Cybersecurity and the Human Element

Businesses invest in many technologies to prevent cybercriminals from breaching their systems. By implementing firewalls, antivirus, and endpoint protection, organizations hope to put a barrier between an attacker and company data. These tools are very effective when implemented correctly, but there’s a catch. Cybercriminals often bypass perimeter security measures by focusing their efforts on one thing, humans.

That’s right; humans often play a critical role in data breaches. Attackers look for human errors to exploit or leverage social engineering tactics like phishing to obtain sensitive information and credentials. Once a cybercriminal possesses stolen credentials, they will look for ways to move laterally throughout your network.

Firms need to establish strong cybersecurity policies and provide user awareness training to minimize the human element. In fact, user training and awareness are so critical to cybersecurity that The Office of Compliance Inspections and Examinations (OCIE) identified them as key factors in its?Cybersecurity and Resiliency Observations report.

Cybersecurity Policies

To prevent users from putting your business at risk, create robust cybersecurity policies that include:

Password Policies

Make sure your organization has password policies. Two of the most common password problems are weak and reused passwords. Require your users to have strong passwords that are long and complex. Your policies should also prohibit users from reusing passwords.

Lastly, your organization should create a standardized schedule for password resets. A standardized schedule improves security and keeps password policies top of mind for users.

Clear Desk Policy

Cybercriminals may use in-person tactics. Implementing a clear desk policy can prevent an attacker who visits your organization, an employee who’s an insider threat, or someone who wants to capitalize on an opportunity from stealing or leaking data. Require users to lock their computers when they are not at their desks. Any document containing personally identifiable information (PII), intellectual property, or sensitive information should be locked in a restricted storage area to prevent unauthorized access.

Security Awareness Training

Cyberattacks have become more sophisticated, making it difficult for users to tell the difference between cybercriminals and trustworthy sources. KnowBe4 reported that “…1 out of 3 employees was likely to click on a suspicious link or email or comply with a fraudulent request…” in their?Phishing by Industry 2022 Benchmark Report. The good news is that this same report showed that users could substantially reduce their risky behaviors with phishing awareness training.

Human error often happens because users don’t understand the level of risk associated with their actions, and they are not familiar with the tactics used by cybercriminals.

Businesses should conduct user awareness training regularly. After users have completed awareness training, your organization should verify the effectiveness of that training by conducting a phishing test.

Reducing Risk

Even a human with the best intentions can make a mistake. Unfortunately, no matter how innocent the error is, it can lead to a breach. In addition to cybersecurity policies and user awareness training, implement tools to strengthen your access rights and controls, and monitor your network for suspicious activities.

Multi-factor Authentication

If an attacker obtains credentials to your business, having multi-factor authentication (MFA) implemented can prevent the attacker from accessing your network. With MFA, a user needs to enter another factor like a code via an app or text in addition to their username and password. So, an attacker would require a user's cellphone and credentials to log into their account.

Set Expectations with New Employees

A new trend has emerged that targets new hires directly, taking advantage of the victim’s status as a new employee. Attackers prey on those who have recently announced new roles on social media websites such as LinkedIn. Attackers find the target’s phone number on a data brokerage website and use it to send an SMS phish while pretending to be an executive from their new employer. The SMS phish will often ask for either gift cards or sensitive data. New hires must have appropriate security awareness training to combat this new social engineering tactic. Share with your employees what standard communication from the C-Level or executives in your company would look like so that it is easier to spot a fake. Lastly, new hires should be advised to limit posts about new positions on social media to give these threat actors fewer opportunities to strike.

Active Security Monitoring

Organizations can make the mistake of assuming that they have security monitoring when they only have performance monitoring. Security monitoring detects your network’s suspicious activities and security incidents, while performance monitoring only checks for functionality.

If a human error allows an attacker to access your network, security monitoring can help your security team detect the attacker’s activities. It can be difficult to identify an attacker’s behaviors when masked by a legitimate account. Implementing a security event and information management (SIEM) platform helps security analysts identify an attacker’s behavior by correlating activities across the network. SIEM platforms allow security teams to investigate a problem before it becomes a breach.

Holistic Cybersecurity

At the end of the day, humans make mistakes. The truth is a data breach can happen even with the best technology and user training. Taking a holistic approach to cybersecurity is the best way to mitigate your risk. Read more about lowering your risk and taking a holistic approach here.