Cybersecurity’s weakest link: the human factor

The latest studies are further confirming a fact that, although already known, is still too often ignored: the human factor is the greatest source of risk for companies’ IT security. In this period, in which the pandemic has dramatically increased the use of smart working, finding a solution to this problem must become a top priority.

The main risk for companies

In a recent survey, the Proofpoint company and the “Let’s System” community questioned the CISOs (Chief Information Security Officers) of 138 Italian companies, asking what were currently the worst threats for companies: according to 85% of them, the greatest risk is posed by phishing and social engineering attacks targeting employees.

Essentially, the main targets of cyber-attacks are no longer the infrastructures, now more difficult to compromise, but the employees. In recent years, a large number of companies have had to deal with identity violations and compromises of business emails (BEC, Business Email Compromise). These are attacks that, in addition to the financial impact, can have devastating consequences for the reputation of the companies involved.

The problem with these social engineering attacks is that they are constantly evolving and increasingly sophisticated; in fact, cybercriminals are always ready to change their methods by taking advantage of global and regional events to launch extremely targeted attack campaigns that are difficult to recognize for anyone that is not properly trained on these types of threats.

The problem of smart working

This aspect was made even more evident during the outbreak of the Covid-19 pandemic, which was exploited in every way to launch “fearware” attacks, used to exploit fears related to the current health emergency situation in order to induce people to open phishing e-mails or messages.

Furthermore, the pandemic has caused a rapid and forced use of smart working for many companies, many of which are absolutely unprepared in terms of security. Most likely, a large number of employees will continue to work often from home or in environments other than the office, using PCs and mobile devices, sometimes even personal ones, which connect to both the corporate network and the Internet, managing backups, passwords and updates. All this has produced an exponential widening of the security perimeter, now much more difficult to control and much more exposed to infiltration attempts.

Training: the first solution

While waiting for new cybersecurity technologies linked to the implementation of Artificial Intelligence and Machine Learning systems to make many processes that are now exposed to the risk of human error more secure, a quickly applicable solution must be found.

Fortunately, this solution already exists and consists primarily of training and raising awareness of employees in the field of IT security. In fact, if now the burden of protecting the company falls directly on anyone who has access to data and credentials of the company IT systems, it is clear that all employees must be adequately trained on the correct behaviors to be adopted to avoid the greatest risks and thus increase the security of the entire perimeter.

In addition, corporate security strategies will also need to be redefined, given that the current scenario requires CISOs to manage security even remotely, facing partly unprecedented threats. The security measures must therefore evolve, alongside and integrating with the tools offered by areas not strictly related to the IT environment, as a prevention tactic.

The resilience of most of the manufacturing companies worldwide depends on the effectiveness of these processes, but we must start acting immediately if we want to avert the worst effects of the cyber-pandemic that is now beginning.