Your Organization’s Biggest Security Threat: You

Fly FishingPhishing, and more specifically spearphising — hiding malware behind e-mail messages that appear to come from your friends and co-workers — is on the rise. “By all accounts, the majority of successful security attacks are a direct result of benign, well-educated company staffers who did something stupid or forgot to do something easy,” writes Alan Wlasuk at TechRepublic. Even though we’re supposed to know better, we still fall victim to the phishing trap.

A fun fact to start any conversation about social engineering is this surprising occurrence: Oak Ridge National Labs (one of the U.S. national energy labs) was a target for a spear-phishing attack where 57 out of a targeted 530 employees opened up an email that installed malware on their personal computers. Oak Ridge was shut down for days to repair the damage. The amazing fact behind this occurrence is that Oak Ridge National Labs is a government agency with a charter to study malware and computer viruses. However, the majority of the staff that opened up the affected e-mails were senior scientists and executives—people who should have known better.

There are a lot of reasons we mess up — greed, poor passwords, idle curiosity, quid pro quos, and Wlasuk has horror stories to make his point. For example, hackers posing as tech support call around to office workers, dialing over and over until they actually find a worker who needs tech support and gladly volunteers his password or other info. That’s pretty clever.

As Wlasuk observes: “Humans are, by all accounts, imperfect,” Wlasuk says.

Source: TechRepublic

Comments

  1. BY Mike says:

    I had a boss (CIO, CTO, CSO) some years ago who claimed to suffer from information overload; he believed others probably did as well. A segment of the overload was remembering passwords. He implemented an enforced “change your password every x number of days” then suggested, in order to reduce the overload of remembering passwords, using the same password for every account on every system.

Post a Comment

Your email address will not be published. Required fields are marked *

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>