Preventing unintended disclosure
Organizations spend hundreds of thousands of dollars hardening their systems with all the latest cybersecurity technologies. But many often fail to address the human element, especially when it comes to phishing and unintended disclosure. In this day and age, everyone in an organization needs some fundamental knowledge of information security threats. It should be common knowledge, like HR policies. By not educating its people, an organization can end up with vulnerabilities much bigger than hackable code.
System glitches account for a large portion of data breaches, but in fact the majority of data breaches are due to human error and unintended disclosure via phishing. It’s most often the people who aren’t part of the security team, the employees who are just going about their normal routines, who are the biggest security risk.
Take a sales team, for example. Sales people spend their lives sharing information with their internal and external “partners”. They are very used to being an informational conduit between the organization and the external world. This personality and work strength may become a threat if someone calls in phishing for information and the “ever happy people connector” isn’t aware that information they inadvertently disclose WILL be used against them.
Of course encryption, forcing strong passwords, firewalls, antivirus, intrusion detection, updating, patching, and scanning your systems is extremely important, but the reality is that preventing unintended disclosure through education is the least technical and most inexpensive tool you can apply.
When I worked as a security professional at a Fortune 500 company a few years ago, our training was essentially me going around and putting notes such as “you got hacked” on someone’s computer if they hadn’t locked it when walking away from their desk. Of course, this is nonsense but it did establish imagery in people’s minds about opening access to their data. We evolved our training to awareness sessions, newsletters, and phishing simulations, which we then shared in awareness sessions to improve people’s understanding of the current security threats. You have to adapt your training to the size and maturity of your organization but whichever it is, you must start somewhere.
There is a common phrase in the cybersecurity community: “It’s not a question of IF you’ll get hacked, but WHEN.” I would add that with the proper tools AND proper education, you have a much higher chance of beating the odds.
