Employees: The Biggest Threat to Security

With the rising frequency and intensity of data breaches, businesses are rightfully concerned about the potential compromise of their corporate data. Often ignored by the majority of enterprises, but widely understood among security experts, is the fact that the biggest security vulnerabilities usually lie within their own walls. These companies spend millions of dollars to protect themselves against a fast array of external cybersecurity threats, but neglect the internal risk and exposure created by their own employees.

In fact, the majority of today’s breaches can be traced directly back to internal negligence. Many hacks are successfully executed with information stolen from unwitting employees, which can be an expensive mistake. According to IBM, the average cost of a data breach is currently evaluated at $3.6 million globally. That gives organizations an incredible incentive to ensure that their employees are secure, but many don’t offer the appropriate training and thus can’t properly safeguard their workers.  The central issue is a lack of awareness. Employees who haven’t been trained in best practices for cybersecurity typically use weak passwords and are more likely to click on suspicious links that compromise employer systems and data. The trend of BYOD has also contributed significantly to the security problem.

Throughout the year, workers will often use personal and work devices interchangeably. This causes many normally innocuous behaviors to become suddenly risky, including sharing files over the cloud, downloading potentially malicious apps, clicking on phishing emails, participating in online games or simply listening to music. These quickly become gateways for cybercriminals to gain access to sensitive corporate information.

Many of the same issues that plague consumers are relevant for businesses as well. As discussed in our last Medium post, phishing is one of the most effective ways malevolent scammers can gain access to company data. Through communications or websites that appear to be from a trusted partner (such as an IT team), employees are conned into inadvertently downloading malware or sharing corporate login details. And this trick is effective beyond employees — the FBI found that it is often used to successfully swindle business executives as well.   The prevalence of and reliance on public Wi-Fi only amplifies this risk. When employees take their work devices outside of the corporate environment and access private work accounts on unsecure networks, they leave themselves and company data exposed to anyone monitoring the network with bad intentions. The opposite practice of workers bringing their personal devices to the office has similar risks. For example, connecting a personal cellphone infected with malware to the office Wi-Fi can give cybercriminals access to the corporate network.   As mentioned, the primary reason that these vulnerabilities exist is simply from poor awareness of cybersecurity and the risks of such actions. It is no longer enough for IT professionals to just be cyber-aware — an entire workforce needs to understand how easy it is to make mistakes and where vulnerabilities exist.

Thus, the best first step to securing employees is educating them on best practices to protect themselves and their corporate devices. Training personnel on cybersecurity awareness not only prevents them from endangering sensitive information, but it can also turn them into an effective first line of defense against suspicious activity or breaches.  From there, organizations need to establish policies and best practices for employee security. For example, some businesses may find it necessary for employees to utilize work laptops outside of the office, while others might consider other options to support remote workers. Once a company has a strong foundation for enterprise security among its employees, it can continue to build upon this framework and amplify it with security tools and programs.

There are many options to consider when mitigating potential enterprise vulnerabilities. Leveraging a two-factor authentication system for internal communications, including email, reduces the risks of any malicious phishing or data leaked from a compromised network. And corporations can secure basic employee web activities through web spoofing and encryption tools like a VPN or Puffin Browser.

Such programs allow for safe internet usage even on public Wi-Fi networks through heavily encrypted sessions on remote servers. And leveraging continuous endpoint monitoring allows IT teams to identify any initiated attacks or breaches — allowing for quicker response and resolution for issues.  Regardless of what strategies and tools are preferred — there’s a clear need for enterprises to protect themselves. Through employing personnel awareness training, clearly communicated procedures and policies, and the appropriate monitoring and cybersecurity software, businesses can significantly reduce the risk of a data breach.  Shioupyn Shen President & CEO