Alerts and Advisories 4 March 2021

Human Error in Cyber Security

advisory thumbnail

Advisory
4 MAR 2021

BACKGROUND 

Making mistakes is a core of the human experience – it is how we learn and grow. In Cyber Security, human mistakes are often overlooked. 

In a security context, human error means unintentional actions – or lack of action – by employees and users that cause, spread or allow a security breach to take place. The weakest link is non-IT personnel as their actions might become an attack vector for the attacker. 

The top cyber security challenges faced in Negara Brunei Darussalam which involves human error are: 

  • Ransomware attack 
    A type of malicious software that infects computers and displays messages demanding a fee to be paid for the system to work again, either by locking the system’s screen or files. This class of malware is a criminal moneymaking scheme that can be installed through deceptive links in an email message, instant message, or website. 
  • Phishing attacks 
    A form of identity theft in which a scammer uses an authentic-looking email to trick recipients into giving out sensitive personal information such as credit card and bank account details. 
  • Software vulnerabilities 
    An identified glitch or weakness in software which can be exploited to cause damage. Outdated and unpatched programs also lack security features. Software downloaded from unauthorized sources often include malware and viruses, so stay away from programs offered by suspicious websites and sources.
  • Bring Your Own Device (BYOD) 
    Employees using personal devices to connect to their organizational network and access work-related systems and confidential data. This may lead to malware infection to the organizational network infrastructure and devices. 
  • Business Email Compromised (BEC) 
    A type of scam targeting organizations and victims who conduct fund transfers and have suppliers abroad. BEC attacks usually involve planning and research to be effective. For example, any information about the target organization’s executives, employees, customers, business partners and potential business partners. 
  • Misconfiguration of Security and network devices 
    Misconfigurations are often seen as an easy target. It arises when systems or database administrators or developers do not properly configure the security framework of an application, website, desktop, or server leading to dangerous open pathways for hackers. Security devices includes Firewalls, switches, routers etc. 
  • Password attack 
    A password attack is a type of cyber attack where an attacker tries to guess, or “crack” a user’s password. There are many different techniques for cracking a user’s password, which includes Brute-Force attack, Dictionary attack, Rainbow Table attack, Credential Stuffing, Password Spraying and Keylogger attack. 

 

CAUSES AND IMPACT 

Based on a study by IBM, human error contributes 95% of cyber security breaches. This could lead organizations to be exposed to various vulnerabilities. 

Examples of human error: 

  • User clicking on malicious links in phishing emails 
  • The fact that the emails appeared to have come from higher management, mimic the official emails that the employees are familiar with 
  • Humans often overlook their own mistakes 

 

RECOMMENDATIONS 

Cyber Security Awareness Training 

Prioritize cyber security at the human layer especially employees by conducting awareness training on all core security topics. Employee awareness training should be the key strategy to combat human negligence attacks. By constantly educating employees about identifying and reporting suspicious risks, organizations can help regulate safety standards. 

Privilege control

Limit access to the data and functionality that users need to perform their roles. 

Password management 

123456 remains the most popular password in 2020. Passwords should be at least 10 characters long and consist of small letters, capital letters, numbers and symbols or special characters. It must not be reused and must be changed every 3 months. In addition to not creating strong passwords, untrained users often make other common mistakes including writing it down on sticky notes pasted to their monitors or sharing passwords with their colleagues. 

Policy implementation 

All organizations should have a proper and simple IT Security policy in place. In many cases, policies are delivered in quite a complicated way that can’t easily be absorbed by employees. Many organizations give multi-page documents that everyone signs but very few read, and even less understand. 

Installing updates and patches 

It is absolutely essential that users install security updates on their computers and mobile devices as soon as they are available. 

Physical security errors 

Confidential information and credentials can be stolen by unauthorized persons who gain access to secure premises, especially if sensitive documents are left unattended on desks, printer output trays, photocopier or even meeting rooms. A common physical error is allowing an unauthorized person to follow someone through a secure door. 

 

REFERENCES