The Weakest Link In Your Security Is YOU

In this article, I am going to reveal your number one most significant security flaw, guaranteed. You see, as an IT guy, I can implement all kinds of hardware and software security in your network to protect you and your clients’ data. We recognize a minimum of seven layers of security that should be in place at any business, regardless of size. However, no security solution can be 100% effective. Most small businesses make a wholehearted attempt to take the proper steps and implement suitable security layers, such as antivirus and email filtering. But they fail on one of the most critical layers, 100 percent of the time.

You see, 90% of all ransomware is currently getting into your network by email. Individuals are the single most prominent target for cybercriminals regardless of the company size or industry. The trend is to attack the weakest link in the organization, which happens to be people and not always software or hardware. Cybercriminals have become increasingly more sophisticated at tricking us into divulging sensitive information. This practice is called social engineering and is what con artists use to extract sensitive information from people. However, this is now happening via email and websites. Not to mention the barrage of phone calls you are getting right now as well.

In my cybersecurity seminars, I talk about some interviews with hackers. In one such interview, the hacker SparkyBlaze says that social engineering, tricking people into divulging sensitive information, is the largest threat we face today. He says this is the case because it does not matter what protections we put in place from a hardware or software standpoint. These protections are all worthless if someone can fool a user into divulging a password, installing malicious software onto their computer, or clicking a link in an email directing them to a phishing website.

The key to keeping you and your clients’ data safe in today’s digital world is to have a strategy that must now include constant education and testing of your staff. This strategy may be a third-party testing service that sends test emails to your team to see who clicks the links or opens the attachment. Such services then follow up with a gentle educational moment to inform the employee what he or she did wrong and how to protect your digital assets in the future better.

It may also include regular additional training on security topics. A service like this adds a security layer and some proof of due diligence regarding staff education and training.

What do you think your employees might fall for when elaborate phishing scams fool even cybersecurity professionals? How do you expect your employees to be able to spot these identity thieves’ actions and avoid divulging sensitive company or client information?

As you develop your cybersecurity strategy, remember that it must now include employee testing and education. Additionally, you must track those results just like you would any other training or industry certifications.

For questions or concerns give us a call at (608) 755-1524 or visit computer-center.com/contact/ for any of your computer-related needs.

https://www.proofpoint.com/us/resources/threat-reports/cybersecurity-analysis-report

https://i-sight.com/resources/social-engineering-a-threat-to-information-security-in-the-workplace/