Search results: phishing

Phishing & Email Scams Gain Momentum in South Africa

5 Nov

One would think that will all the awareness campaigns around phishing and email scams, South Africa’s risk profile would be on the decline. As it turns out, it’s not. Email scams and phishing scams are always on the rise and, right now, unsuspecting South African citizens are being scammed. Whether it’s due to ignorance or carelessness, thousands of rand are being delivered into the hands of criminals via online scams.

What can you do to protect yourself?

Being aware of the latest scams and ensuring that you behave safely online are the first steps to take.  Let’s take a look at the latest…

Ministry of Finance Scam

The Minister of Finance recently warned South Africans to be aware of a scam doing the rounds in the first week of October 2019.  The scam involves an email that is sent to thousands of South Africans claiming to be from the Ministry of Finance. The email advised the recipient that there are millions of rand that need to be claimed from the South African Reserve Bank and that the recipient of the email is indeed one of the citizens entitled to do so. To start the claims process, the individual will need to send through their particulars, including:

  • Full name
  • Date of birth
  • Occupation (place of employment)
  • Cell phone number

The intention of this fake email is to gather the personal information of the recipient.

The Minister of Finance has spoken out against the scam and asked South African’s to ignore emails of this kind from the Ministry. It’s important to note that the Ministry of Finance will never request personal information via email.

Department of Labour Scam

Another scam that’s taken the South African community by surprise is one targeted at the Department of Labour and aims to take advantage of the desperation of some citizens.

The scam, which is social media-based, involves a fake social media page complete with Department of Labour branding. The page features an announcement that claims certain citizens, who have worked in the country between 1990 and 2019, have the right to claim/withdraw R30 000 from the Ministry of Labour. To do so, individuals must check if their name appears on a list of entitled individuals. The next step would naturally be to provide the “Department” with all their particulars, including banking details so that the claim could be paid out. Once again, a fake email is being used to gather personal information.

The Department of Labour has spoken out against this scam and informed the public that there is no such benefit in place.

Are the Criminals Winning?

Does the steady increase in phishing and email scams in the country, and the world, mean that there are no wins from the cybersecurity community? No, it doesn’t. In fact, that is where the good news comes in. Just recently, the Department of Justice in the United States made a massive breakthrough in Cyber Crime, where 281 email scammers were arrested in a major global sweep.

While South Africa didn’t appear on the list of criminals, South African citizens have undoubtedly been the target of many of these arrested criminals. The Department of Justice seized a whopping 3.7 million dollars during the operation while arresting people from the following countries:

  • Nigeria (167 arrests)
  • United States (74 arrests)
  • Turkey (18 arrests)
  • Ghana (15 arrests)
  • The last seven criminals were located in France, Italy, Kenya, Malaysia and Japan.

As you can see, West Africa is in the lead by leaps and bounds.

Protect Your Own Best Interests

While it might not be possible to shut down every scammer in Africa or the rest of the world, there is a way to minimise their impact. And that is through awareness. Tech users need to become savvy to the prospect of scams and be aware and alert at all times when receiving emails and other forms of communication from people and enterprises they do not know.

If something seems a bit fishy, it is best not to respond, or completely shut down communications. Also, keep in mind that any email requesting personal information over the internet is not considered safe and secure – rather avoid it. If you wish to confirm that it is, in fact, the authorised company or person making contact with you, call the company in question and speak directly to an official representative.

What Exactly are Cybercriminals Looking for?

25 Sep

South Africa is not experiencing Cybercrime for the first time. In fact, the general population and businesses have been hearing about cybercrime – and been adversely affected by it – for many years.

Have you ever wondered if you have what a cyber-criminal is looking for? Are you computing habits and behaviours putting you at risk? To answer this question, you first have to know what cybercriminals are looking for in the first place.

Cybercriminals all have an agenda

There’s no such thing as “winging it” as a cybercriminal. There’s a target, there’s a plan, and then there are weeks (sometimes even months and years) of hard work to achieve their goal. Most companies find it impossible to detect a hack attack before it’s too late.

What the Average Cybercriminal Looks for

Industry professionals imply that cybercriminals are looking for scenarios where their work will be hard to detect. Essentially, cybercriminals are searching for the following:

  • Business plans
  • Innovations
  • Opportunities to connect with partners, investors, shareholders
  • Government links
  • University scientific research

To date, the most reliable method for a Cyber-Criminal to hack these particular types of projects and data is – you guessed it – phishing. It’s a sad reality that people are still unmindful that clicking on a link in an email, or opening an unknown attachment to an email, can put them and their organisation at serious risk.

 

What most Cybercriminals do is send out emails pretending to be a colleague, manager, or interested party! When the email is opened and the files with it; the criminal gains access to the victim’s sensitive information.

How to Protect Yourself & Your Organisation

Protecting yourself and your organisation against potential cybercrime is essential. Below are a few tips:

  • Set a Cybersecurity policy in place that determines how members of the organisation are expected to behave electronically/digitally.
  • Educate all the various teams in your business to ensure that everyone is aware of the risks.
  • Use repetition to continually remind staff and team members of possible risks. You can put up warning posters, send out warning emails, and include it in the weekly agenda at staff meetings.
  • Ensure that you do regular encrypted data backups to a remote server; chat to a consultant at Soteria Cloud about this, at your convenience.
  • Don’t allow personal devices to store sensitive company information.
  • Ensure that you have anti-virus, anti-malware and a firewall installed on all computer systems.

Cyber-crime is no longer something that just affects the rest of the world. It is a problem that is very real in South Africa too. Protect your business, assets, research, and sensitive data with meticulous care.

Future Trends & Themes Emerging from the RSA Conference 2019

13 Aug

Cybersecurity experts flocked to the RSA Conference 2019,  hosted in Singapore from 16th to 18th of July. Several resources have described this years’ conference as “a success with thought-provoking and useful topics”, and the attendees all seem to agree.

Strong Themes at RSA Conference 2019

At past cybersecurity conferences, it seems that participants mainly focused on punting new products and their exceptional specifications. In 2019, however, other themes came to light. The main themes were unwavering in their focus on:

  • Innovation in the industry,
  • The increase in the use of AI (artificial intelligence) and the tech that supports it,
  • The involvement of youth in the fight against cybersecurity threats,
  • The possibility of collaboration between security agencies, academia, researchers, and governments.

Informative Content Designed to Support the Themes of the Conference

Content presented to industry experts was informative and valuable to numerous fields. The material covered included:

  • Privacy
  • Security
  • Cyber risk leadership
  • The roll-out of global threat detection systems
  • Security forensics
  • Methods of industrial system cyber threat countering

Information and experience sharing was also a significant theme at the conference, with several speciality topics including:

  • eFraud
  • Law enforcement
  • Strategy
  • Architecture and data security
  • Cloud security
  • Mobile security
  • IoT security

With 100 sessions and a myriad of well-respected keynote speakers in the industry, there was undoubtedly much to see and do for the cyber experts in attendance.

Future Trends and Highlights

While a great deal of attention was given to security threats facing the industry at present, for many cyber experts, future security trends were a highlight.

Security, privacy, legislature and foreign affairs were just some of the topics discussed in-depth. The focus of these topics veered away from the technical side of things, focusing instead on how these elements will impact on the future of cybersecurity and the industry.

The RSA Conference addressed issues such as the state-sponsored attack which hasn’t seen much progress since 2015. As cyber-warfare remains a real threat, it seems that the stumbling block is in the implementation of an actionable agreement that dictates acceptable behaviour among different countries and states in cyber space.

A responsive Security Operation Centre was set up for the duration of the conference. The centre observed the behaviour of attendees on the network traffic without interfering. The purpose of the centre was to determine just how security conscious attendees were, and the results were astounding. Over the course of the week, the op centre detected numerous unencrypted emails containing confidential information and malware submissions.

Future Threat Trends

When it comes to future threats and warnings evaluated and reviewed during the course of the conference, the reminders and memory refreshers were welcomed. Keynote speakers paid particular attention to the following trending and future threats:

  • The ability of hackers to bypass two-factor or multi-factor authentication methods.
  • The trend of cybercriminals attacking systems without security patches.
  • The attack of third parties and supply chains using sophisticated phishing techniques.
  • The ability of attackers to scale-up their attacks and how to detect replicated attacks.
  • The trend of cybercriminals attacking with the intention of causing damage and losses.

Conclusion

The take away of topics from the RSA conference was vast, but it is clear that cybersecurity took top spot and looks set to keep that position into the foreseeable future.

The 4 Most Damaging EMail Attachments

10 Jun

Email attachments have been blamed for viruses, malware and complete and utter computer breakdowns many times in recent years. Despite the plethora of warnings stating “do not open attachments from unknown senders” and “do not click on links in Emails”, still people, and entire corporations fall victim to the plight of an infected or malicious email attachment. More recently, Trickbot, Gandcrab, NanoCore Remote Access Trojan, and AgentTesla malware are malicious infections that have been contracted by opening seemingly innocent DOC files and ZIP attachments!

Spam isn’t Always Easy to Recognise

Not all online and email scams are as obvious and easy to spot as the infamous Nigerian prince looking for ways/reasons to send you spans of money. Some scams look so legitimate and trustworthy that the average man on the street will fall prey to it with little encouragement. That being said, what can you do to ensure that you spot the warning signs of a malicious attachment? Being aware and knowing what to be suspicious of is a good start.

The first thing you need to know is that hackers do their very best to keep their intentions secret. They won’t make it evident that the attachment is malicious, so you need to do a bit of detective work. Any regular PDF, DOC, XLSM, ZIP, ISO, or IMG file can be used for a spam or malware campaign, and this makes recognising a threat all the more complicated.

4 Types of Attachments You Should Be Wary of

We have already mentioned these file types above, but here are 4 of the most dangerous email attachments and how they are used to deliver destruction to your device & data.

1. Trickbot Modular Banking Trojan Spread by DOC/XLSM Files

This trojan is typically sent as an Excel spreadsheet detailing tax records and similar. Once the spreadsheet is open, a BitsAdmin tool takes control and starts stealing data from the device and network, in particular, banking data.

2. GandCrab ransomware spread with ZIP files

GandCrab ransomware, when unwittingly installed on a computer, encrypts all the machine’s contents and then displays a ransom note to the user. Once the user has followed the instructions on the ransom note (usually to pay money), it is expected that the ransomware can be removed. This ransomware looks much like a ZIP file photo attachment in an email.

3. Amex Phishing via PDF File

This phishing campaign specifically targets American Express customers. An email is sent out with a PDF attachment stating that the customer’s Amex account is “under review”. Once the email is opened, the attachment contains a link directing the customer to a secure message from Amex. Once the link is clicked on, it takes the customer to a Malicious website page which looks just like an official Amex page. Here, customers unwittingly input their banking details where hackers promptly steal them.

4. Winner scams Sent by PDF File Attachments

One of the biggest email scams is the “winner scam”. The email, which looks as though it comes from an official Google email account, states that the recipient has won in the online Google sweepstakes. To receive the prize, the recipient must input their personal details and the bank account details where they wish to receive their winnings. Of course, sensitive data is provided such as ID number, address, telephone number etc. There are no winnings – in fact, the entire scam is being run by identity thieves who then use the personal information to open accounts or take out loans.

What to Do

If you receive emails with attachments from people you do not know, do not open the email. It is also highly unlikely that you will be advised of a big win via email. If you are suspicious, google the phone number for the company and call them directly to verify that the information that you have received is legitimate. Also, never provide your personal details to a person or company you have not made initial contact with (or know) yourself.

If you have any tips and pointers to help others avoid email attachment scams, we’d love you to share them with us.

Identity theft? Your personal information is like gold – it needs to be well secured

22 Apr

Gold is a lot of things, but it’s not the most valuable thing you can own. What could be more valuable than gold, you ask – palladium perhaps? True, but the most valuable thing to you, after your family, is your personal information, that’s what!

When criminals start mining your data they are not hunting for your gold; they’re hunting for your personal information for the purpose of identity theft. The problem is that many people are still unaware of how easily it can happen.

What is identity theft? Identity theft is when a criminal fraudulently uses another’s personal information to make purchases, apply for credit cards, and get loans.

If you have a good credit record and a lost ID, you’re in for a lot of trouble!

Identity theft is easier than you think

Have you ever requested a credit card statement via email and been asked to provide your ID number? Have you emailed a copy of your ID to someone recently? Did you know that all an identity thief needs is your ID number along with some of your personal info such as your address and mobile number, to create fake IDs, paperwork, and complete various online applications?

Identity theft is so serious in South Africa that Carte Blanche did a feature piece on how it happens. And according to the TransUnion credit bureau, identity theft in South Africa is on the rise and consumers need to do more than they are currently doing to protect themselves.

How does identity theft work?

We hear about identity theft from time to time, but how do the criminals actually get it right?

Identity thieves can sell your ID and personal details, along with your credit profile for as much as R3 000.

When an unscrupulous individual wants to buy a luxury car, open a cell phone contract, buy groceries, or apply for an instant cash loan, they will need to prove a good credit rating, provide proof of address, copies of bank statements, and have a positive ID. Thank you Mr Smito – all of this can be created by simply acquiring your ID number. It’s a scary reality!

What to do when your identity is fraudulently used

If you detect that fraudulent purchases are being made on your behalf, here’s what to do:

  • Contact the South African Fraud Prevention Service to start an active investigation.
  • Write an affidavit detailing the situation and open a case at your local police station.
  • Get in touch with the companies that the criminal has racked up bills with. Explain the situation to them and ask them to investigate the purchases made.
  • Check your credit profile to ensure that none of your details have been changed. You can also ask the bureau to make a note on your profile that there is a suspicion of identity theft.

How to treat your personal information like gold

Want to ensure that your personal particulars never fall into the wrong hands? Here are a few tips:

  • Never leave your ID, driver’s license, mail, or statements lying around.
  • Shred all documents containing your personal details before you throw them in the bin.
  • Ignore those “Congratulations! You’ve won a prize!” text messages.
  • Don’t provide personal information to anyone that makes an unsolicited call to you. If you need the service, but don’t trust the contact you have received, contact the company directly yourself.
  • Check your bank accounts regularly to ensure that no unusual purchases have been made.
  • Don’t be caught out by phishing and digital banking fraud – no bank will ever ask for your password along with your personal details.

The time to take better care of your own identity is now. Follow the above tips to minimise the risk of becoming an identity theft victim and be sure to backup all your personal data securely, online.

Digital banking fraud is on the rise! What’s the solution?

4 Mar

Absa has recently warned the public that digital banking fraud is on the rise – and they are right!

To come up with a viable solution to the problem, we need to fully understand how the fraud is being committed. Simply put, social engineering is to blame.

Social engineering and data security

“Social engineering” in terms of data security is a process of using deception to manipulate people into sharing their confidential and sensitive information. This information is then used for fraudulent activities with phishing being one of the most prevalent forms of social engineering.

Absa has noticed that more customers are falling victim to the process and end up sharing their card PIN, One Time PIN (OTP), CVV (last 3 digits on the back of your card), online banking username and password with third parties that are posing as legitimate financial and banking institution employees. There was a whopping 64% increase in digital banking fraud in South Africa over 2018.

The problem is not merely data security

Your digital banking profile and the money that it represents are only as safe as your data is. Unfortunately, mid-2018, 4.5 billion consumer data records had been exposed in various types of data breaches, phishing attempts, and spam email.

The fact of the matter is that the problem is not simply limited to the level of security that a person has. For instance, a spam email containing compromising hyperlinks would be useless if it’s ignored. For that to happen, consumers need to be able to tell the difference between a spam email and a legitimate email.

Education is a part of the problem. Consumers need to be more aware of what is considered acceptable and secure correspondence, versus potentially risky communications via the internet, phone, and apps.

Absa’s advice to digital bankers

Ulrich Janse Van Rensburg, the Head of Fraud Strategy for Absa, has released useful tips for the public regarding safe digital banking. In summary, here are the pointers:

  • Never approve transactions via mobile banking apps if you are not personally transacting.
  • Only make use of reputable and safe banking systems such as the Absa (or other bank’s) Mobile Banking Application.
  • Never provide your personal details (PIN, password, CVV etc.) to anyone via the phone or email. A bank will never request these details from you on these platforms.

What can you do?

Consider removing your auto-saved banking data from your devices. One-touch sign in to digital banking apps on your mobile device can result in substantial financial losses, especially if you lose your phone. Avoid making use of new, unknown apps that require your banking details or credit card details. And you should also make sure that you change your passwords regularly.

Have you had a disastrous situation with a digital banking app? We’d love to hear your stories – good or bad!

2019 Cybersecurity threats and opportunities

18 Feb

2019 is no longer a retype or an afterthought. It’s happening and with the new year comes a variety of new Cybersecurity threats and opportunities.

Our lives and lifestyles seem to become more digitised each year. You can do almost anything online, and you can control almost anything from your smartphone. Life has changed, and technology has become a part of our everyday existence. Because of this, the topic of Cybersecurity is (or should be) always a conversation piece and top of mind.

From the many surveys and reports released at the start of the year, it is apparent that cybersecurity is a number 1 risk factor for businesses as well as the public.

While it seems that most people are aware that there are risks, a very low percentage of businesses actually take the time to train and educate their staff on the topic. And when we say low, the stats show as little as just 11% of global organisations providing cybersecurity training to their people.

In an attempt to get business owners more actively interested in cybersecurity risks and educating employees, we take a look at the top cybersecurity threats and opportunities expected in 2019.

  • Increased sophistication

Cybercriminals have always been quite advanced in their methods, but it seems things might get even more complicated as criminals up their game. Already, 55% of all gross bank losses in South Africa relate back to cybercrime. Without educating staff and perhaps training highly-skilled cyber security expects to fight the war against cybercrime, this already shocking figure could rise.

  • The entire nation could be inconvenienced or negatively impacted

Cybercrime is no longer targeting account holders, investors, and business owners. Cyber criminals are turning online crime into a matter of national security. This year, cyber criminals plan to target entire electricity supply grids, government grant payment systems, banking systems, and even tax collection systems. This could affect you…and the entire economy!

Phishing attempts have been fairly effective to date, but now with social engineering improvements and better data correlation, phishing will be far easier to pull off. Prepare for some sleepless nights over this one – especially if you run a business with uneducated staff (when it comes to cybersecurity that is).

  • A new trend toward targeting vulnerable SMEs will be seen

Large enterprises have been a focus for quite some time and this year, cyber criminals are likely to target small to medium enterprises that haven’t felt too much at risk. SMEs typically have limited security systems. They also have access to cash flow. This makes them an attractive target for opportunistic criminals.

It’s not all bad news!

It’s easy to think that 2019 is going to bring about a plethora of new cybersecurity threats… because it will. But what’s the good news? Are there any opportunities for cyber security improvement? Yes! There most certainly are.

As new technologies emerge and cyber security professionals enhance their skills and tools, cyber criminals can expect to enter into a good fight. Machine learning and AI (Artificial Intelligence) is being designed to analyse data and search for potential breaches and vulnerabilities, which will make the task of cybersecurity for us mere mortals a great deal simpler and more effective.

Are you ready for 2019? You need to be!

If you need cybersecurity advice or products to protect your business or personal devices, give us a call or send us an email at Soteria Cloud today.

Is the heart of democracy really data security? You decide!

4 Feb

When experts in the field of data security start saying things that imply military systems can be easily hacked, one starts to realise just how vulnerable we are to cyber criminals.

Unfortunately, the opportunity for cyber criminals abounds as their skills seem to surpass the expertise and efforts of the world’s cybersecurity pros. It’s not just a fighter jet being hacked and taken control of by opportunistic terrorists that one should fear though. Hacking and cybercrime can go beyond even the threat of a skyjacked jet and have an effect on entire nations on a global basis.

Suppose a hacker was to breach the security protecting the national tax collection system? Such an act could cripple the economy and leave millions starving. And this is just the start to the type of terror that online crime can result in.

Just how resilient is South Africa’s cyber security?

South Africa, and the world seem to be have been up in arms last year with data and security breaches abounding at every turn. The importance of highly-effective cybersecurity policies in the public sector is an area that has been highlighted.

The main objective is (and should be) to protect public institutions from falling prey to disruptions and the pillaging of cyber criminals. A call to protect the following public institutions has been heard, and the government will have to do something about it if they want stakeholders to feel more confident:

  • Revenue collection
  • Military defence
  • Freight handling
  • Social grant distribution

As the country, and the world seamlessly merges into new technology, the worry that essential public and government services will be faced with cybercrime related havoc increases. Just because South Africa is developing in terms of technology and the IoT (Internet of Things) a bit slower than its peers, doesn’t mean that it has escaped the risk. The risks are the same…and they are looming!

The South African Government Takes Cyber Security Risks to Heart

The South African government seems to have come to the party in this instance and appears to be taking a serious interest in the cyber security of its systems and people.

The Department of Telecommunications and Postal Services has set up the Cybersecurity Hub, which is designed to create a greater awareness of cyber risks and help South African’s share information regarding cybercriminal activity.

Educating the people of South Africa about cybercrime and the risks (and what to do) is probably the first step that the SA government should take. A security system is after all, only as strong as its weakest link. And if people aren’t aware or don’t understand the risks, they are indeed a weak link!

Cyber Security is Everyone’s Responsibility, for the Sake of Our Democracy

If democracy is important to South Africa and its people, surely educating the hundreds and thousands of employees and the public sector about the reality of cybersecurity – and how to play a part in preventing it, should be a major focus? By educating the public, the country can ensure that service delivery and essential services never fail its people, because everyone is doing their bit to protect the democratic lifestyle that we so love and value.

Of course, it’s not just the government’s responsibility. Businesses should be training their employees and ensuring that they have knowledge of risks and defence strategies when it comes to cybersecurity.

Where we are Failing

Recent surveys have shown that a whopping 1/3rd of the world’s public sector companies say that they aren’t sure their employees are able to identify an identity impersonation in action or a phishing scam unravelling. A further worrying statistic showed that even though these companies are doubtful of their staff members’ abilities, only 14% of them provide training on the different types of cyber threats and how to avoid becoming a victim!

How government and public sector companies can do more:

  • Provide ongoing awareness training to increase knowledge and insight into cybercrime.
  • Be proactive rather than reactive by ensuring that effective cyber security measures are in place (instead of only scrambling to find cyber security solutions when an incident occurs).
  • Design and implement plans and processes to keep emails and business operations up and running, even in the midst of a cyber-attack.
  • Make sure that data can be recovered after a security breach. Cloud backups are often a viable solution here.

For an ongoing, beneficial South African democracy, it seems that more care must be taken to involve the people of the country in the overall cyber-security efforts. Education is the starting point and implementing the correct processes and procedures should be a main objective for all.

Need some advice on how to play your part in protecting yourself, the company you work for, and others from cybercrime that threatens our democracy? Get in touch with us or consider our data backup packages today.

Simple Cybersecurity Measures that Work!

27 Nov

If you have been a victim of cybercrime, chances are that there was no serious plot to target you and your account specifically. By nature, cybercrime is an opportunistic business. This means that a hacker might come across your password or send out spans of emails and you’re the one who falls for it and…yes…clicks the link. The truth is that there are a few basic cybersecurity measures that you can take to ensure that you don’t become a victim.

Don’t Want to be Hacked? Make These Security Measures Your Online/Device Mantra!

These tips are for individuals as well as businesses, so listen up and take note!

Make your password strong and regularly update it

We could all stand to be a little more mysterious with our passwords. If you’re the type of person who uses the same password for all applications and accounts, STOP! Mix things up. Use an upper case letter, lower case letter, number, special character and you must avoid using anything that is easy to guess (think ID number, partner’s name, child’s name, pet’s name – you get it!).

Log out when you leave

If you access accounts on public devices or even work devices, always log out when you are finished. To be even more secure, you can clear the device history and cache so that you are certain the log in information will no longer be valid.

Get in the habit of doing regular encrypted data backups.

The cloud is there for a reason. Make sure that you don’t leave any sensitive information saved to your device. You can do a data backup and secure your information from hackers. We can help you with this at Soteria Cloud.

Password protect your network

This should be the first step in anyone’s cyber security strategy. It might seem like it’s “just your home Wi-Fi”, but you won’t be feeling the same when someone realises your network is unsecured and uses it to access personal information which can be used against you. Identity theft and fraud is a lot easier than you think. It’s all about protecting your personal information.

Password protect your devices

Ever lost a phone and wondered what would happen if it fell into the hands of the wrong person. With banking apps, Zapper and NFC functionality, your phone can be your worst enemy (when in the hands of a criminal, that is). Make sure that your protect your device with a secure password, just in case.

Get choosy with the apps you use

Apps are great. They’re fun and convenient. What happens when the app you are using is hacked? You guessed it! Your personal information is at risk. If you are going to download an app, make sure that it offers sufficient security and that the company or brand it is linked to offers protection against cybercrime too. You should also encrypt your most commonly used accounts.

Avoid “dodgy” emails and messages

If you don’t know where the email is coming from and it’s asking for personal information or requires you to click a link, avoid it! Phishing is a top cybercrime trick. Don’t know the email sender? Don’t open it!

These simple cyber security tips can help you avoid cybercrime victim status. Thwart the efforts of opportunistic cyber criminals with our help! Got any more security tips of your own to add? Share them with us!

How Big is the Human Error Element when it comes to Cyber Risk – Time to do a FAIR?

30 Oct

According to a recent report released by Verizon, 17% of data breaches originated from social engineering, mostly emails. The report uncovers that 17% of the breaches are a result of human error, such as employees sending sensitive emails to the incorrect recipients. This report is making industry professionals wonder just how big the human element is when it comes to cyber risks and what can be done about it.

If you ask a company what percentage of their risk is owed to human error, they probably won’t know how to answer that. That’s because over time, most of the attention, when it comes to cyber risk, has been given to the more obvious concerns such as misdirected emails and phishing, instead of what can happen along the attack chain. Not knowing where to start can lead to the stats being a little inaccurate.

Assessing the Human Element

If you really want to assess how big the human element is in cyber risk in an organisation, there is a simple 2-step analysis process to follow.

The two elements that can be used for such an analysis are:

  • Frequency – How likely is it that an employee will become victim to phishing or accidentally forward sensitive information a second or third time?
  • Impact – How likely is it that such a negligent act of an employee will result in data breach or disruption and what could this potentially cost the business.

The FAIR Method of Analysis

Using the Standard Factory Analysis of Information Risk (FAIR) model, one can determine probability and cost of incidents. FAIR is a digital system that allows one to use critical thinking in identifying risks and measuring them. Such a system allows for greater insight into frequency and impact.

Being able to gather valuable data in this manner means that results can be translated accurately and potential outcomes predicted.

Benefits of the FAIR method of analysis:

  • The risk from data breaches can be thoroughly considered.
  • Multiple assets at risk can be carefully identified.
  • Security teams can get a better concept of the frequency of such risks and if similar risks will present in the future, and what impact they will have.

This can be done by considering the following in each of the two analysis factors:

Frequency

  • How often are emails containing sensitive information sent?
  • Just how often do employees send emails to the incorrect person or attach the wrong information?
  • Is the email content being sent encrypted?

 Impact

  • How much does it cost for experts and customer relations to rectify the email problem?
  • What it may cost if legal action is taken against the company or if you have to offer some form of compensation for the mishap.

The FAIR analysis system can use the solid data gathered to generate a whole host of potential outcomes. Often, using this method can uncover the possible dangers of overlooking seemingly low-impact events.

With the results provided by FAIR, you can tweak the impact of different factors and rerun the analysis to see what outcomes there are with alternative controls in place. FAIR makes it possible to assess the human element easily and more accurately.

By effectively assessing just how big the human element is in your cyber risk, you can cut back on occurrences that cause losses for your business. While you cannot change human nature, you can identify risks better and implement strategies to safeguard against potential catastrophic fallout.