The greatest threat to the data security of any organisation is often traced to an oblivious employee who has inadvertently brought a company to its knees by allowing confidential and sensitive data to be hacked.
Cyber forensic security expert, Rudi Dicks, director of The Cyber Academy, said: “A data breach can cost an organisation millions of rand and worse, its reputation.
“Even with excellent information, security teams and robust technologies in place, the weakest link is often a user within the company that has been manipulated by a malicious attacker who is then able to access the sensitive information that the user is authorised to view.”
He said that while data leaks can be orchestrated by a disgruntled worker or a corporate spy who is familiar with the organisation, most data breaches occur because of avoidable human error.
“As malicious attackers constantly use new and innovative methods, companies can’t keep implementing new technologies to mitigate these.”
Cyber attacks continue to make headline news such as the recent hack into Liberty’s data and the Cathay Pacific attack which saw the personal information of 9.4 million customers leaked.
Current estimates indicate that more than 90% of cyber attacks can be attributed to human error.
Dicks said the easiest method of attack is to manipulate an employee and therefore the best security intervention is to raise awareness among staff.
“Technology can’t help a human problem which involves someone manipulating an employee or contractor to perform an action or divulge confidential material.
“In one instance, a stranger came onto the premises for an alleged job interview, told the receptionist he had spilled coffee on his CV, handed her a USB and asked her to print it for him. Once the USB was inserted to her computer the attacker gained remote access to that machine and from there, the entire network,” said Dicks.
Physical security is a basic but often overlooked form of defence, said Dicks. “Staff must report all strangers they see in the office that are not clearly marked with a visitor’s access card. Access to the building needs to be rigorously managed.
“Unknown USBs may not be used and sensitive information should be shredded. Password protection policies must be strictly adhered to – people are still writing their passwords on a piece of paper.”
With the advent of social media, people’s interests are publicly available which often hackers use to manipulate. This is exacerbated by the number of digital devices that people now have.
Types of cyber security risks:
- Phishing uses disguised email as a weapon. The email recipient is tricked into believing that the message is something they want or need — a request from their bank, for instance, or a note from someone in their company — and the recipient then clicks a link or downloads an attachment.
- Vishing is a similar type of attack where voice is used instead of email. Attackers will phone a victim to prime an attack or ask to guide them through changing settings or disclosing a password.
- Spoofing sees attackers impersonating people familiar to the victim either by sending an email as someone else, or changing the address very slightly to appear as if from the legitimate sender.
- Pharming attacks involve a hacker sending the same email to many recipients and then waiting to see which recipients respond.
- Whaling is a specific form of phishing that personalises the attack towards high-profile people in senior positions.
- Ransomeware occurs when data is encrypted within an organization. The hacker then requests payment in bitcoin to receive a code to unlock the user’s files.