Employees are the weak link in cyber breaches

With hybrid work models and working from anywhere still popular, the risk of cyber breaches increases, along with potential costs for businesses.

The following reports from consulting and cybersecurity companies disclose:

• 91% of all cyberattacks begin with a phishing email.
• According to data from the last year, at least one person clicked a phishing link in 86% of organizations.
• 90% of IT decision-makers claim legacy systems are holding their companies back.
• Employee negligence accounts for 84% of reported cyberattacks.

“The figures above demonstrate how important it is for organizations to pay attention to employees’ online behavior,” saidCarlos Salas, an engineering manager at NordLayer, Nord Security’s network access protection for businesses.

Salas underlines the following most common employee cybersecurity habits that may impose a risk to businesses:

Weak passwords. People tend to prioritize convenience over security, often reusing weak passwords on all of their accounts. The latest research by NordPass demonstrates what the most common passwords are and how often they are being reused.

Keeping business data on personal devices. With company networks expanding rapidly, more employees use unsupervised devices for business purposes, making it harder to ensure the security of sensitive information.

Clicking before thinking. Fast-paced work environments require employees to communicate and act quickly, which often leads to them clicking on malicious phishing links — especially if they lack sufficient cybersecurity training. Data reveals that internet users detect only 53% of phishing websites.

Leaving work equipment unattended. Doing so can be especially dangerous if a person is working remotely or in a public place because company data can be exposed to strangers.

Not taking cybersecurity responsibly. The most advanced technological solutions are helpless against human factor-induced mistakes, such as falling victim to social engineering.

Not securing the internet connection. With WFH and WFA trends becoming more popular, employees who are not aware of the importance of network security can be at risk of confidential information leakage. Unfortunately,  30% of employees do not use a VPN when working remotely.

Lack of cyberawareness. Cyber threats are most dangerous when they exploit the naivety of employees. Data show that 61% of employees lack basic cybersecurity knowledge.

Indefinitely postponing software updates. Delayed updates mean an increased risk of cyber threats because they usually fix vulnerabilities in software.

Confusing compliance with cybersecurity. One of the most frequent misconceptions about cybersecurity is that regulatory compliance will make the company unhackable. While it is true that being compliant helps to drive down data breach costs, it’s not the main purpose of regulations. They exist to ensure that appropriate standards are set when businesses handle sensitive data. However, the actual application of the regulations is left to the company.

Plugging in unknown devices. An unattended USB thumb drive could spark curiosity to check what’s on it – 48% of people plug in to their computers USB drives found in strange places like parking lots. However, doing so can open the floodgates to a hacker’s attack.

Help employees avoid mistakes

“Cybersecurity is crucial, and negligence might be costly for businesses. This is why it’s in the best interest of companies to treat employee cyberawareness seriously. One of the most effective ways to do so is to organize regular cybersecurity awareness training,” Salas said.

“It’s important to inform employees about every possible threat they can encounter and raise awareness about the shared collective responsibility for the company’s security. Spreading awareness is one step towards a whole new organizational culture.”

But be careful you don’t start treating your employees as the weakest link.

“That’s the opposite of what you should be doing because treating your employees as partners and investing in their cybersecurity awareness can pay back tenfold,” said Nord Security information security manager Sigita Jurkynaitė.

“However, it shouldn’t be done just “check the box”. The process should be a continuous one — make it engaging and fun, and avoid resorting to punishments if an employee fails a test.”