Blog

The employee element in IT security is a significant determinant of data security

Most of the data breaches resulting from insider threats are completely unintentional

Keeping your data safe begins with the acceptance that your security is as strong as your weakest employee’s understanding of cybersecurity

 The pandemic has changed the way we function and made working from home the new order of how things are to be in the future. Unfortunately for corporates, while on-premises security was managed with much prudence, the new order has posed a separate set of unfathomable challenges. Furthermore, a lack of preparedness has put organizational data at greater risk. The situation has been compounded by the fact that cybercriminals are leaving no stone unturned to find loopholes and launch attacks.  

The employee element in IT security is a significant determinant of data security. In recent years, cybercriminals are relying more and more on the human factor to succeed with their attacks. It may surprise you to know that 95% of cybersecurity breaches are caused by human error and the average cost of a data breach was roughly around $3.86 Mn in 2020. One wrong click and you open the flood gate to cyberattacks. When it comes to mass remote working, the security challenges cannot be ignored. Cyberattacks are getting more and more sophisticated by the minute. Today the greatest cyber threat that an organization faces  is the insider threat.

Some of the cyberattacks that have taken place in the past year include remote user credential theft, phishing emails with malware, malicious websites, and ransomware attacks. In most cases, it has been an unsuspecting employee clicking on the bait for the cybercriminal to launch their attack. Most of the data breaches resulting from insider threats are completely unintentional. However, that does not completely indemnify the fact that malicious insider intent is a possibility.

To combat these risks, a cohesive approach to security is essential — one that effectively addresses not only insider and outsider threats, but efficiently manages both unintentional and intentional threats posed by those within an organization.

Acknowledging The Insider Threat Possibility

Keeping your data safe begins with the acceptance that your security is as strong as your weakest employee’s understanding of cybersecurity and the latent complacency towards the adherence of security protocols. From inadvertently introducing a virus through a download, accepting malware through a phishing exploit, introducing a corrupted mobile device to the corporate network, or not updating security settings, using simple passwords, doing secure work on public wifi, the challenges can be plentiful.

Let us look at some of the most basic practices that need to be inculcated for preventing an insider breach, however with a word of caution, that this does not foolproof the system.

Poor password practices: This is one of the most common mistakes made by employees. All it takes is for one employee with a password like “password” or “12345678” for a hacker to gain easy access to your company’s valuable and sensitive information. 

To combat this, you need to design a well-enforced password policy. Ensuring that passwords are changed regularly and cater to some basic requirements is a starting point for strengthening your data security. You can also use a password management system. 

Access policies: Another aspect that makes your data vulnerable are weak access policies. Your employees should only have access to relevant files and systems — and such access should be revoked when the work is done. If this is not followed, a cached copy of your confidential data can be created on your employee’s personal workstation and the same can be hacked with ease. 

Your system administrator needs to enforce a strict access policy. While this may turn out to be a hassle for your employees, it is a simple yet effective way to avoid a data breach in the long run. 

Apply deep-tech analytics: Humans are creatures of habits. They behave the same way, prefer to do familiar tasks, and interact with technology the same way. Analytics and deep-tech can uncover aberrations in behavior even at the individual employee level which can make it easier to spot early warning signs of a system breach.

Risk of downloads: Remote working also means that employees are in charge of their own workstation and the kind of files they download could end up being a potential risk for the entire organization. It could be anything from a productive app or a malicious link download through email. Such a threat will likely spread through your network and make your data vulnerable for everyone. Phishing and social engineers have the power to exploit and gain access to important data. Every mistake has a high cost. 

Some basic things you can do are running a virus scanner, backing up your data at regular intervals, and having a strong disaster recovery plan in place. Another best course of action is to block network access to suspicious websites such as torrents. To prevent phishing, you need to educate your employees on how to prevent phishing attacks and recognize and report red flags. 

The Path Ahead

Organizations should invest in continual employee training and test their understanding of cybersecurity policies and systems in place. In today’s digital world, cybersecurity is not a need, it’s a culture that needs to be infused to ensure business success and sustainability.  Acting in cohesion has never been more important. By working together with employees and patching holes in the security system, one can forestall cybercriminals from hacking the weakest point — employees.