Naive employees often a risk to cyber security
Often, the greatest threat to the data security of any organisation is traced to an oblivious employee who has inadvertently brought a company to its knees by allowing confidential data to be hacked.
Cyber forensic security expert, Rudi Dicks, director of The Cyber Academy explains, “A data breach can cost an organisation millions of rand and worse, its reputation. Even with excellent information, security teams and robust technologies in place, the weakest link is often a user within the company that has been manipulated by a malicious attacker who is then able to access the sensitive information that the user is authorised to view.”
“While data leaks can be orchestrated by a disgruntled worker or a corporate spy who is familiar with the organisation, most data breaches occur because of avoidable human error. As malicious attackers constantly use new and innovative methods, companies can’t keep implementing new technologies to mitigate these.” Cyber-attacks continue to make headline news, such as the recent hack info Liberty’s data and the Cathay Pacific attack which saw the personal information of 9.4 million customers leaked.
Current estimates indicate that more than 90% of cyber-attacks can be attributed to human error. Dicks says the easiest method of attack is fo manipulate an employee and therefore the best security intervention is to raise awareness among staff. “Technology can’t help a human problem which involves someone manipulating an employee or contractor to perform an action or divulge confidential material. “In one instance, a stranger came onto the premises for an alleged job interview, told the receptionist he had spilled coffee on his CV, handed her a USB and asked her to print it for him. Once the USB was inserted to her computer, the attacker gained remote access to that machine and from there, the entire network.”
The Cyber Academy works with companies to protect them from cyber-attacks by raising awareness and training staff to ensure that cyber protection and data security are maximised. “Our trainers have real-world hacking experience and remain thoroughly engaged with the current cybercrime landscape and, most importantly, they understand the attackers’ mindsets. Social engineering attacks such as phishing, vishing, spoofing and ransomware are all cyber-attacks that continue to grow in frequency and sophistication at alarming rates.” Dicks adds that physical security is a basic but often overlooked form of defence.
Staff must report all strangers they see in the office that are not clearly marked with a visitor’s access card. Access to the building needs to be rigorously managed. Unknown USBs may not be used, and sensitive information should be shredded. Password protection policies must be strictly adhered to. With the advent of social media, people’s interests are publicly available and hackers often use it to manipulate them. This is exacerbated by the number of digital devices that people now have.
Types of cyber security risks:
- Phishing uses disguised email as a weapon. The email recipient is tricked into believing that the message is something they want or need – a request from their bank, for instance, or a note from someone in their company- and the recipient then clicks a link or downloads an attachment.
- Vishing is a similar type of attack where voice is used instead of email Attackers will phone a victim to prime an attack or ask to guide them through changing settings or disclosing a password.
- Spoofing sees attackers impersonating people familiar to the victim either by sending an email as someone else or changing the address very slightly to appear as if from the legitimate sender.
- Pharming attacks involve a hacker sending the same email to many recipients and then waiting to see which recipients respond.
- Whaling is a specific form of phishing that personalises the attack towards high-profile people in senior-positions.
- Ransomware occurs when data is encrypted within an organisation. The hacker then requests payment in Bitcoin to receive a code to unlock the user’s files.