Our lives in days of technology

Impact of human error in breaches

We tend to blame a system for security breach. Reality is that human error voluntary or involuntary is the number one cause of cyber security breaches. Here are some points to consider:

1. Social engineering: This is currently the biggest cause of leak in the system still. Phishing is an example of social engineering. In simple language any means by which a human can be coerced to divulge confidential information is social engineering. Abject lack of infosec awareness still plagues most organizations and individual. Honestly basis of cyber security is mere common sense.

2. Backdoors or zero day hacks: These are attacks that either take advantage of a poor piece of code or  ill configured devices. Again who configured or coded them in the first place?

3. Lack of stakeholder commitments: Small and medium scale businesses that are not heavily into IT tend to ignore the presence of cyber threat to their business as usual. These are most likely to fall prey to scam, spam and malware. They do not realize that it is not the IT infrastructure that faces threat, it  is the information that is vulnerable to attacks.

4. Security is a virtue not a product: Decades of research and effort to improve quality has been put in as people realized its importance in the industrial revolution era. In information revolution era people should understand that security has the same importance as quality.

5. To err is human: True that humans cannot be 100% all the time but a conscious effort can bring numbers close to that. Plus there are means and measures like continuity plan and disaster recovery for the rest of the percentage.

6. Information security is nerdy gobbledygook: May be so is theory of aerodynamics. Does it prevent anyone from flying? You have an information that you have to protect, all you need to know is how. Leave the rest to the researchers.

7. I have antivirus syndrome: Just get over it man! They are not enough. Like I said earlier it is your data that is vulnerable. There are 100 more ways in which you share your personal data willingly to unintended audience.

To add to this I am putting an interesting number here: "... potential annual cost to a company in the event of a successful phishing attack is around $3.7 million.." (Source). What is interesting is that most of the loss is due to loss of employee productivity, so there goes your quality!

Backdoor

 

Backdoor: Gaining unauthorized, often hidden, access to a system after bypassing security measures in place. Users are unaware a lot of times. Anomaly detection could be used to scan for existing backdoor.

Denial Of Service (DoS) Attack

DoS attack: When someone or something prevents the user from accessing desired services. While the shop would open only after repairs, there are many ways of preventing/mitigating the attack in cyber security! Load balancing is a prevention technique.

Dumpster Diving

Dumpster diving is a term in information security. It means going through trash to look for useful data or clues to find it, without owner consent.

Phishing

Phishing: To dupe someone to divulge sensitive or personal information

Man in the middle

Man in the middle is a kind of attack where an attacker tries to listen or alter communication between two parties.

Penetration Testing

Penetration testing: is a method of offensive security. Someone knowingly tries to break into a security system and tries to find vulnerabilities in the process. Of course, with owner consent.

Lack of User Training - Worst Vulnerability

Evolution of Security Tools