J2 Software is embarking on a campaign to assist customers to overcome what has become the biggest cybersecurity threat to businesses – users.
John McLoughlin, MD J2 Software, says insider threats cause the most damage to businesses with breaches leading to destruction of reputation and loss of market confidence.
“I am in almost constant discussion with IT and security professionals who tell me that their users are the most common source of breaches. I believe it is time to steer away from blaming the users and talk with them so that we can help them become part of the solution,” says McLoughlin.
He notes that while it has been proven that insiders are the biggest threat to information security, “They can also be a company’s greatest ally in the fight against stopping the growing number of cyberthreats. We should be asking why does it happen and have we done enough to prevent our users from taking us all down?”
McLoughlin emphasises that this is the only way to begin the process of sewing information security into the fabric of a business.
“While research states that anywhere between 70% and 90% of breaches happen because of trusted insiders, in many of these cases the user in question did not even know that they were the cause of the breach. They inadvertently click on an infected link or fail to identify a fake advert while online. Instead of disciplinary procedures; business owners need to question when they last conducted awareness training with their users and what warning systems have been put down to stop inadvertent breaches in their tracks,” he says.
McLoughlin confirms threats evolve daily, so companies cannot afford to be complacent about awareness in light of the fact that they may not have conducted awareness training in over a year or more. “It is also important to deploy systems that will instantly identify risky behaviour or alert to compromised websites and malicious traffic as it happens – not after the breach has already occurred,” he adds.
“When users put customer information or sensitive business records onto open, unsecured and unprotected cloud sharing platforms, the business owner needs to ask the question was it deliberate and malicious? Or were their actions inadvertent due to lack of training or inadequate system support? Moreover, the company needs to question if they actually even know what information was moved into a cloud sharing or online storage platform in the last 24 hours.
“Therefore, the trick is being able to see exactly when a breach occurs; what has been breached; what information has been transferred; and by whom. It is only with this information that companies decide what to do about it. Businesses will find it far more effective to conduct ongoing awareness campaigns with their users and work with them in the event of a breach and not just find someone to blame.”
