Employees hide IT security incidents in 44% of businesses in Saudi Arabia \u2013 that\u2019s according to a new report from Kaspersky Lab and B2B International, \u201cHuman Factor in IT Security: How Employees are Making Businesses Vulnerable from Within\u201d. With 46% of IT security incidents caused by employees each year globally, this business vulnerability must be addressed on many levels, not just through the IT security department.<\/p>\n\n\n\n
Uninformed or careless employees are one of the most likely causes of a cybersecurity incident \u2014 second only to malware. While malware is becoming more and more sophisticated, the sad reality is that the evergreen human factor can pose an even greater danger.<\/p>\n\n\n\n
In particular, employee carelessness is one of the biggest chinks to incorporate cybersecurity armor when it comes to targeted attacks. While advanced hackers might always use custom-made malware and hi-tech techniques to plan a heist, they will likely start with exploiting the easiest entry point \u2013 human nature.<\/p>\n\n\n\n
According to the research, targeted attacks on businesses in the last year had phishing\/social engineering at its source. For example, a careless accountant could easily open a malicious file disguised as an invoice from one of a company\u2019s numerous contractors. This could shut down the entire organization\u2019s infrastructure, making the accountant an unwitting accomplice to attackers.<\/p>\n\n\n\n
\u201cCybercriminals often use employees as an entry point to get inside the corporate infrastructure. Phishing emails, weak passwords, fake calls from tech support \u2013 we\u2019ve seen it all. Even an ordinary flashcard dropped in the office parking lot or near the secretary\u2019s desk could compromise the entire network \u2014 all you need is someone inside, who doesn\u2019t know about or pay attention to security, and that device could easily be connected to the network where it could reap havoc,\u201d says David Jacoby, Security Researcher at Kaspersky Lab.<\/p>\n\n\n\n
Sophisticated targeted attacks do not happen to organizations every day \u2013 but conventional malware does strike at mass. Unfortunately, though, the research also shows that even where malware is concerned, unaware and careless employees are also often involved, causing malware infections in their businesses.<\/p>\n\n\n\n
Hide and seek: why HR and top management should get involved
Staff hiding the incidents they have been involved in may lead to dramatic consequences, increasing the overall damage caused. Even one unreported event could indicate a much larger breach, and security teams need to be able to quickly identify the threats they are up against to choose the right mitigation tactics.<\/p>\n\n\n\n
But staff would rather put organizations at risk than report a problem because they fear punishment, or are embarrassed that they are responsible for something going wrong. Some companies have introduced strict rules and impose extra responsibility on employees, instead of encouraging them to simply be vigilant and cooperative. This means that cyber protection not only lies in the realm of technology but also in an organization\u2019s culture and training. That\u2019s where top management and HR need to get involved.<\/p>\n\n\n\n
\u201cThe problem of hiding incidents should be communicated not only to employees but also to top management and HR departments. If employees are hiding incidents, there must be a reason why. In some cases, companies introduce strict, but unclear policies and put too much pressure on staff, warning them not to do this or that, or they will be held responsible if something goes wrong.<\/p>\n\n\n\n
Such policies foster fears and leave employees with only one option \u2014 to avoid punishment whatever it takes. If your cybersecurity culture is positive, based on an educational approach instead of a restrictive one, from the top down, the results will be obvious,\u201d comments Slava Borilin, Security Education Program Manager at Kaspersky Lab.<\/p>\n\n\n\n
Borilin also recalls an industrial security model, where a reporting and \u2018learn by mistake\u2019 approach are at the heart of the business. For instance, in his recent statement, Tesla\u2019s Elon Musk requested every incident affecting worker safety to be reported directly to him, so that he can play a central role in change.<\/p>\n\n\n\n
The human factor: corporate climate and beyond
Organizations around the world are already waking up to the problem of their staff making their businesses vulnerable: 42% of companies surveyed in Saudi Arabia admit that staff is the biggest weakness in their IT security. The need to implement personnel-focused measures is becoming more and more evident: 37% of Saudi businesses are looking to improve security through delivering training to staff, making this the second most popular method of cyber defense. This ranks second only to the deployment of more sophisticated software, as per 41% of Saudi businesses.<\/p>\n\n\n\n
The best way of protecting organizations from human-related cyber threats is to combine the right tools with the right practices. This should involve HR and management efforts, to motivate and encourage employees to be watchful and seek help in the case of an incident. Security awareness training for staff, delivering clear guidelines instead of multipage documents, building strong skills and motivation, and fostering the right working atmosphere, are the first steps organizations should take.<\/p>\n\n\n\n
In terms of security technologies, most of the threats aimed at targeting unaware or careless employees – including phishing – can be addressed with endpoint security solutions. These can cover the particular needs of SMB and enterprise companies in terms of functionality, pre-configured protection, or advanced security settings, to minimize risks.<\/p>\n\n\n\n
To read the full report \u201cHuman Factor in IT Security: How Employees are Making Businesses Vulnerable from Within\u201d, visit our blog.<\/p>\n","protected":false},"excerpt":{"rendered":"
Employees hide IT security incidents in 44% of businesses in Saudi Arabia \u2013 that\u2019s according to a new report from Kaspersky Lab and B2B International, \u201cHuman Factor in IT Security: How Employees are Making Businesses Vulnerable from Within\u201d. With 46% of IT security incidents caused by employees each year globally, this business vulnerability must be […]<\/p>\n","protected":false},"author":2,"featured_media":5789,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_yoast_wpseo_meta-robots-noindex":"","_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","_pr_autopilot_social_copy":"","_yoast_wpseo_opengraph_title":"","_yoast_wpseo_opengraph_description":"","_yoast_wpseo_opengraph_image":"","_yoast_wpseo_opengraph_image_id":0,"_yoast_wpseo_twitter_title":"","_yoast_wpseo_twitter_description":"","_yoast_wpseo_twitter_image":"","_yoast_wpseo_twitter_image_id":0,"_yoast_wpseo_primary_category":439,"_extra_hide_author_box":"1","_extra_featured_post":"","_partner_post_id":0,"footnotes":""},"categories":[439],"tags":[],"class_list":["post-5787","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","et-has-post-format-content","et_post_format-et-post-format-standard"],"yoast_head":"\n