Human error is still the greatest threat to security

Several studies, including the Italian Cyber Security Report 2014, identify users’ poor awareness of threats and the mistaken behaviour they adopt among the main causes of vulnerability to cyber attacks.

A 2018 study by the Information Security & Privacy Observatory of the Politecnico di Milano, covering a sample of 667 Italian organisations, found that among the main vulnerabilities were precisely employees’ distraction and poor awareness (82% of cases), an obsolete IT architecture (41%) and updates not carried out regularly (39%).

An IT system, even a meticulously protected one, may no longer be reliable in the face of an operator’s mistake. This is why, in addition to investing in and adopting an effective cyber protection system, companies must invest in training their employees in the good habits to adopt so as not to be tricked.

There are of course strategies that can be put in place to address these aspects. Training and spreading a culture of cyber security are important steps, but the choice of technology solutions, and the approach taken to them, is also a factor not to be underestimated.

While it is true that no technology is invulnerable and everything can be attacked, it is also true that adopting the right tools makes defence much easier. And what is often forgotten is that prevention costs far less than intervening once cyber incidents have already happened.

Email and phishing

Email remains in first place as the main attack vector. An attack by email is much simpler and causes greater damage than attacks via malware.

It is estimated that in the first three months of 2018 the global financial loss caused by email fraud amounted to 12.5 billion dollars, with over 90% of companies affected and a 103% year-on-year increase.

Phishing, in which a malicious actor tries to deceive the victim into providing personal information, financial data or access codes by posing as a trustworthy body in a digital communication, is one of the most popular online scams.

Public administrations themselves, despite investing in technology solutions to safeguard information security, are the most affected by phishing, which exploits the employee as the weak link.

Identity theft, especially via email, is constantly increasing. In most cases credentials are cloned, perhaps to trick business associates into carrying out financial transactions that are actually intended for the criminal. The famous man in the middle.

Types of human error

“Human error” means unintentional or accidental actions. It is the leading cause of data and security breaches. The most common types of breach occur when data is sent to the wrong person.

There are 3 types of human error. Understanding the differences and how they can occur can help prevent the compromise or loss of system data.

• Lack of Skill in using the applications provided
• Lack of Knowledge when unexpected situations arise
• Lack of Regulation on the procedures to follow

The growing culture of BYOD (Bring Your Own Device) raises further concerns, especially the risk of mobile devices being lost or stolen. Technology is available to help companies control what happens to the data stored on such devices, even allowing sensitive data to be wiped remotely so that it does not fall into the wrong hands.

Even the most trusted and highly skilled employees run a significant risk of human error. System and network administrators are commonly guilty of system misconfigurations, poor patch management practices and the use of default usernames and passwords. There are numerous security controls that organisations can explore to protect themselves against this type of threat.

Attackers know exactly how to exploit human curiosity

Cyber criminals are targeting people’s interests, but the success of this technique does not depend entirely on end users making mistakes. Social engineering is a common technique used by attackers to mislead.

Today, websites are increasingly being compromised, because users would habitually use them without thinking twice.

People, processes and technology

As with mistakes made solely by users themselves, such as the unintentional sending of sensitive data outside the organisation, there are technologies available to organisations to help protect against external factors that target individual users in the hope of inducing them to make mistakes.

To curb mistakes made through social engineering and to raise staff awareness, technology and processes must be combined with training on the threats and on the role that people should play in protecting against them.

The security of organisations depends on the constant education of employees in identifying suspicious cases and new potential risks.