You may not realise this but a high percentage of security breaches in business’ are connected to or caused by people within an organisation. In 2020 the statistics showed that 38% of breaches were attributed to human error in Australia, and instead of decreasing this metric is on the rise.
Knowing this and understanding how these breaches occur are the first steps to ensuring the security of your business data. Human error is random, potentially making users the weakest link. So, let’s have a look at the most common ways people create risk at work with simple actions.
Why Attackers Target Employees
Why are employees the most vulnerable? Cyber attackers like to use social engineering to exploit human behaviour and coax a monetary return for themselves through employee error or negligence. Usually, through phishing, they engage with employees using malicious intent.
Employees are more likely to open emails by rote and download harmful content without realising it when they are busy or distracted.
Attackers may:
- Install Ransomware that encrypts company files and data until a ransom is paid.
- Facilitate the theft of source codes, the personal details of employees, and client information.
- Engage in blackmail.
- Engage in industrial espionage.
- Damage the company’s brand and reputation.
- Disrupt services or production.
- And more.
Where You May Be Most Exposed
The risks attackers exploit are often easy to plug. These are the three areas where breaches using employees may happen.
Maintain Passwords as a Secure Gateway
We need a password for almost everything we interact with online. Trying to maintain them as unique and keeping track of them all is a mammoth task, and this is where users often become apathetic.
When passwords are stolen or broken, hackers can access your data. It is in your best interest to inform your staff about the potential hazards and establish a companywide policy for regular password revision to reduce the risk.
Warn About the Dangers of Phishing
Phishing attacks are often preventable – if only that person doesn’t open this link in that email. Seems easy, yet it still happens far too often. Attackers target login credentials, company data, and financial details, usually through email.
Employees need to be aware of what potential phishing emails look like, that they are primarily emotional manipulation, and what to do if a communication they receive seems suspicious.
Updating Protection is an Easy Fix
Malware can be dealt with using robust security software, yet users fail to install solutions (on all devices), and if it is in place, don’t take the necessary steps to keep it up to date.
Attackers are continuously refining and redeveloping their attacks. To stay current, patches and updates are developed and if they are not installed your security is compromised.
Taking a moment to update is an easy fix.
Reducing Business Wide Vulnerabilities
Addressing the problem across your business to reduce your vulnerability can be as simple as:
- Providing in-depth training to employees that includes the different types of risks and how they may present.
- Conducting risk assessments regularly on your employees to ensure they are following the prescribed security protocols.
- Devising incentive schemes to encourage employees to think about security.
- Regular Vulnerability Assessment and Penetration Testing (VAPT).
A Few Last Words
With more people working from home in 2020/21, attacks in general have increased to take advantage of home systems that may not have optimal protection because businesses had to quickly pivot to stay afloat.
We have more time to plan now and one of the issues that always needs to be top of mind for your business is security, regardless of where your workers are located and the devices they use.
Your security needs depend on the size of your business, but you will always have people working for you. Support them in creating security awareness and you are already starting to reduce your risk.
