Apparently, we are getting in our own way when it comes to advancing cybersecurity. According to a leading 2018 study by the Ponemon Institute LLC (sponsored by IBM), the three primary causes of data breaches were malicious or criminal attack, system glitch and human error. While the study reports that the length of time to identify and contain, and the cost, were lower for data breaches caused by human error as opposed to the other categories, it is an issue that nearly 27 percent of data breaches are caused by human error. Coupled with an employee’s involvement in cyber incidents are ransomware, social engineering fraud and fraudulent funds transfer, as well. We are quickly becoming the weakest link in the cybersecurity chain.
Even the most robust cybersecurity protocols can be undermined by an employee that fails to uphold their responsibilities. For example, note the 2019 “inside job” pulled off by a former employee that gained access to over 100 million Capital One customers’ accounts and credit applications. As a result, Capital One has been saddled with the financial and reputational cost of that data breach, while the perpetrator is facing federal charges that will likely result in jail time and a significant fine. Experts say the “inside job” is one of the most difficult to protect against, but not impossible.
Businesses have a greater likelihood of preventing cyber incidents caused by everyday negligence. Employees are frequently referred to as the Achilles’ heel of cybersecurity because while they must be trusted with access to a business’s computer systems to be productive, they have the ability to make mistakes that even the most rigorous cybersecurity framework struggles to prevent. From the lost laptop, containing sensitive information that was not adequately encrypted, to the email link that should not have been clicked, employees frequently expose businesses to serious losses resulting from malicious software and lost information that they unwittingly initiate. As we have seen from the headlines, even businesses with the most robust and progressive cybersecurity protocols are falling victim to their own employees’ lapses in judgment.
Increasingly, businesses are suffering from an employee’s failure to adhere to its established culture of cybersecurity. A wave of social engineering frauds and fraudulent funds transfers are resulting in seven- and eight-figure losses that are transferred from a business’s accounts to those of bad actors, which are then swept clean before the fraud is detected and authorities notified. In most of these cases, an employee thinks that they are communicating by email, phone, voicemail, or text with a colleague, customer, or counterpart at another business. In actuality, the employee is communicating with an imposter that is using their knowledge of the business, the employee, or a third party to convince the employee to do something that they otherwise would not have done had they known all of the facts (e.g., purchase gift cards, wire money, grant access to computer systems, or open an attachment).
Fortunately, companies have options to limit their exposure to internal threats both innocent and malicious, but that means assessing the level of an employee’s access to systems, actively monitoring logs and detecting anomalies therein, and implementing policies and procedures that may slow down transactions by requiring in-person verification. A strong technical cybersecurity defense should also be supplemented with employee education at every level on common and emerging security risks. Email alerts should also be used when new risks are detected, as well as testing whether employees can resist falling for traps. Utilizing simple and clear instructions will help increase compliance and decrease mistakes. Encouraging the reporting of accidents without the threat of repercussion will help to quickly contain and remediate the effects of a cyber incident. Lastly, consider rewarding employees who have adopted your cybersecurity culture.
The biggest factor for enterprises to overcome to avoid breaches and cyberattacks is the human factor. From intentional acts by employees, independent contractors, or consultants that harm the company or its customers, to innocently opening a malicious email and its contents, organizations are vulnerable to trusted insiders whose authorized access to computer systems exceed their ability to remain vigilant for cybersecurity threats. Employing the cybersecurity best practices stated above is a good way to increase your employee’s cybersecurity IQ.
This article originally ran in Today’s Cybersecurity Leader, a monthly cybersecurity-focused eNewsletter for security end users, brought to you by Security Magazine. Subscribe here.
