The biggest threat to the data security of any organization is often traced to an oblivious employee who has an inadvertently brought a company to its knees by allowing confidential and sensitive data to be hacked.
Cyber forensic security expert, Rudi Dicks, director of The Cyber Academy, said: “A data breach can cost an organization millions of rand and worse, its reputation.
He also said, “Even with excellent information, security teams and robust technologies in place, the weakest link is often a user within the company that has been manipulated by a malicious attacker who is then able to access the sensitive information that the user is authorized to view.”
He said that while data leaks can be orchestrated by a disgruntled worker or a corporate spy who is familiar with the organization, most data breaches occur because of avoidable human error.
“As malicious attackers constantly use new and innovative methods, companies can’t keep implementing new technologies to mitigate these.”
Cyber attacks continue to make headline news such as the recent hack into Liberty’s data and the Cathay Pacific attack which saw the personal information of 9.4 million customers leaked.
Current estimates indicate that more than 90% of cyber attacks can be attributed to human error.
Dicks said the easiest method of attack is to manipulate an employee and therefore the best security intervention is to raise awareness among staff.
“Technology can’t help a human problem which involves someone manipulating an employee or contractor to perform an action or divulge confidential material.
Dicks said, “In one instance, a stranger came onto the premises for an alleged job interview, told the receptionist he had spilled coffee on his CV, handed her a USB and asked her to print it for him. Once the USB was inserted to her computer the attacker gained remote access to that machine and from there, the entire network”.
Physical security is a basic but often overlooked form of defense, said Dicks. “Staff must report all strangers they see in the office that are not clearly marked with a visitor’s access card. Access to the building needs to be rigorously managed.
“Unknown USBs may not be used and sensitive information should be shredded. Password protection policies must be strictly adhered to – people are still writing their passwords on a piece of paper.”
With the advent of social media, people’s interests are publicly available which often hackers use to manipulate. This is exacerbated by the number of digital devices that people now have.
Types of cybersecurity risks:
- Phishing: It uses disguised email as a weapon. The email recipient is tricked into believing that the message is something they want or need — a request from their bank, for instance, or a note from someone in their company — and the recipient then clicks a link or downloads an attachment.
- Vishing: It is a similar type of attack where the voice is used instead of email. Attackers will phone a victim to prime an attack or ask to guide them through changing settings or disclosing a password.
- Spoofing: sees attackers impersonating people familiar to the victim either by sending an email as someone else or changing the address very slightly to appear as if from the legitimate sender.
- Pharming: attacks involve a hacker sending the same email to many recipients and then waiting to see which recipients respond.
- Whaling: is a specific form of phishing that personalizes the attack towards high-profile people in senior positions.
- Ransomware: occurs when data is encrypted within an organization. The hacker then requests payment in bitcoin to receive a code to unlock the user’s files.
