Human Factor in Cyber Security: What the Stats Say

As connected tech becomes increasingly ubiquitous, most of us tend to grow lax with security — especially if we haven’t experienced an attack. It’s tempting to believe lies like, “No one falls for that stuff anymore.” Or, when our freedom seems threatened, to say, “There’s no reason to get extreme about security protocol.”

But the human factor in cybersecurity data tells a different story. In 2018, hackers stole $500 million in personal records — 126% more than they did in 2017. One source estimates 44 records are stolen through cyber security breaches every second!

The stats about the human factor in security are confusing, but they all point in the same direction. For example, one study found that:

• 71% of breaches come from careless mistakes made by employees
• 68% are the result of employee negligence
• 61% come from someone acting with malicious intent

Another study tells a more disconcerting story: the human factor in cyber security is the cause of 90% of data breaches.

Whatever stats you reference, the most significant risk to an organization’s data does not come from bad actors. Instead, they come through simple, everyday mistakes — clicking the wrong link, giving information to the wrong person, or neglecting to follow an established policy.

Unfortunately, too many organizations aren’t doing what it takes to build and empower their internal cyber defense team combat the problem.

• Only 45% have mandatory training in cybersecurity
• Only 33% have a cyber security breach response plan
• 90% of the people who should know better — IT pros! — underestimate the possibility of a phishing attack.

Organizations are rapidly working to build internal Human Factors Cybersecurity Teams.  Often, these new business units report directly to the most senior executives.  However, finding qualified, experienced and highly training cybersecurity resources is a challenge as the supply of these individuals is far behind the demand.  Some reports indicate that there will likely be 3.5 million unfilled cybersecurity jobs in 2021.

Cyber Security Threat Vectors — The Human Factor

Employees and subcontractors can leave an open door to hackers in a variety of ways. And since hackers find and exploit simple mistakes, vigilance is key.

Here are some possible avenues of attack, aka “Threat Vectors.”

Threat Vector #1: Social Engineering / Phishing Scams

Phishing is the most common — and most pernicious — Threat Vector. It’s easy to gain access to employees through a simple email or phone call.

Though everyone’s familiar with the “foreign prince” scam by now, hackers have moved on. They use advanced psychology to trick victims, tailoring their attacks to those they’re targeting in the absence of awareness about cyber security human factors.

First, Business Email Compromise (BEC) scams are emails designed to trick employees into giving up corporate information or passwords. They include subject lines containing words or phrases like “Urgent,” “Past Due,” or “Your Account May Be Suspended.” A link inside the email will usually lead to a familiar-looking webpage asking for a password.

Spear Phishing finds ways to imitate trustworthy colleagues, friends, or corporations. Well-designed and hard to spot, techniques include breaching human factor security:

• Email Spoof: Though “systemadministrator@apple.com” may spell “apple” with a lower-case “L,” a spoof will spell “appIe” with an upper-case “i”.
• Domain Spoof: This is a fake email address created with a friend’s or colleague’s name plus “@yahoo.com” (or similar).
• Close Cousin Spoof: Here, hackers add a slight modification to a familiar domain name. For example, com can become trustedsourceglobal.com or trustedsource.xyz.com.

Whaling Phishing targets high ranking members in a company. These are usually created by smart hackers who have done their homework, know their victim, and have devised an especially focused entrapment scheme.

Vishing, or Voice Phishing, is a technique where fraudsters trick targets into giving out sensitive data over the phone. Though the old schemes are easy to catch — poor quality phone connections and demands for data — new schemers use advanced manipulation tactics. Contact Center employees are especially vulnerable.

Threat Vector #3: BYOD (Bring Your Own Device)

When companies allow employees to use their own devices, the result can be a win-win. Generally, staff members are happier and more productive when using their own devices, and the organization saves money in the short term.

However, cyber security policies often don’t keep up with BYOD. Since IT departments rarely (if ever) scan or review personal devices, risks present themselves when employees:

• Use unfiltered or unsecured Wi-Fi
• Install an app with hidden malware
• Access a corporate network through a compromised device
• Lose a device containing sensitive data
• Leave a company but keep corporate apps and data saved on their device

Threat Vector #5: Remote Workers and External Vendors

When employees work from home or public places, it’s vital to create and communicate policies and procedures to protect data.

External vendors and subcontractors bring their own bad habits, dysfunctions, and therefore cyber security human factor risks with them. They can do much damage if:

• Their devices go unscanned
• They don’t understand corporate policy clearly
• They have unsegmented access to the network
• The end of their contract doesn’t coincide with a loss of access
• They don’t participate in company-wide training

All of these off-campus workers are prone to access the Internet over unsecured Wi-Fi in coffee shops, airports, and at home.

Cyber Security
Closing the Gap on the Human Element

It’s easy for employees and contractors to make mistakes that can cost an organization millions of dollars, expose sensitive information, and damage reputation for years to come in the absence of cyber security human factor awareness.The variety of scams and the propensity for human factors in cyber security make it all too easy for hackers to take advantage.

But every organization can help keep “the human element” at bay:

• Limiting access and properly segmenting servers
• Keeping a close eye on the work of subcontractors
• Solidifying security protocol and best practices guidelines
• Clearly sharing those guidelines

Even so, we all tend to forget what we’ve learned. Employees need regular and detailed training on cybersecurity human factor risks. They should be able to spot a current phishing scheme and know how to report it. And employees should feel comfortable reporting mistakes immediately.

This is true throughout the organization — members of the C-Suite can’t miss out on trainings on human factor risks in cyber security or subvert policies. No one can be “above the rules.”