veroniki Stamati-Koromina, Security Engineering Associate Director, Flutter International; Nir Chervoni, Head of Data Security, Booking.com; and Oz Alashe, CEO and Founder, CybSafe at the teissLondon2023 cyber security conference.

Here are the top highlights from the teissLondon2023 panel discussion featuring these industry leaders.

Can data science provide real insight into changing behaviour and cyber-risk levels?

Cyber risk is a major talking point at almost every organisation, considering the scale at which threat actors carry out phishing, spear-phishing, business email compromise, CEO fraud and other forms of cyber crimes that specifically target the human factor. Such being the case, the overall cyber security awareness of the workforce and their attitudes towards cyber security are important indicators of an organisation’s exposure to cyber risk.

The challenge for cyber security leaders and decision-makers is how to communicate the true state of the workforce’s security awareness and behavioural change to the board in simple terms. Can they use user-generated telemetry data to create metrics and if so, can the metrics bring attention to specific weaknesses, help raise awareness, and improve the security posture?

Rebecca Massey, Cyber Security Awareness Specialist at Pinsent Masons, said that her organisation uses a tool called the Human Cyber Index which measures the extent to which people practice secure behaviour. The tool monitors various aspects such as incident reporting, password management, updating devices, and information handling.

Massey said the insights generated by Human Cyber Index are analysed in a practical manner, taking into consideration both the quality and the quantity of the data and whether certain cyber behaviours are influenced by whether they are affecting people’s productivity or not.

"When we’ve analysed that data which we put through Power BI, we can really drill down on the numbers and where things are coming from that then informs our security programme for the next year. So we’ve been able to compare the results from 2020 and 2022 and can see the trajectory of where we’re going in terms of secure culture and where we’re improving," she said.