Only A Few Employees Cause The Majority Of Breaches

In today’s increasingly digital world, it’s more important than ever to be aware of the risks your small business could face online. Cyber crime can impact businesses in several ways, and a cyber-attack has the potential to cause financial and reputational damage to a small business or sole trader.

As businesses of all sizes know, building a good reputation and earning customer trust takes years of hard work. Without the appropriate precautions in place, this can be destroyed in minutes if the business is targeted by a cyber attack.

Too often staff are putting their companies at risk from phishing, malware, and insecure browsing and staff who do this the most are often putting the firm at risk of cyber  attacks. Usually, it is a small group of employees who are often responsible for most of the digital risk in an organisation, according to recent research.

The Report, from the cyber security firm Elevate Security and the cyber security research organisation Cyentia have found that those responsible for putting their companies at risk from phishing, malware, and insecure browsing are often a few repeat offenders.

The research found that 4% of employees clicked 80% of phishing links, and 3% were responsible for 92% of malware events.

  • Four in five employees have never clicked on a phishing email, according to the research. In fact, it asserts that half of them never see one, highlighting the need to focus anti-phishing efforts on at-risk workers. 
  • The malware that phishing and other attack vectors deliver also affects a small group of employees. The research found that 96% of users have never suffered from a malware event.
  • Most malware events revolve around the 3% of users who suffered from two malware events or more, reinforcing the notion that security awareness messages just aren't getting through to some employees.
  • A small number of users are also responsible for browsing risky websites. 12% of users tried to visit sites that violate their organisation's browsing policy at least 750 times each in a year, causing security systems to block the session. These users accounted for 71% of all browsing violations.
  • Illicit browsers aren't always the same people responsible for phishing emails and malware. The report found 9% of users exhibiting high risk in only one category, and only 0.052% of users falling into the high-risk category for all three activities.

Companies can mitigate human error by including technical controls to block malicious emails, but performance here is mixed. Almost one in five (17%) of departments blocked no malware.

Departments were either very good or very bad at blocking phishing emails. More than half of departments block 95% of these mails, while one in ten block almost none. Those that receive the most phishing emails per year are more likely to block them.

The report found that block rates for both phishing emails and malware are not uniform within organisations. Individual departments have varying success rates at stopping digital toxins. "Simply making controls available or even requiring them isn’t enough," the report said. "Organisations have to be willing to also measure whether those controls are doing what they are supposed to be doing."

Small businesses are attractive targets because they typically lack the budget and resources to prevent, identify, respond to, and recover from threats.

No target has proved too small for hackers, who are constantly on the hunt for new opportunities. "No matter if it is education, government, health care, manufacturing or electricity, each sector has had many successful cyber-attacks in the past," says Candid Wuest, vice president of cyber protection research at cyber security firm Acronis.

Some criminals enjoy variety, focusing on specific groups for a while before they move on to the next group. Remote workers are sitting ducks for cyber criminals. Hackers can slip in through remote access entry points, including remote desktops and VPN access portals. You should make sure your remote workers are trained to spot phishing attempts, use two-factor authentication, and download the most recent updates of security software.

Elevate Security:    ITPro:     Forbes:   Inc.com:     Hosting Tribunal

For advice and recommendations on  cyber security staff training please contact Cyber Security Intelligence.

You Might Also Read: 

Employee Cyber Security Training Is Vital To Reduce Cyber Attacks:

 

« US Moves Cyber Defences To High Alert
Operating Technology Security Issues Are Increasing »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall (and why does it matter)?

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall (and why does it matter)?

Watch this webinar to hear security experts from Amazon Web Services (AWS) and SANS break down the myths and realities of what an NGFW is, how to use one, and what it can do for your security posture.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

Surrey Centre for Cyber Security (SCCS)

Surrey Centre for Cyber Security (SCCS)

The Centre focuses on three main research directions - Privacy and Data Protection, Secure Communications, and Human-Centred Security.

Global Digital Forensics (GDF)

Global Digital Forensics (GDF)

GDF specialise in Digital Forensics and e-Discovery. Other services include Data Breach Response and Cyber Security.

S2 Grupo

S2 Grupo

S2 Grupo is the benchmark company in Europe and Latin America, for Cyber Intelligence and mission critical systems operations.

Internet Storm Center (ISC)

Internet Storm Center (ISC)

ISC provides a free analysis and warning service to thousands of Internet users and organizations, and is actively working with ISPs to fight back against the most malicious attackers.

Ipsidy

Ipsidy

Our identity platform enables mobile users to more easily authenticate their identity to a mobile phone or portable device of their choosing.

Independent Security Evaluators (ISE)

Independent Security Evaluators (ISE)

ISE is an independent security consulting firm headquartered in Baltimore, Maryland dedicated to securing high value assets for global enterprises and performing groundbreaking security research.

Department of Justice & Equality - Cybercrime Division

Department of Justice & Equality - Cybercrime Division

The Cybercrime division is responsible for developing policy in relation to the criminal activity and coordinating a range of different cyber initiatives at national and international level.

Simplilearn

Simplilearn

Simplilearn is the world's #1 online bootcamp for digital skills training in disciplines such as Cyber Security, Cloud Computing, Project Management, Digital Marketing, and Data Science.

Motorola Solutions

Motorola Solutions

Motorola Solutions build mission-critical services, software, video and analytics, backed by secure, resilient land mobile radio communications.

Periculus

Periculus

Periculus makes managing digital risk simple. Its integrated platform offers access to purchase cyber insurance and cyber security solutions uniquely tailored to fit the needs of every business.

BaXian Group

BaXian Group

BaXian AG is an international consulting company specializing in IT security, data analytics, risk management and compliance.

Zerify

Zerify

Zerify offers the industry’s only video conferencing platform built with a zero-trust architecture to keep your meetings secure, private and business compliant.

Nullify

Nullify

Nullify is your automated security sentry that continuously finds and fixes security issues across your codebase.

Infima Cybersecurity

Infima Cybersecurity

INFIMA tackle the hard parts of managing your Security Awareness Training program so you can focus elsewhere.

Viatel Technology Group

Viatel Technology Group

Viatel Technology Group is a complete digital services provider. We have over 26 years’ experience delivering fully managed security, networking, cloud and communications services.

Coalition for Secure AI (CoSAI)

Coalition for Secure AI (CoSAI)

CoSAI is an open ecosystem of AI and security experts from industry leading organizations dedicated to sharing best practices for secure AI deployment and collaborating on AI security research.