Preventing human error

If you have read our article on the role of human error in cyber security breaches, you will know that human error is the main cause of over 90% of breaches. This is a frightening statistic, but also a very useful one.

Since the vast majority of corporate data breaches are due to human error, it is easy to know where to start when drawing up a plan to protect your company.

So, how do you reduce human error in your company?

1. Principle of Least Privilege

The Principle of Least Privilege is the IT version of the “need to know” principle. It means that every user starts with the minimum privileges and is granted more when required.

By using the Principle of Least Privilege you reduce the number of actions each of your employees can perform, while still allowing them to access everything they need to do their job. This means that if an employee’s account is compromised, unauthorised access will be limited to the operations that specific employee has the privilege to carry out.

2. Awareness Campaign

Much human error stems from employees not knowing the risks.

Awareness is most easily delivered through campaigns and reminders, which might include general basics, tips and advice more directly related to your company’s operations.

3. Reduce Password Restrictions

Passwords are an irreplaceable part of cyber security, but users who are “overloaded” with passwords will always look for the easiest – and least secure – ways to get around the problem.

While a complex password policy is essential, the best way to reduce human error around passwords is, first of all, to reduce their number. This can be achieved by using password managers or Single Sign On systems – with multi-factor authentication enabled to increase security – and by moving to devices with biometric authentication such as fingerprint recognition.

4. Change the Security Paradigm from Passive to Proactive

Cyber security tends to be something the average employee forgets about until the worst happens. Encourage your employees to spend time learning about cyber risks, and reward them for being proactive in looking for potential risks and countermeasures.

A proactive security culture will help ensure that cyber security is always taken into account when your company makes changes to the tools it uses or to the way it works.

5. Continuous Training

To keep employees engaged with cyber security requirements and maintain awareness of the different types of risk, training should be continuous and flexible.

A good training programme will focus on identifying the specific risks to which your employees and your company are vulnerable, and will train your employees on the most important aspects of security according to their unique risk profiles.