Student Loans Company splashes out on 20,000 cybersecurity training courses – for just 3,300 employees
- Reference: 1623321906
- News link: https://www.theregister.co.uk/2021/06/10/student_loans_company_security_training/
- Source link:
According to the SLC's response to a Freedom of Information (FoI) Act request, which was made by self-described "niche litigation practice" Griffin Law, almost 20,000 specialist courses were booked and completed in the 2019/2020 and 2020/2021 financial years ended this April. At a total spend of just over £76,800, that's a miserly £3.84 per course – but the released figures don't necessarily cover everything.
"£77,000 may appear to be low, especially if this is distributed over two years," opined security specialist Sean Wright of the figures. "It could actually be an appropriate amount if the training which they are purchasing helps their employees and organisation.
[1]
"Companies need to spend the time to select training which is appropriate for them and their employees. Simply throwing money at the problem is not going to solve it. We've seen this in security tooling, where some companies attempt to throw loads of money on new tools but without properly evaluating those tools and ensuring that they fit the purpose for their organisation and teams. Training should be no different."
[2]
[3]
The breakdown of courses includes fees paid to third-party agencies, but not costs involved with internal training developed within SLC itself – such as an anti-money laundering course, which the overwhelming majority of the organisation's staff took in both 2019-2020 and 2020-2021.
Some courses, such as "Counter-Fraud, Bribery, and Corruption", had a roughly even number of attendees year to year. Others, including "Role of the Manager Security MasterClass", saw a spike from 20 attendees in the first financial year to 142 in the second.
[4]Capgemini scores £150m contract to help Student Loan Company overcome its IT problems 5 years after £50m superfail
[5]Adobe about to pull the plug on Creative Cloud freebie 'at-home' access for students
[6]Student Loans Company burns £50 million in IT project superfail
[7]ICO raps UK Student Loans Co for leaking MEDICAL files and more
Oh gosh - we can't keep an eye on staff anymore
The 2020-2021 financial year, meanwhile, saw a big spike in training related to one key topic: trusting staff who might not be working in the office any more due to a certain virus. "Defending SLC from Phishing Attacks", "Power to your Passwords", and "Working from Home Securely" were all new for the financial year just ended – though only a small minority of staff were treated to these, with "Working from Home Securely" attended by just 189 staff out of the organisation's 3,300 members.
The course that cost the most in third-party fees, "Mastering GDPR, Governance Security, and Compliance in Office 365", was attended by only three SLC staff at an overall cost of £9,780: that's £3,260 per head. It formed part of role-specific training for the organisation's Technology Group Security Team and Information Governance and Compliance Team, which between the pair ate up the lion's share of the budget, according to the FOI response.
[8]
While the case could be made for SLC spending too much or too little on this course or that course, experts agreed that there's no dodging the need for training. "It is encouraging to see the SLC making a proactive effort to equip and train its employees with the latest cyber security skills," claimed Barracuda Networks' senior veep of sales Chris Ross, "especially given the high volume of financial data it is tasked with managing.
"This effort must be supported by the necessary cyber protection systems to identify and quarantine malicious attacks before they reach the inbox of employees as well as having the right backup systems in place in the event of a ransomware attack."
"Training is a vital part of an organisation's approach to security," agreed Wright. "We have seen, on numerous occasions, breaches happening as a result of lack of awareness and knowledge. Training helps reduce this, empowering employees to have the appropriate knowledge and awareness to make the right decisions and actions."
[9]
An SLC spokesperson told The Register : "Malicious online activity affects every organisation and individual, this has become an everyday part of modern life. As such, cybersecurity will always remain a top priority for SLC, and we will continue to invest in training, technical expertise and the robust resources required to keep our customers' information safe." ®
Get our [10]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YMI3IS9UI7Rl@LPXbb1eXgAAABQ&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YMI3IS9UI7Rl@LPXbb1eXgAAABQ&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YMI3IS9UI7Rl@LPXbb1eXgAAABQ&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[4] https://www.theregister.com/2021/04/22/cagmini_150m_deal_student_loan_company/
[5] https://www.theregister.com/2020/06/17/adobe_creative_cloud_athome_access/
[6] https://www.theregister.com/2016/07/13/student_loans_company_it_disaster/
[7] https://www.theregister.com/2014/05/28/student_loan_data_breach/
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YMI3IS9UI7Rl@LPXbb1eXgAAABQ&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YMI3IS9UI7Rl@LPXbb1eXgAAABQ&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[10] https://whitepapers.theregister.com/
Re: "Mastering GDPR, Governance Security, and Compliance in Office 365" at £3,260 per head
I don't know about this particular course, but we've had some of the Office 365 courses run by Microsoft engineers (not trainers) and go into way more depth about the topic than is available in the standard docs. Those courses were not cheap but the staff who attended them rated them as some of the best they've every attended as the engineers knew their stuff and didn't blindly follow a PPT.
Re: "Mastering GDPR, Governance Security, and Compliance in Office 365" at £3,260 per head
Maybe so, but what the tutors know is less of an issue than what the learners leave the course able to do .
To master GDPR, governance, security and compliance, even in a single specific context, is bound to take rather more than a week or so and will certainly cost a lot more than three grand. I've been doing all this for over two decades and I'm still learning every day.
Re: "Mastering GDPR, Governance Security, and Compliance in Office 365" at £3,260 per head
20 year's experience of a 5 year-old piece of legislation. Exactly what the HR drones are looking for...
Re: "Mastering GDPR, Governance Security, and Compliance in Office 365" at £3,260 per head
It's perfectly obvious what was meant.
3,300 staff? Doing what exactly?
By contrast, Wonga had c. 650 staff in the UK, Blackhorse has ~330.
Ok, SLC loan book is higher at ~50bn, but Black horse isn't so far behind at ~16bn. BH's is likely a much higher turn over of clients too, so higher labour overhead per staff member.
I've had contact with both over the years, SLC is a pain to get through to and then they can do FA without some sort of offline activity. BH on the other hand were straightforward 15 years ago and almost entirely web based now.
But hey, its only our money been wasted!
You need to look at the number of accounts rather than the value.
Having said that, Wonga's individual account balances are likely to be a lot lower than SLC's. Probably the same to a lesser extent at Blackhorse; so looking at the value of the loan book probably understates the difference in work load.
>Doing what exactly?
Managing the approval and disbursement £1.7Bn of loans to around 1.3M students and a few hundred education providers every single year within a complex, highly regulated framework.
They are not a small organisation.
> 3,300 staff? Doing what exactly?
No idea, but I expect they have a very peaky load - i.e. September / October - so perhaps the 3,300 is a cumulative figure over the last few years of temp staff and they're not actually full time?
On the other hand
How much did they NOT lose in ransomware attacks during the same period?
"Mastering GDPR, Governance Security, and Compliance in Office 365" at £3,260 per head
That's the typical cost of a five day PPT delivery plus multiple choice memory test course, so a more realistic course title might be "Being fed some superficial buzz-word stuffed flannel to satisfy our 'compliance' auditors". Nobody can master anything in a week.