In this article, we will be sharing the most common threats that can be posed to an entity because of their lack of cyber-security awareness.
Phishing
Phishing is a phenomenon in which an imposter tricks the victim into clicking on malicious attachments or links by sending them emails or via social media websites or via advertisements that appear to be legitimate (but are anything but). Mostly, once they have clicked, they are led to a webpage that looks original (but isn’t) and are prompted to enter confidential information, such as credit card numbers, Social Security numbers, etc. Over the years, phishing has grown in sophistication with hackers being able to make phishing looks more and more realistic (e.g., a person gets an email from an ID that looks almost identical to his brother’s ID and he does whatever is written in the email without bothering to check because the hacker emulated his brother supremely, using his social engineering skills). At the enterprise level, this can easily be fixed; employees need to be trained to be skeptical about basically everything. Only those links that have been received from verifiable senders should be clicked upon. To ensure that the awareness is widespread, organizations can test their own phishing risk, see how many employees click phishing emails and deliver training as appropriate. [Free] Marine Lowlifes Campaign Kit You don’t need an unlimited budget or dozens of hours to create a truly engaging security awareness campaign. You just need the right resources and a playbook. [Download] Free Security Awareness Kit
Unauthorized Application Installation/Usage
Another common security threat is posed by the installation of unauthorized applications on personal computers and workstations. These days, it should be easy to verify the authenticity of a third-party application, but sometimes people ignore the warnings given by operating systems and just go ahead anyway, thinking, “What could possibly go wrong? It’s just one application and isn’t even a couple of megabytes.” This can be excessively dangerous because it just takes the execution of one small script, once administrative privileges have been granted (when “Yes” is chosen during installation), for a small program to take control of the whole computer. This can easily be fixed by revoking administrative access for corporate devices and for most employees. Conversely, a small training session explaining the importance of third-party credibility and authenticity can be enough to make employees aware of the threats posed by the installation of unauthorized applications.
Default or Weak Passwords
Obviously, when you make a list of the most common security blunders, there is no way that weak passwords won’t be on the list. This problem has basically been here since the dawn of technology and is still responsible for the majority of cyberattacks in the world. Most application suites, development software, and enterprise solutions come with default passwords, but leaving them as they were is as bad as leaving your front door open on the night of the purge. Guessing passwords is the easiest way of breaking into a system and it has always been the first trick up a hacker’s sleeve. Evidently, this can easily be fixed by spreading awareness about strong passwords and the part they play in keeping the novice hackers at bay. Modern-day sophisticated systems won’t accept user passwords that don’t meet the security requirements and that should become more of a norm.
Disabled Security Controls
Usability and security are often each other’s worst enemies. Administrators often disable security controls to make applications more usable for the employees but, obviously, this can lead to fatal repercussions. (If an employee has absolute administrative privileges for their laptop, then they can install whatever they see fit; and if they end up getting their computer infected by a malware, they can in turn damage the network and the whole interconnected infrastructure, too.) This can be fixed by installing a thick layer of firewall security and ensuring that nothing unwanted passes through. This way, even if an employee is about to install malware, they won’t be allowed to, because once they approach the administrator for installation privileges, they will be warned (and saved).
Lack of Remote Security
Remote insecurity can also have catastrophic consequences. Employees often transfer files between their personal computers and their corporate workstations or allow their family members to use their corporate devices at home, and this can create some security loopholes. Let’s consider a scenario: Bob is running out of processing power on his workstation so he transfers a proprietary executable application to his personal computer and runs it. He does all the work, notes down his findings, and then deletes the file from his personal computer. However, the proprietary executable application still resides on his personal computer in fragments. Any sophisticated recovery software can recover the application and, in extreme worst case scenarios, it can be misused. The fix is simple: the enforcement of a company-wide policy prohibiting the transfer of data from corporate devices to personal ones.
Clumsy Social Networking
Social networking obviously allows the entire workplace to stay collaborative and lively but it can also pose some obvious risks, such as confidential corporate information getting posted on networking websites. Once it has been released there, it’s beyond the protection hemisphere of the organization. Moreover, the number of (fatal) sophisticated social engineering attacks has also been increasing exponentially over the years. To fix this, technical awareness needs to be imparted to the employees via training sessions periodically.
Obsolete Software or Uninstalled Patches
Last on our list (but most certainly not the one with least significance) is the threat posed by obsolete software. Often we just delay updates and/or patch installation because of the “could not be bothered” syndrome and it ends up opening a lot of vulnerability holes in our systems. Updates or patches get rolled out for a number of reasons and sometimes they are released to remove a vulnerability from an application or other software. If a user doesn’t install an update that tries to eradicate a vulnerability that has now been made public knowledge, then they are laying themselves open for potential attacks. Once again, employees (and people, in general) must be made aware of the importance that updates and patches have, in order to prevent systems from getting compromised because of this common mistake.
Final Word
Even the most rigorously “secure” infrastructures get compromised every now and again, but that doesn’t mean that following standardized security enforcement practices doesn’t go a long way toward protecting systems from unwanted intrusion. The aforementioned are some of the most common reasons for modern day-cyberattacks and it’s of paramount importance that precautionary awareness regarding them be made widespread.
