{"id":56777,"date":"2023-06-20T16:19:42","date_gmt":"2023-06-20T08:19:42","guid":{"rendered":"http:\/\/www.upgrademag.com\/web\/?p=56777"},"modified":"2023-06-20T16:19:45","modified_gmt":"2023-06-20T08:19:45","slug":"small-and-medium-businesses-remember-your-own-employees-might-cause-cyber-compromise","status":"publish","type":"post","link":"http:\/\/www.upgrademag.com\/web\/2023\/06\/20\/small-and-medium-businesses-remember-your-own-employees-might-cause-cyber-compromise\/","title":{"rendered":"Small and medium businesses \u2013 remember: your own employees might cause cyber compromise"},"content":{"rendered":"\n

By Adrian Hia<\/em>
Managing Director for Asia Pacific, Kaspersky<\/em><\/p>\n\n\n\n

Many small or medium businesses think they can do without a cybersecurity solution since they believe they cannot fall prey to cybercriminals. However,\u00a0the recent study<\/a>\u00a0reports that nearly 46% of all cyberattacks are targeted at SMBs. And, according to the data from the World Economic Forum,\u00a0\u00a095% of cybersecurity breaches<\/a>\u00a0are attributed to human error.<\/strong><\/p>\n\n\n\n

These figures claim that small and medium-sized businesses may be unaware that their employees could unintentionally \u2013 or even deliberately \u2013 cause harm to their company\u2019s \u201cwell-being\u201d. Some improper behavior might lead to financial losses, reputational damage or decreased productivity of the whole business.<\/p>\n\n\n\n

Let\u2019s explore how employees, their negligence, or vindictive feelings may affect cybersecurity or SMBs. In this article, Kaspersky experts shed light on these questions, and none of them will remain unanswered.<\/p>\n\n\n\n

Negligence isn\u2019t bliss<\/strong><\/p>\n\n\n\n

According to the Kaspersky 2022 IT Security Economics survey<\/a>, involving interviews with more than 3,000 IT security managers in 26 countries, about 22 percent of data leakages in the SMB sector were caused by employees. Almost the same proportion was due to cyberattacks, which, at some point, makes employees almost as dangerous as hackers. Of course, in most cases, this happens because of employee negligence or lack of awareness.<\/p>\n\n\n\n

There are various ways that employees\u2019 actions can unintentionally lead to serious security breaches and harm the cybersecurity of small and medium businesses. The main ones are:<\/p>\n\n\n\n

1. Weak Passwords:<\/strong> Employees might use simple or easily guessed passwords, which could be effortlessly cracked by cybercriminals, ultimately resulting in unauthorized access to sensitive data. There\u2019s even a list of the most hacked passwords<\/a> – check to be sure yours is not among them.<\/p>\n\n\n\n

2. Phishing Scams: <\/strong>Employees might accidentally or unknowingly click on phishing links in emails, leading to malware infections and unauthorized access to the network. Most scammers can mimic an email address supposedly belonging to a legitimate company, and when sending an email with an attached document or archive, it turns out to be a malware sample. A recent example is the Agent Tesla attack<\/a> that affected users around the world.<\/p>\n\n\n\n

\"\"\/<\/figure>\n\n\n\n

Example of a mass malicious mailing message<\/em><\/p>\n\n\n\n

3. Bring Your Own Device (BYOD) Policy:<\/strong> BYOD gained greater impetus as a result of the successive lockdowns during the height of the COVID-19 pandemic. At this time, staff in non-essential sectors were forced to work from home and business continuity, rather than security, was foremost in the minds of company managers.<\/p>\n\n\n\n

Employees frequently use personal devices to connect to corporate networks, which can pose a serious security threat if these devices do not have adequate protection against cyber threats. Given the fact that there are over 400,000 new malicious programs<\/a> appearing every day, and the number of targeted attacks against companies is growing, businesses find themselves in a very dangerous situation. At the same time, the majority of companies are not planning<\/a> (or find it impossible) to completely block personal devices from accessing corporate data.<\/p>\n\n\n\n

Unprotected business data stored on a personal laptop that gets lost in the airport or a taxi is a typical nightmare of an unprepared IT department<\/a>. A number of companies solve this by allowing employees to work only in the office on approved PCs with highly limited abilities to send data and a ban on using USB flash drives. This approach, in fact, will not work in a BYOD-driven company. First, employees use their own computers for greater flexibility; but this should not mean that security is compromised. The ideal solution to the problem of losing devices is full or partial encryption of corporate data, enforced by a policy. This way, even if a laptop or a USB Drive has been stolen, the data on it would not be accessible data without a password.<\/p>\n\n\n\n

4. Lack of Patching:<\/strong> If employees use personal devices, IT staff may not be able to monitor the security of those devices or troubleshoot any security issues. Furthermore, the employees might not apply patches or updates to their systems and software regularly, leaving vulnerabilities that can be exploited by cybercriminals.<\/p>\n\n\n\n

 5. Ransomware: <\/strong>In case of ransomware attacks, it is important to back up your data \u2013 to have access to the encrypted information even if cybercriminals have managed to take over the company\u2019s system.<\/p>\n\n\n\n

6. Social Engineering:<\/strong> Employees might unintentionally provide sensitive information such as login details, passwords, or other confidential data in response to social engineering tactics or phishing scams. Those more likely to be easily tricked are new employees who are unaware of the company\u2019s \u201crituals\u201d. For example, a scammer may pretend to be the \u201cboss\u201d to a newcomer, and then try to steal some important information about the company or extort money.<\/p>\n\n\n\n

One example of the way scammers operate is by sending an email posing as the boss or someone senior<\/a> (using an unofficial address) asking the employee to do a task \u201cright away\u201d. The newbie will be happy to oblige. The task might be, say, to transfer funds to a contractor or purchase gift certificates of a certain value. And the message makes clear that \u201cspeed is of the essence\u201d and \u201cyou\u2019ll be paid back by the end of the day\u201d. Scammers highlight the urgency so as not to give the employee time to think or check with someone else.<\/p>\n\n\n\n

These are mistakes that employees can make out of negligence. But what can happen when an employee deliberately seeks to undermine a company\u2019s security while employed or right after leaving their job? More troubles may arise then.<\/p>\n\n\n\n

Desire for revenge<\/strong><\/p>\n\n\n\n

Let\u2019s begin with some statistics obtained by Kaspersky. Although innocent mistakes or ignoring cybersecurity policy were behind most leakages, security managers reported that around a third (36 percent) of employee-triggered leakages<\/a> were deliberate acts of sabotage or espionage.<\/p>\n\n\n\n

Kaspersky reported several issues relating to deliberate sabotage. One example occurred when a former medical device supplier sabotaged deliveries to customers<\/a>: after being fired from their entity, a healthcare exec used a secret account to delay the shipping process. Since the healthcare company was unable to deliver supplies on time, it was forced to shut down all business processes temporarily, and interruptions persisted even months later. In the end, the company resorted to contacting law-enforcement agencies.<\/p>\n\n\n\n

Another case of this type was when an IT ex-employee filed a racial discrimination complaint <\/a>against an organization. Once offered a relocation package, he refused; working remotely was one of his key conditions. As a result, he was dismissed \u2013 and decided to take revenge on his employer. He changed the company’s Google account password<\/a>, denying former colleagues email access, and blocking more than 2,000 students from receiving study materials.<\/p>\n\n\n\n

These examples show how former employees, in the seek of revenge, might cause real harm to their once employer.<\/p>\n\n\n\n

SMB needs some action \u2013 what should be done?<\/strong><\/p>\n\n\n\n

The high number of cyber incidents stemming from employee action shows all organizations need thorough cybersecurity awareness training<\/a> to teach staff how to avoid common security mistakes.<\/a><\/p>\n\n\n\n

Businesses should use endpoint protection with capabilities for threat detection and reaction to reduce the risk of attacks and data breaches. Managed protection services will also assist organizations with attack investigation and professional reaction. To lessen the possibility of incidents brought on by employees, thorough cybersecurity awareness training that teaches how to prevent common security threats is also necessary.<\/p>\n\n\n\n

To be truly assured that everything is fine with your firm\u2019s cybersecurity, Kaspersky prepared a list of advice:<\/p>\n\n\n\n