In 2016, the world experienced an enormous uptick in data breaches; numerous ransomware attacks and devastating DDOS attacks. In 2017, the attacks are increasing in number and scope with no slowdown in sight including the WanaCry Ransomware attack that targeted 74 countries, spread by a phishing email. According to a recent PhishMe study, 91 percent of all cyberattacks begin as phishing emails.
In today’s world of technology, human error can be the difference between success and ruination. Nowhere is this truer than in the workplace, where humans are the weakest link.
Case and point being, last week I was sitting on the tarmac, my flight had been delayed due to an unruly passenger, which is nothing new these days. However, what happened next was mind-boggling.
The man sitting next me was talking to his office; he explained that his flight was being delayed upwards of an hour and wanted to make use of the time by calling his list of ‘cold calls,’ the only thing is, the list was on a word file on his computer. Apparently, he never heard of the cloud.
He instructed his assistant Julia, whom he mentioned by name several times to turn on his computer, gave her his username and the password- three times, very slowly – at a decibel so loud, it was heard by more than half of the 100+ passengers on the plane.
He then told her that his username/password in the future could be found on a blue sticky note in his top left-hand drawer and that it is never locked.
When he hung up with his assistant, he made several cold calls which he proceeded to tell each one the same nauseating scripted story. Adding insult to injury, on one call he explained to the prospective client how to avoid the security desk. I was trying not to stare, but that was ultimately futile at this point.
So, just what did I learn? (All names have been changed.)
- His name is Paul XXXXXXX.
- He is a Senior Vice President.
- Paul works for a Financial Services Company.
- His company specifically works with high-net-worth clients.
- His office is located at xxx Wacker Drive, Chicago.
- His office is on the XXth floor, on the west side of the building.
- Sensitive information in his office is not secured.
- Username is first and last name.
- His Password for all his accounts is ‘654321′ <= Clever…
- His Business email is PaulW@company.com.
- Office Phone number is 872-xxx-xxxx
- Cell Phone number is 312-xxx-xxxx
- His personal email is Paul2xxxxxxx@AOL.com
- His assistant’s name is Julia, who just had a baby boy 3 months ago
- He has 4 kids (3 boys, 1 girl), all in Ivy League Universities, that is costing him an arm and a leg.
- His 3rd wife, Natalie, who cannot cook a meal to save her life, rents high-end Jewelry for a variety of events.
- This is my favorite => If you do not want to deal with the ‘hassle’ of going through the security desk, there is a side entrance that is always opened and will not alert the alarm system because the smokers in the building use it for a smoking area and the elevators are located at the end of the hall
- Come up to the XXth floor, knock on the window, and ‘someone will always let you in.’
I thought for sure this has to be a joke and at any minute someone probably dressed in a killer clown suit, was going to jump out and yell ‘Never, ever do this.’ No one jumped out.
The bottom line on how does this happen? Employees know far too little about the cyber security threats today and organizations are not doing enough to educate their employees or protecting their clients’ critical data.
It is time for all organizations to act.
It is estimated that the majority of incidents globally involve human error. Cyber criminals know this is an area of weakness and they target it, and more often than not, very successfully.
Cyber security awareness is a process that needs to concern the entire organization. All employees must understand both their roles and responsibilities as employees.
Moreover, all organizations whether small, medium or large, need to understand where their weaknesses are. A good first step is by conducting cyber-risk assessments through a holistic review of their policies and education for all employees from the C-suite to the third party relationships.
Suggested training activities
- Educate employees on the need for resource protection including protecting passwords, locking computers and locking up sensitive information.
- Never leave your password on a sticky note where it can be stolen. Once it is out of your control, so is your security.
- Never share your password with another co-worker. NEVER.
- Create different passwords for different accounts and applications.
- Educate employees on why using strong passwords is essential, not a hassle.
- A strong password should be at least eight characters and should include uppercase, lowercase, and special characters – like @#?%^&*.
- Adding just one capital letter, and one special character changes the processing time for a cybercriminal to crack an eight character password from 2.4 days to 2.10 centuries. Think about that!
- Train employees on strategies used by cybercriminals to compromise networks including Phishing and fake websites; and how malicious software is installed by clicking on the links within the emails and downloading attachments from compromised websites.
Frequently conduct unannounced tests. Engage your IT department or use outside experts to test employees both in person and on the computer using social engineering strategies. Moreover, employees who routinely fail the tests need to be held responsible for their actions.
Cybersecurity is an enormous problem to address. Training and testing require planning and resources, but the process of preparation is far better than dealing with the aftermath.
A single vulnerability can lead to data breaches; it can also result in the theft of Personally identifiable information (PII) which often proves the most costly and detrimental to organizations. Negative headlines, financial and reputational penalties, while legal and regulatory sanctions can quickly escalate into the millions of dollars.