More and more, businesses blame cyberattacks on “human error,” that single employee who, either accidentally or maliciously, made a decision that resulted in a security breach. You probably remember the 2017 Equifax breach that exposed over 145 million Americans’ personal information. At the time, the ex-CEO blamed a single employee for failing to install a patch for a vulnerability that the hackers then exploited. But a recent lawsuit argues that the breach was actually the inevitable result of Equifax’s poor cybersecurity practices. How poor? Equifax was protecting sensitive informationon a portal to manage credit disputes by using “admin” as both the username and the password.
Even though we regularly blame human error for security breaches, human error is just a symptom of a larger issue that results in breaches. Since National Cyber Security Awareness Month is about to wind down, let’s take a look at the actual issue at hand: poor cybersecurity culture. When organizations build a strong cybersecurity culture, the likelihood of employees making mistakes about security is significantly reduced.
So what does a strong cybersecurity culture look like?
“Your biggest risk is your employees.” Do a quick search for advice articles on cybersecurity and you’ll find this argument over and over again. These articles argue that it is your employees who will share personal information, click on malicious links, or wire money to the wrong place. But blaming employees when security lapses occur is counterproductive because it can cause rifts and make it harder for a business to work together as a team and protect information. Usually, if a breach occurs as the result of a human error it’s because employees did not have the tools, resources or training need to protect the business. In other words, the company lacked a strong cybersecurity culture. Case in point? Equifax. It wasn’t a matter of one employee messing up—Equifax overlooked basic industry standards for cybersecurity, making it easy for hackers to get in.
Building a strong cybersecurity culture starts with the basics, including a strong password policy and using two-factor authentication (note: SMS two-factor authentication can be compromised, better to opt for alternatives). Limiting who has access to certain data, systems and software based on their role also helps protect sensitive information. But in addition to that, making security training a regular part of office life also key to building strong cybersecurity culture. This focus shouldn’t only be limited to the IT department; building a strong cybersecurity culture encompasses the entire business, from the executives regularly discussing sensitive business strategy to every employee touching customers’ information.
Employees are far less likely to make mistakes that result in breaches when they use the right cybersecurity tools. Business communication tools, are one of the most common causes of a breach. whether because an employee accidentally shares information or is tricked by a phishing email. But when employees use a tool that actively prevents them from inadvertently sharing information and protects them from hackers, the possibility of human error is reduced to almost nothing. Vaporstream helps businesses create a strong cybersecurity culture with enterprise policies that determine who can communicate with whom and ensures that all devices are wiped at pre-set intervals. Conversations with sensitive information can’t be leaked and are protected from third-party eyes even if a device is lost, stolen or otherwise compromised. Learn more about how you can strengthen your cybersecurity culture here.