95% of cyber security breaches are due to human error, which in reality means it could be any user, at any time. The best bit? They probably won't even know they're doing something wrong, but they have inadvertently just become an unintentional insider threat. As Andy Pearch, Head of IA Services, CORVID, explains, organisations need to stop playing the blame game and pointing fingers at users when the system is compromised and instead ensure they have the right technology in place to take back control of their security defences.
Unintentional insider threats.
A person becomes an unintentional insider threat when they unwittingly allow a cyber attacker to achieve their goal--whether that's a breach of systems or information, or diverting payments to a criminal's account. This can be through negligence or lack of knowledge, but can also be a result of just doing an everyday job.
Unintentional insider threats are particularly dangerous because the traditional methods of identifying insider threats don't work--they don't try to hide emails or files, because as far as they're aware, they're not doing anything wrong. If an attacker presents themselves as a legitimate person with the right credentials to request a change, the unsuspecting employee will probably respond exactly as the attacker was hoping.
Trusted employees have access to company-sensitive information, assets, and intellectual property, and permission to make financial transactions--often without requiring any further approval. Threat actors target these privileged, trusted people--impersonating suppliers, regulators, and known colleagues--and try to encourage them to do something they have permission to do, but shouldn't.
Removing reliance on users.
Email allows threat actors to communicate with users with almost no defensive barriers between them. Even the most diligent employee gets distracted, rushed, or slightly too tired, which is all it takes for a malicious email to achieve its objective--whether that's clicking a link, opening an attachment, or trusting the email's source enough to reply. Employees don't expect to be attacked in a safe office environment but threat actors prey on this perceived safety to catch them off guard and socially engineer them into doing something they shouldn't.
Many people think they know what a spam email looks like, but 97% of people are unable to identify a sophisticated phishing email. This is hardly surprising when considering there are...