Tag Archives: jobs

Corporate Cybersecurity Training

Posted on by
Reply

It isn’t very effective, apparently.

To measure the effectiveness of different methods of cybersecurity training, the authors [of a study] divided employees into four groups. After each attack, each group received a different training method: one received generic tips about avoiding phishing attacks, a second received an interactive Q&A on cybersecurity, a third was informed about the specific methods used in the most recent attack, and the fourth received an interactive Q&A that also included details about the most recent attack. A fifth group was also created, and the employees in that group received no training.
The authors found that on average, employees who received training of any sort had only a 1.7% lower failure rate than employees who had no training.

The authors’ solution?

The study’s takeaway for organizations, says [lead author Grant] Ho, is to rely on measures other than training, like phishing-detection software that automatically eliminates the need for employees to detect phishing attacks.

Software aids are important in this milieu, but the weak link remains the human. Software aids by themselves are insufficient.

There needs to be more to the training than just a slide presentation and some lectures, or in the present case, “interactive” Q&As. The training sessions need to be plussed up, a lot, but that can’t be the end of it. Schools and responsible companies run fire drills that run to completion with evacuation of the building and head counts and roll calls while the evacuees are gathered up at their assigned evacuation points. So it must be with cybersecurity training. Simulated cyber attacks (phishing, social engineering, etc) attacks should be run against a rotating collection of employees to test their training and their responses to the attacks. Those simulations should be run some weeks after the training and more frequently than those fire drills, and they should not use IT-ginned up attacks, either; they should use serious real-world attacks, altered only to get them targeted to the collection of employees being tested.

Beyond that, there needs to be teeth attached to the training and to employees’ failure to take the training seriously.

There are three outcomes from this. One is an empirical assessment of the quality of training, its durability, and identification of weaknesses in the training program, which then can be corrected (not given up on). A second results from those teeth: once management is satisfied with the training quality, employees still falling for the attacks should be terminated. They’re too great a risk to the company.

The third outcome is a very great increase in the cyber safety of the company and of its employees (with a follow-on: those employees will be better able to maintain security in their homes’ cyber environment). The added training and testing will incur costs to the company, but the risk of the far greater cost of a cyber breach—both direct and indirect through liability—is too great to ignore.

A Misunderstanding

Posted on by
Reply

This one, a Wall Street Journal editorial centered on a coerced unionization of ride share companies Uber and Lyft. The editors got their misunderstanding in early, via their lede:

California Governor Gavin Newsom on Friday announced a “deal” with ride-share companies Uber and Lyft that they couldn’t refuse. Democrats in Sacramento will reduce auto insurance coverage mandates that are driving runaway litigation in return for the companies letting drivers collectively bargain.

Yes, they could have refused the deal. The California government foisted onto them a supremely ugly choice, but it was no less a freely taken choice for all its ugliness. The companies’ managers were just too timid to resist, too timid to leave the State altogether, as their own powerful alternative to Sacramento’s demand.

There’s no reason for any business, not just Uber and Lyft, to suffer the politically imposed costs of operating in California. Nothing is stopping businesses from leaving other than the timidity of their managers.

I alluded to it just above: the cost of doing business in California isn’t just fiscal. It’s political, too, reducing as that cost does, a company’s ability to manage its own business affairs in accordance with its own free market imperatives.

Correct Move

Posted on by
Reply

A DoJ paralegal flipped off a National Guard soldier while the paralegal was enroute to her office work. Then she bragged about it to a DoJ security guard on her way into the building. When word got to Attorney General Pam Bondi, her response was prompt and direct. Bondi’s memo to the paralegal said, in part:

Based on your inappropriate conduct towards National Guard service members, your employment with the Department of Justice is hereby terminated, and you are removed from federal service effective immediately[.]

This has two correct moves in the same sentence. The first is the prompt termination of the misbehaving paralegal. The second is especially important: the paralegal is not going to be reassigned somewhere else in the Federal government; she’s barred from Federal employment altogether.

The woman might have gotten away with her reprehensible behavior, even though she would have deserved to be fired, had she not bragged about it. The lack of judgment she showed by bragging about her misbehavior, though, conclusively demonstrates she’s unfit for Federal employment regardless of any specific act of misbehavior.

Bondi’s memo can be read here.

Disingenuous

Posted on by
Reply

The Canadian government has ordered binding arbitration in the dispute between Air Canada and its flight attendants union, the latter which struck the airline a week ago last Saturday. The union is crying foul over not having gotten its way, accusing the airline, in typical union fashion, of sandbagging (the union’s term) the negotiations.

On the other hand, there’s this, also, from the union regarding those negotiations.

The airline said it offered its flight attendants a 38% increase in total compensation over a four-year period. The proposal also offered a 12% to 16% rise in hourly pay in the first year. The union said the pay offers failed to help its members recover after historically-high inflation this decade.

Leave aside the minor fact that the airline didn’t cause the inflation, the Canadian government’s response to economic factors did, so the union’s beef regarding the effects of inflation is properly between it and the government.

What the union is choosing to ignore in its inflation beef is that the airline suffers just as much from that historically-high inflation and must also deal with the resulting price increases and current elevated price levels.

A Brief Thought on AI and Employment

Posted on by
Reply

It seems that newly minted college graduates are having trouble getting those entry level, low-paying jobs that used to be virtual guarantees in most avocations. Employers are discovering that AI can do many of those entry level jobs just fine, so they’re only interested in hiring folks with a few (say 5-ish) years of actual experience into those jobs that need that experience.

The question becomes what to do after those 5-ish years when those relatively experienced employees move on. Having hired few to no inexperienced folks fresh out of college, there now is no pool of somewhat experienced folks from which to hire.

My thought: use AI to train those who are inexperienced, both new graduates and by now 5-ish years post-college and still inexperienced, to do the entry-level and the somewhat experience-needing work. Continue that cycle as AI advances into the work heretothen requiring more experience, using AI to train employees into those yet more experience-needing positions.

Humans are always going to be better than robots at doing work that requires actual thinking, including jobs that don’t require much thinking directly but do require interaction with other humans in teamwork and/or collaboration (which are not the same thing), with supervisors, even with robots. It also takes humans to train that thinking, and robots can be useful tools in that training.

Carlyle, an investment firm, already is doing this sort of thing, but it needs to get more widespread.

The investment firm Carlyle now pitches to prospective hires that they won’t be doing grunt work. Junior hires go through AI training and a program called “AI University” in which employees share best practices and participate in pilot programs, said Lúcia Soares, the firm’s Chief Information Officer.
In the past, she said, junior hires evaluating a deal would find articles on Google, request documents from companies, review that information manually, highlight details, and copy and paste information from one document to another. Now, AI tools can do almost all of that.
“That analyst still has to go in and make sure the analysis is accurate, question it, challenge it,” she said. “The nature of the brain work that needs to go into it is very much the same. It’s just the speed at which these analysts can move.”