6.1 Introduction

6 Security Awareness and Training

6.1 Introduction

Organisational cybersecurity is widely acknowledged to rely on three pillars: namely, technologies, processes and people. Additionally, transforming raw data into eligible information, and information into actionable intelligence, is an increasingly significant component of maintaining situational awareness of cybersecurity.

People are often perceived as the weakest link in the cybersecurity chain [32] [164]. Though this negative characterisation of human nature is debatable [123], it is undeniable that the human is a major contributing factor to the majority of cybersecurity breaches [128]. Cybercriminals frequently employ techniques, such as social engineering, that exploit innate human weaknesses to carry out attacks and to improve their chances of success.

Cybersecurity competence development focuses on enabling people to establish technical and operational barriers to cybersecurity threats, and to conduct themselves appropriately, through the vigilant processing of actionable intelligence. It is an iterative process of continuous and incremental improvement [249] targeted toward transforming the human factor from a potential attack vector to a multiplier of organisational preparedness to protect against, detect, respond to and recover from cyber-attacks. Cybersecurity competence development is based on a continuum that expands formal education through added value activities, such as i) hands-on experience, ii) awareness programmes and iii) training programmes, with each of these multipliers serving particular functions in maintaining organisational cyber hygiene.

Leveraging human factors in cybersecurity goes beyond traditional training and awareness methods. It calls for modern approaches that draw on understandings human behaviour and implementing tools that provide targeted cyber training and awareness. Hands-on experience (also known as learning by doing) is an extremely effective approach to teaching and learning cybersecurity [213]. It engages the learners and improves knowledge comprehension and retention, as well as the possibility of translating acquired knowledge into action [90]. Many successful strategies are used for this purpose, including exercising cyber-attacks detection and defence skills in a cyber range envi-