Strengthening your first line of defence

As businesses fight the war against phishing attacks and cyber security breaches, staff are, in the words of one data systems manager, both the weakest link and the first line of defence.

Doug Frost, IT Manager at Ozo Innovations in Kidlington, near Oxford, has been working closely with Northampton- based ACS since 2020 when it became clear that the increased threat from phishing emails, particularly with employees switching to remote working during the pandemic, called for immediate action.

ACS Account Manager James Ball introduced Ozo Innovations to KnowBe4, a security awareness program available through Microsoft 365, that can be used to test the awareness of employees and deliver training to those who need it.

Doug said: “Phishing attacks are becoming more common and more sophisticated, and we knew we had to ensure our users were aware of the risks. We had a situation a couple of years ago where a member of staff reacted to what looked like an email from the CEO and made a purchase on the back of it. It was a relatively small cost to the company, as it happened, but it could have been devastating.

“My take is that your employees are your weakest link, because if they are not trained to spot phishing attacks it can cause serious problems, but they are also your first line of defence when they spot things that they are not sure about and report them. I contacted ACS to see if they could help and they introduced us to KnowBe4.”

KnowBe4 generates safe, simulated phishing emails and sends them out to your workforce. If the member of staff suspects it might be unsafe, they can click a Phish Alert Report icon on their screen and KnowBe4 records it. If they open the email because they don’t recognise it as a phishing email, or don’t suspect it might be, they will be sent a link to short training video that reminds them what to look out for, and which they can watch at a time that suits them.

Additionally, a monthly report is sent to IT managers or depart-ments as an up-to-date record so that they can measure how users have responded and how awareness has improved over time.

James Ball said: “We use it ourselves at ACS and have found it invaluable for just raising and maintaining awareness levels. There was a massive spike in phishing emails during lockdown because people working from home were seen as more vulnerable, no colleagues next to them to double check with, for example.

“Using KnowBe4 means you can keep track of who is opening emails they shouldn’t and assign some dedicated training to that person. It’s not heavy handed and they aren’t made to feel like they’ve done something wrong, it just keeps their training and awareness at the level it should be.”

KnowBe4 works with both Microsoft 365 and G-suite, with a scalable cost depending on the number of users a
business has. It runs along-side the company’s cyber security system, which should also be working to identify and filter phishing emails.

The benefit in taking KnowBe4 through ACS is they work with aligned partner, Brigantia, in deliver-ing a managed wraparound of the service to ensure clients need to spend little to no time managing the platform to ensure maximum return on investment. They deliver a two-week trial period in which clients gain an overview of their current risk posture across their user base. ACS support the initial set up of the solution and, once live, phishing simulations and training are scheduled on behalf of the client, with any particular at-risk users automatically enrolled into further remedial training.

Since getting KnowBe4 up and running, Ozo Innovations, which delivers sustainability and productivity benefits that enable carbon net zero through innovative electrochemical solutions, has gone on to build its relationship with ACS, which has worked with Ozo to modernise the IT environment, particularly in embracing the M365 portfolio with separate projects to migrate to Exchange Online and SharePoint for storage.

Beyond this, ACS have delivered a CLIP Training solution which gives Ozo users immediate access to simple video training tools across the M365 stack, in turn alleviating the onus on Ozo’s internal IT team to handle first-line support queries.

Doug added: “What we found with ACS was that they really got to know our methodology and work out what we needed. We never feel like we’re being sold to, or advised to take a product just because that’s what they happen to be selling. Instead, we discuss what our needs are, where we could do with some more support, and then they come up with a solution that will work for us.

“There’s no hard sell with ACS, they listen and understand how we work to recommend the right solution.”