UK businesses still overlooking human element in security

Only four in 10 (42%) businesses focus on compliance training as part of cyber security efforts to ensure sensitive data is kept secure, despite the fact that accidental lapses in security through carelessness or negligence are responsible for a significant proportion of security breaches, a report has revealed.

More worryingly, 63% rely predominantly on passwords to protect IT systems, according to a whitepaper on the link between personality types and vulnerabilities to cyber crime by security firm Eset and business psychology organisation the Myers-Briggs Company.

The whitepaper, based on a survey of 500 UK firms, highlighted that cyber security should be on every boardroom’s agenda and that there need to be ongoing one-on-one meetings and training sessions to highlight and mitigate potential vulnerabilities within teams.

“It is vital that modern businesses have a degree of self-awareness regarding cyber security,” the whitepaper said. “That is, not just a general awareness of the problem, but detailed and personalised knowledge of how cyber crime and cyber security relate to their own operations.” It noted that the most successful cyber attacks typically rely on a degree of human error and/or ignorance.

The whitepaper also highlighted popular cyber threats, such as formjacking, PowerShell-based attacks and attacks exploiting weaknesses in IoT (internet of things) devices.  

Cyber criminal techniques are extremely diverse and unpredictable, the report said, noting that aside from a reputable and trustworthy cyber solution, having a solid front line of employees who are armed with ample information and support is critical for businesses.

“Securing the human element is vital in today’s fast-changing cyber landscape,” said Jake Moore, security specialist at Eset. “We are seeing a growing need for companies to streamline their teams’ cyber safety protocols.”

While the motivation behind a cyber attack may be varied and impossible to predict, the whitepaper said companies can take the time to learn more about their employees’ personalities and behavioural preferences to help them understand the role they play in securing company data.

“For the human risk factor to be mitigated, both senior and middle management need to play a much larger role in both identifying vulnerabilities within their teams and securing cyber systems via an integrative human/machine approach,” the whitepaper said.

Research collated by the Myers-Briggs Company that looked at individuals across Europe revealed that people who focus their attention on the outside world (extraverts) are more vulnerable to manipulation and persuasion by cyber criminals.

In contrast, people who tend to observe and remember details may be better suited to spotting risks as they arise, while people guided by personal values or who are systematic or structured are more likely to fall victim to social engineering attacks than those who solve problems with logic.