At the IT Security Guru we’re showcasing organisations that are passionate about making cybersecurity a healthier, more mindful industry. This week, Jack Chapman, VP of Threat Intelligence at Egress, spoke to the Gurus about the human side of phishing, leading by example, and eradicating blame culture.
When it comes to mental health and wellbeing support, Egress are a shining example of how a rounded, but personalised approach is key. They offer a wide range of traditional support, alongside dedicated programmes to foster mental wellbeing, including financial advice and private healthcare schemes. Earlier this year, they were named one of the 2023 UK’s Best Workplaces™ for the second year too.
On the importance of mental health in the workplace, Chapman says: “if we don’t look after our people how can we push forward together?” He continues, regarding their comprehensive company wellbeing offerings, “in terms of offering a broad range of elements, it’s understanding that people don’t fit into neat boxes, people need supporting at their level, at different times.”
Egress offer their employees a whole range of programmes to support their staff, including:
- Qualified mental health first aiders in the office.
- Employee assistance programmes including a set number of free structured counselling sessions. For example, in the UK this is via Legal and General.
- Time off / work-life balance incentives are on offer including:
-
- Flexible working.
- eFlex – a scheme that enables employees to flexibly take up to 15 additional days of paid leave throughout the year.
- Paid time back.
- Increased holiday entitlement.
- Enhanced maternity package.
- Active listening / feedback regularly taken from employees to improve the workplace.
Egress aim to stop data breaches by reducing human activated risk, so it makes sense to foreground the ‘people’ element of cybersecurity and provide ‘human’ support for employees and customers. The most common threat vector of UK businesses last year was phishing attempts (83%), according to the Cyber Security Breaches Survey 2022. When it comes to phishing, Chapman notes: “phishing isn’t just the technical problem, it’s a people problem as well.” He succinctly describes cyberattackers as aiming to ‘trick’ users in these sorts of attacks. He notes that what cybercriminals do is try and invoke fear and strong emotions, ultimately leading to emotional distress. Egress aim to work with victims to educate on why this is dangerous, in an attempt to balance the technical needs of businesses, but also the needs of the person who is being targeted.
Chapman notes that we need to move away from a culture of blame: “The last thing in terms of the cyber phishing is how many businesses respond to it. We’ve seen those industries where they’re slightly older school thinking, where they might punish people with more training, they might have policies like ‘you’ll have three breaches, then you’re dismissed’. All this does is actually create a negative culture where people won’t come forward… And that’s why it’s so important to blend human wellbeing with security.”
But how can organisations move away from blame culture? “I think first and foremost, it starts with leadership, and showing that leaders can make mistakes in these areas. They need to step forward and almost show you the way forwards.” Chapman notes that the importance of accountability must be instilled in everyone, including those from a non-technical background. He notes that unity of approach is key.
“And I think by having that collaborative approach, you destigmatize the fear that surrounds the fallout of these events. And it might be the case where some stakeholders go who’s to blame for this and the answer for that is quite often we as a business are to blame for this.”
He continues: “All things start with good communication.”
When asked to offer advice, Chapman says it’s key to “have a mission statement of enabling and supporting your employees” and to “have safety nets underneath for when they do fall.”
It is worth noting that Egress offer a range of internal schemes to support diversity within the company. For example, their Culture Club uses awareness days to raise awareness through mindfulness activities. Equally, inclusivity is important. Egress often change bank holidays, celebrate/mark awareness dates, and celebrate various religious holidays.
Chapman says: “Diversity of thought is paramount. You see attackers coming from all backgrounds, all walks of life, targeting employees, especially in a social engineering firm, so it’s important to have that across your business.”
“If you have everyone thinking a certain way, you’re not going to evolve together. So I think diversity plays a key part in making us more secure in a lot of ways.”
A final word from Chapman, “it’s really a case of we advocate for technology and humans together as a business and our products.”
Do you know an organisation that’s doing incredible things for employee wellbeing? Email us at [email protected].
