Only A Few Employees Cause The Majority Of Breaches

In today’s increasingly digital world, it’s more important than ever to be aware of the risks your small business could face online. Cyber crime can impact businesses in several ways, and a cyber-attack has the potential to cause financial and reputational damage to a small business or sole trader.

As businesses of all sizes know, building a good reputation and earning customer trust takes years of hard work. Without the appropriate precautions in place, this can be destroyed in minutes if the business is targeted by a cyber attack.

Too often staff are putting their companies at risk from phishing, malware, and insecure browsing and staff who do this the most are often putting the firm at risk of cyber  attacks. Usually, it is a small group of employees who are often responsible for most of the digital risk in an organisation, according to recent research.

The Report, from the cyber security firm Elevate Security and the cyber security research organisation Cyentia have found that those responsible for putting their companies at risk from phishing, malware, and insecure browsing are often a few repeat offenders.

The research found that 4% of employees clicked 80% of phishing links, and 3% were responsible for 92% of malware events.

  • Four in five employees have never clicked on a phishing email, according to the research. In fact, it asserts that half of them never see one, highlighting the need to focus anti-phishing efforts on at-risk workers. 
  • The malware that phishing and other attack vectors deliver also affects a small group of employees. The research found that 96% of users have never suffered from a malware event.
  • Most malware events revolve around the 3% of users who suffered from two malware events or more, reinforcing the notion that security awareness messages just aren't getting through to some employees.
  • A small number of users are also responsible for browsing risky websites. 12% of users tried to visit sites that violate their organisation's browsing policy at least 750 times each in a year, causing security systems to block the session. These users accounted for 71% of all browsing violations.
  • Illicit browsers aren't always the same people responsible for phishing emails and malware. The report found 9% of users exhibiting high risk in only one category, and only 0.052% of users falling into the high-risk category for all three activities.

Companies can mitigate human error by including technical controls to block malicious emails, but performance here is mixed. Almost one in five (17%) of departments blocked no malware.

Departments were either very good or very bad at blocking phishing emails. More than half of departments block 95% of these mails, while one in ten block almost none. Those that receive the most phishing emails per year are more likely to block them.

The report found that block rates for both phishing emails and malware are not uniform within organisations. Individual departments have varying success rates at stopping digital toxins. "Simply making controls available or even requiring them isn’t enough," the report said. "Organisations have to be willing to also measure whether those controls are doing what they are supposed to be doing."

Small businesses are attractive targets because they typically lack the budget and resources to prevent, identify, respond to, and recover from threats.

No target has proved too small for hackers, who are constantly on the hunt for new opportunities. "No matter if it is education, government, health care, manufacturing or electricity, each sector has had many successful cyber-attacks in the past," says Candid Wuest, vice president of cyber protection research at cyber security firm Acronis.

Some criminals enjoy variety, focusing on specific groups for a while before they move on to the next group. Remote workers are sitting ducks for cyber criminals. Hackers can slip in through remote access entry points, including remote desktops and VPN access portals. You should make sure your remote workers are trained to spot phishing attempts, use two-factor authentication, and download the most recent updates of security software.

Elevate Security:    ITPro:     Forbes:   Inc.com:     Hosting Tribunal

For advice and recommendations on  cyber security staff training please contact Cyber Security Intelligence.

You Might Also Read: 

Employee Cyber Security Training Is Vital To Reduce Cyber Attacks:

 

« US Moves Cyber Defences To High Alert
Operating Technology Security Issues Are Increasing »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

UK Cyber Week Expo & Conference

UK Cyber Week Expo & Conference

Award-winning event organiser ROAR B2B announces the launch of UK Cyber Week and its inaugural event on 4 and 5 April 2023 at the Business Design Centre, London.

Clayden Law

Clayden Law

Clayden Law are experts in information technology, data privacy and cybersecurity law.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

Echelon

Echelon

Echelon Company is a provider of information security services specializing in certification of security software and hardware products in Russia.

CipherPoint Software

CipherPoint Software

CipherPoint Software provides data-centric auditing and protection solutions for securing unstructured information

ICSA Labs

ICSA Labs

ICSA Labs provides third-party testing and certification of IT security software and products, as well as network-connected devices.

NTNU Center for Cyber & Information Security (NTNU CCIS)

NTNU Center for Cyber & Information Security (NTNU CCIS)

NTNU CCIS is a national centre for research, education, testing, training and competence development within the area of cyber and information security.

FixMeStick

FixMeStick

FixMeStick is a virus removal device, a USB key that removes malware conventional antivirus software often can’t detect.

VerSprite

VerSprite

VerSprite is a specialist information security consulting firm. We provide organizations with detection across all their attack surfaces and deliver critical insight into all possible attack methods.

Keepnet Labs

Keepnet Labs

Keepnet Labs is a phishing defence platform that provides a holistic approach to people, processes and technology to reduce breaches and data loss and presents anti-phishing solutions.

North European Cybersecurity Cluster (NECC)

North European Cybersecurity Cluster (NECC)

NECC promotes information security and cybersecurity-related cooperation and collaboration in the Northern European region in order to enhance integration into the European Digital Single Market.

CUJO AI

CUJO AI

CUJO AI is the global leader in the development and application of artificial intelligence to improve the security, control and privacy of connected devices in homes and businesses.

OISTE Foundation

OISTE Foundation

OISTE foundation allows users to control their digital identities using well-understood and secure algorithms that ensure the continued validity of an identity and its claims.

Stratejm

Stratejm

Stratejm, a Next Generation Managed Security Services Provider, brings innovation and thought leadership to the fight against cyber criminals.

KETS Quantum Security

KETS Quantum Security

KETS harnesses the properties of quantum mechanics to solve challenging problems in randomness generation and secure key distribution and enable ultra secure communications.

10dot Cloud Security

10dot Cloud Security

10dot Cloud Security is a security service management company. Our solutions give you contextualised visibility into your network security.

BugDazz

BugDazz

BugDazz pentest as a service (PTaaS) platform helps bringing in real-time results, detail coverage, & easy remediation workflows with compliance-ready reports.

Mosaic Insurance

Mosaic Insurance

Mosaic is a next-generation global specialty insurer distinguished by an exceptional team, agile technology, and a structure that combines Lloyd’s of London strength with a global distribution network

PointWire

PointWire

PointWire offers a range of cybersecurity solutions and services including Penetration Testing on various levels, as well as Intrusion Detection and Prevention Systems.