As the world becomes increasingly digital as a result of the so-called Fourth Industrial Revolution (4IR), more and more of our devices are becoming connected to the open Internet as well as to each other, writes Vishal Barapatre, Chief Technology Officer at In2IT Technologies.
Every one of these edge devices is a potential point of vulnerability, and cybersecurity has become a growing concern for businesses as the sophistication, velocity and volume of cyberattacks has increased dramatically.
However, even with the most sophisticated security solutions money can buy, people will always be the weakest link. From accidental incidents to malicious intent, human intervention can bypass cybersecurity and lead to catastrophic data loss events. How do organisations people-proof their networks and technology to maximise cyber security coverage?
A case of overshare
One of the biggest challenges is the amount of data people have access to and share, and the unsecured ways in which they share it. According to the 2019 Global Data Risk Report from Varonis Data Lab, 53% of companies found over 1,000 sensitive files exposed to all employees, and on average, every employee had access to over 17 million files. In addition, companies found, on average, 3,441 exposed sensitive files and 28,645 exposed folders per terabyte.
Data is clearly at risk, and human behaviour is the problem. People use unauthorised public cloud services to share data, or place folders of sensitive information on common servers that may not be secured. There is also the real possibility that people have malicious intent and steal information for the purpose of selling it.
Threats taken to the edge
Another challenge to cybersecurity, exacerbated by people, is the increasing prevalence of malware on edge devices. As the number of connected devices we use and our reliance on technology grows, so cybercriminals increasingly target these devices.
Windows computers and Android phones are the most vulnerable currently, as they represent the largest proportion of users. The Insight into the Cyberthreat Landscape in South Africa report from Accenture states that “Android mobile phones in South Africa were the second most targeted by banking malware.” However any edge device, even a smart TV, could potentially be at risk.
Risky business
At-risk behaviour is the most significant threat. When it comes to edge devices, this generally involves people downloading apps off the open Internet, rather than through the verified app store. One example recently was an app that claimed to be able to tell people whether or not they had Covid-19 through their phone. This app created a vulnerability that exposed users’ personal information, including bank details, and permitted OTPs to be diverted and SIM cards to be cloned.
Other issues include people using common passwords that can be easily guessed, using the same password for multiple accounts, and a general lack of education around cyberthreats. The most common entry point for malware is still through accidental exposure, such as phishing emails, clicking infected links in SMS and emails, or sharing personal details like ID numbers over unsecured channels.
Once a vulnerability is created and exploited, business data is at risk of being stolen, encrypted and held for ransom, which could cost millions in terms of recovery and fines for breach of privacy laws.
Prevention is better than cure
Protecting organisations from cyberthreats requires technology at multiple levels, and advanced technology such as Artificial Intelligence (AI) and Machine Learning (ML) can reduce potential exposures and increase security. However, technology needs to go hand-in-hand with education, because no matter what solution is in place, people have the power to override it, and hackers are always one step ahead.
Ultimately it is not possible to 100% people-proof infrastructure or data, but there are ways of minimising the risk. People need to understand the policies and procedures around security, but more importantly why they exist. Awareness of security threats and risks, and understanding of how their behaviour can affect cybersecurity, are essential weapons in the war on cybercrime.