The biggest cyber threat largely ignored by small businesses

I believe it’s the human element. An organization can have all the technology in place but if one person doesn’t know what to do with that technology or isn’t educated on cyber risks, the technology can become impractical.

Take social engineering for example, and in particular, phishing attacks through emails. With 129 billion business emails exchanged every day,¹ a quick and easy attack could result in large payouts to bad actors. All it takes is for one key individual to be duped into transferring money to a criminal posing as the company’s senior executive. Or it could take just one colleague to click on a phishing email’s hyperlink, accidentally downloading malware to infect an entire network.

In addition to acts of commission, I believe there are threats arising from omission. For example, manufacturers of software programs will only provide appropriate security patches after they are made aware of those vulnerabilities.

It’s easy for individuals to become complacent and put off taking the time required to analyze software programs and flag vulnerabilities to software companies.

Another risk is failure to apply security patches. Depending on how an organization is set up, installing system patches could mean organizational downtime. Vulnerabilities start to emerge when businesses don’t take the time to install important patches.

Ninety-five percent of all cyber incidents are human-enabled, including cyber attacks, data breaches, and ransomware attacks.²

Humans seem to be the weakest link in security and risk management. Managing the human side of cyber threats involves human-centred approaches, including diligent and frequent training and awareness programs, provided to all employees, from the front lines to senior management.

Working remotely has become a necessity in these times and while there are many benefits, there are also heightened risks.

While compliance to security protocols is easier in a normal office environment, individuals may become less diligent when working remotely. Examples of lax behaviour can include introducing a personal computer to a remote work network; leaving a work laptop in a car, making it a target to theft; or using an infected thumb drive.

Cyber risk should be looked at in the same way as property risk. A typical commercial building owner is likely to install fire alarms, smoke detectors and security cameras, as well as hire security guards, in addition to buying property insurance.

Yes, an organization can invest in IT infrastructure with strong networks and security protocols. These will make it harder for bad actors to attack, but they will not make it invincible. An organization can never be fully secured.

At the end of the day, it’s about risk mitigation rather than risk elimination. It’s hard to eliminate cyber risks but the right steps can help mitigate risk.