Your Employees Could Be Your Biggest Cybersecurity Risk

Introduction

In Greek mythology, the warrior Achilles was believed to be invulnerable, except for his heel, which was his one weakness. Similarly, in the world of cybersecurity, companies may have robust defences in place, but one vulnerable point or weakness can lead to a devastating breach. One such vulnerability is the insider threat, which can be caused by human error or malicious intent. Insider threats can pose a significant risk to an organization’s cybersecurity, as they can bypass traditional security measures and access sensitive information. In this article, we will explore the issue of insider threats in cybersecurity, examining the human error aspect and the steps organizations can take to protect themselves from this “Achilles heel” of cybersecurity.

Human Error as a Cybersecurity Risk

Despite the best intentions of employees, human error can lead to devastating cybersecurity incidents. This includes things like clicking on a phishing email, misconfiguring security settings, or failing to update software. These types of mistakes can leave an organization vulnerable to cyber-attacks and data breaches.

One of the biggest challenges with human error is that it is difficult to predict and prevent. No matter how well-trained an employee may be, mistakes can still happen. Additionally, employees are often targeted by cybercriminals through social engineering tactics, making it even more difficult to identify and prevent human error.

To address the risk of human error, organizations need to take a multi-faceted approach. This includes implementing technical controls like firewalls and intrusion detection systems, as well as providing regular security training for employees. Organizations should also establish clear policies and procedures to govern how data is accessed and used.

Insider Threats as a Cybersecurity Risk

Insider threats are another significant cybersecurity risk that organizations must address. Insider threats refer to individuals within an organization who use their access to sensitive information for malicious purposes. This can include stealing data, sabotaging systems, or conducting espionage.

Insider threats can be difficult to detect and prevent because these individuals often have legitimate access to the data or systems they are targeting. Additionally, insider threats can be difficult to identify because they are often highly trusted employees with no previous history of malicious behaviour.

To address the risk of insider threats, organizations need to establish a strong security culture that emphasizes the importance of data protection. This includes implementing access controls to limit the amount of data employees can access and monitoring for anomalous behaviour.

Organizations should also conduct regular background checks on employees and limit access to sensitive data to only those employees who need it to do their job. By implementing these measures, organizations can reduce the risk of an insider threat and minimize the damage caused by a malicious employee.

Some research and statistical data

According to the 2021 Verizon Data Breach Investigations Report, human error is responsible for 85% of successful breaches, with the most common human errors being misdelivery of emails, sending sensitive information to the wrong recipient, and misconfiguration of databases.

In a 2021 survey by IBM Security, 54% of respondents reported that their organization had experienced a data breach caused by a malicious insider, with an average cost of $2.69 million per breach.

According to a 2020 study by Ponemon Institute, the average cost of an insider-caused data breach was $11.45 million, which is more than twice the cost of an external breach.

A 2021 report by Cybersecurity Insiders found that 75% of organizations believe that insider threats have become more frequent over the past year.

In a 2021 survey by CSO Online, 48% of respondents reported that their organization had experienced a data breach caused by human error.

The 2021 Cost of Insider Threats Global Report by Accenture found that the average cost of an insider-caused incident was $4.9 million, with 60% of incidents being caused by malicious insiders and 40% being caused by negligent insiders.

A 2021 report by the International Telecommunication Union (ITU) found that 10.5% of internet users in Africa had experienced a cybersecurity incident in the past year.

In a 2021 survey by Serianu, a Kenyan cybersecurity consulting firm, 66% of organizations in Ghana reported that they had experienced a cyber-attack in the past year.

A 2020 report by Serianu found that Ghana experienced 46,167 cyber threats in 2019, a 5% increase from the previous year.

According to a 2020 report by the African Union, insider threats are a significant risk to cybersecurity in Africa, with 34% of cybersecurity incidents being caused by insiders.

In a 2020 survey by Deloitte, 61% of African organizations reported that they were not confident in their ability to detect insider threats.

These statistics highlight the significant risk of cybersecurity incidents and insider threats in Ghana, Africa and across the world. As cybersecurity threats continue to evolve, it is important for organizations to invest in cybersecurity measures, such as implementing access controls and conducting regular security training for employees, to reduce the risk of an incident. Additionally, collaboration and information sharing among African countries and organizations can help to address the shared challenges of cybersecurity in the region.

Conclusion

While external cyber-attacks are a significant risk to organizations, the risk of human error and insider threats cannot be overlooked. Organizations must take a multi-faceted approach to address these risks, including implementing technical controls, providing regular security training, and establishing clear policies and procedures. By taking these steps, organizations can reduce the risk of a cybersecurity incident caused by human error or an insider threat and protect their sensitive data and networks.

Infographic

Daniel Kwaku Ntiamoah Addai, Cyber security, Digital forensics, Cyber Fraud Investigation and Audit. An excellent researcher in the field of Information communication and technology – 0279489127