The human factor of cybersecurity: What’s putting you at risk

For any organization, continuously strengthening its cybersecurity posture is mandatory – especially in the wake of the recent surge of post-pandemic attacks. However, most cybersecurity strategies tend to focus on automated protection and mitigation, and only rarely look at things from the human angle.

1. Techniques putting you at risk

1.1. Social engineering

Social engineering is a deceptively effective way to steal credentials and gain access to even the most securely protected network. It works by preying on the most vulnerable people to fraudulently extract or extort information, and it’s mind-bogglingly effective: Social engineering reached over $250 million in damage just in 2020. Victims of social engineering can be baited, lured or coerced into providing their legitimate access credentials in many ways from posing as a tech department employee asking for info to impersonating a government agent who formally requests access. Deepfakes employing AI technology to create fraudulent images, videos or recordings of real people have made it even harder for humans to detect social engineering attempts.

2. Phishing-as-a-service solutions

Given how advanced natural language processing software has become, spotting a fake email is not as simple and immediate as it was before. And while they may look like a trivial threat, 90% of cyberattacks originate from email, causing nearly $6 trillion of damages in 2021 alone. In fact, phishing is such an effective and popular strategy among cybercriminals that, now, some of the most entrepreneurial cyber-actors have started selling phishing kits in the form of Phishing-as-a-Service (PaaS) solutions. With prices ranging from $20 to $200, less skilled fraudulent actors can now pay other more knowledgeable teams to carry out their attacks. https://growntechnology.com/experts-share-the-top-cloud-computing-trends-of-2022/

3. Convincing forgeries

It’s no secret that cybercrime spiked in the COVID-19 era. This trend continued as vaccines became widely available and cybercriminals began selling fake COVID-19 vaccination certificates online. These forgeries appear “identical to those being issued by many vaccination clinics,” according to a CBC News article from 2021.

2. Tactics for cybersecurity awareness

1. Artificial intelligence in employee training

Data indicates some less tech-savvy departments (such as sales) may reach miss rates as high as 40% so you must administer proper training to help your employees spot deep fakes, voice cloning, and other elaborate attack schemes. This remains true even if your employees use their own devices since email headers and SMS are harder to read and assess on mobile device apps. AI is able to learn which employees show the wrong behaviours and act accordingly to focus on those who need more training. It can also constantly integrate data from new threats to ensure the scenarios proposed are always fresh and up-to-date. That’s why AI will be indispensable for the future of employee cybersecurity awareness training. https://www.techopedia.com/2/28629/internet/social-media/7-sneaky-ways-hackers-can-get-your-facebook-password

2. SIEM and UEBA

No matter how much you train your employees, things can still go awry. So, you should always have a secondary layer of security in place. When someone still falls for the most ingenuous scam, the latest security incident and event management (SIEM) systems can still save the day by employing user and entity behaviour analytics (UEBA). UEBA leverages AI to recognize normal user behaviours and spot suspicious activities. If a given user, for example, starts executing a malicious process on their device.

No cybersecurity perimeter will ever be 100% safe, regardless of the technologies employed. Dangerous online bandits will keep lurking in the darkest corners of the internet, innovating new ways to lure those who lack the awareness to identify their fraudulent approaches immediately.

________________

𝐂𝐨𝐦𝐩𝐫𝐞𝐡𝐞𝐧𝐬𝐢𝐯𝐞 𝐭𝐞𝐜𝐡𝐧𝐨𝐥𝐨𝐠𝐲 𝐬𝐨𝐥𝐮𝐭𝐢𝐨𝐧𝐬 𝐟𝐨𝐫 𝐛𝐮𝐬𝐢𝐧𝐞𝐬𝐬𝐞𝐬.