Human Side Risks Cause of "Cyber" Disaster?

Interesting initial reporting on the Colonial Pipeline ransomware attack. Published sources, as of today, gloss over how the criminals gained access. Their focus is on the results of the break-in. Of course, the results are important. But to mitigate this risk, we must focus on the method of gaining access.

It's like a gang duped an employee into allowing them access to a bank's vaults. The gang once inside the vaults, drilled open safe deposit boxes, and stole gold, securities, cash, and valuables. Instead of focusing on the duping of the employee to gain access, the response is focusing on the results of the access. Immediate post-incident discussions revolve around the hardness of the safe deposit box metal, the locks on the boxes, vault alarms, and other technical issues.

Only one report hints that there may have been a Human Side to the access:

A ... cybersecurity firm ... said that the Colonial Pipeline cyber-attack might be due to an increasing number of engineers remotely accessing pipeline control systems from home owing to the COVID-19 pandemic. (emphasis added)

  As if engineers accessing systems from home caused ransomware to magically appear!

It's not "engineers accessing systems from home" that cause ransomware. It's engineers suffering manipulation at the hands of skilled human operators.

Harden the Human Side, and you reduce the need to constantly focus on the technical side. If the employee did not let the gang into the vault, there'd be no need to harden the metal in the safe deposit boxes.

Is your Human Side hardened?

What are you doing to mitigate the risks on your Human Side?