- 1. OVERVIEW News stories every day exposure of private
companyinformation Not advanced technology or genius hackers but
Human Beings, Being Human 2
2. RISKS STEMMING FROM A. Careless Use Of E-Mail B. Other
Aspects of Human Error 3. A. CARELESS USE OF EMAIL1. Employee
Vulnerablility to Spear Phishing AttacksFraudulent email intent on
gaining data/information - much more focusedthan traditional
PhishingExample: 2008 District Court Subpoena ScamSolutions:
Education Messaging Intelligence Phishing Filter Avoiding Embedded
Links Increased Sensitivity of Spam Filters4 4. A. CARELESS USE OF
EMAIL2. Use of Company Account for Personal Use (and
Vice-Versa)Lack of distinction between the company account and
personalaccount can lead to embarrassing or disastrous
consequencesExample: Anonymous - Sarah Palin, 2008Solutions: Policy
of separate accounts for personal andwork use Ban on internal chain
mail on companyaccounts If absolutely necessary to use
personalaccount for work purposes, encryption mustbe used 5 5. A.
CARELESS USE OF EMAIL3. Avoidable Loss of Old E-mailsIts often
assumed that once an e-mail is stored in an account that it issafe
forever.However e-mail accounts can crash leading to loss of all
data whichhasnt been backed up.Example: G-Mail Mishap,
2006Solutions: Manual e-mail backup on cd/storage device withstrict
back up schedule. Purchase of automated backup software to takecare
of backups automatically6 6. A. CARELESS USE OF EMAIL4. Mis-use of
the Reply All ButtonOne of the most common mistakes made by
individuals regarding e-mail error which can result in sensitive or
embarrassing informationbeing sent to unintended
recipients.Example: LA Police Dept. Controversy, 2012Solutions:Many
e-mail providers offer a number of preventativemeans,e.g. Outlook:
Option to remove Reply All button Option of 30 second lag on all
e-mails Option of an alert warning the user that Reply All has been
selected 7 7. A. CARELESS USE OF EMAIL5. Over-Dependence on E-mail
(especially for discussion ofsensitive info)E-mail is often seen as
an easy way out communication tool providing aquick fix. The short
term relief, however, does not outweigh the potentialproblems
including clogging of internal email systems.Also problematic is
the use of e-mail for sensitive corrospondence moresuited to aNavio
Computers to face meeting. System,Example: phone call or face
Clogged Email2011Solutions: Ban on unnecessary internal e-mails
Alternative cloud-based collaboration tools FtF meetings and phone
calls to discuss sensitiveinfo Encryption if sensitive info MUST be
sent via e-mail 8 8. B. OTHER ASPECTS OF HUMAN ERROR1. Loss Of
Laptop/Other Device (Containing Unencrypted Data)Theft/Loss of a
computer or other data storage medium made up 35%of all data
breaches in 2012. Such theft/loss can cost a companyhugely in
monetary terms as well as image, competitive advantage andconsumer
trust.Example: Dept. of Veteran Affairs Database Theft,
2006Solutions: Education of employees around device and
passwordsecurity Immediate notification of loss or theft Encryption
of all sensitive company data/info Device Management Consoles
monitor, set , enforcepolices & remotely wipe devices 9 9. B.
OTHER ASPECTS OF HUMAN ERROR2. Failure To Erase Data When No Longer
Required/PermittedIt is generally good practice to destroy old
info/data that is no longerrequired, to free up disk space.More
importantly, many sectors are governed by laws prohibiting
retentionof certain info after a specific time period.Example:
Affinity Health Care Digital Copier Mishap,2010Solutions: Policies
regarding deletion of old emails, messages, call logs & files
Strict reviews of data on all devices on regular continual basis
Education of staff around safe destruction of old data Device
Management Consoles (again) for remote wiping of lost/stolen
devices10 10. B. OTHER ASPECTS OF HUMAN ERROR3. Sharing of User
Account Details and PasswordsPassword sharing - convenient &
cost saving in relation to certainsystems.Can widen potential for
unauthorised access, especially when peopleleave the
company.Example: Lincoln National knowing whoAffiliate into what
and whenIt also prohibits mgmt from Securities logged(audit
trail).Access, 2010Solutions: Assign usernames and PWs specific to
individual users & grant/revoke permissions depending on what
these users require Policies demanding strong PWs & mandatory
routine for changing PWs PWs should be changed when duties are
reassigned or employees leave11 11. B. OTHER ASPECTS OF HUMAN
ERROR4. Data Theft By Employees/Former EmployeesEmployees gain
access to numerous systems through their employmentincluding email
accounts, HR payroll systems, etc.Often Companies do not prioritise
the practice of updating user access &privileges when employees
leave the company, opening the door to data theft bydisgruntled
former employees.Example: Fidelity National Information Services
DataTheft, 2007Solutions: Policy of updating access and privileges
whenemployees leave the company Purchase of systemsto simplify the
userprovisioning process 12 12. B. OTHER ASPECTS OF HUMAN ERROR5.
Use of company laptops outside of work / personal laptops in
theworkplaceIdeally should never use the same device for both if
company laptop MUSTbe used, they should never be left unattended or
connected to unsecureExample: Saudi Aramco Virus Infection,
2012networks.Solutions: Separate laptops for home and work except
whenabsolutely necessary Password protection & no sharing
Deletion of sensitive information when no longerneeded Restrictions
of the type of data allowed outside theworkplace Encryption of all
sensitive information Restrictions on connection to
unprotectednetworks 13 13. B. OTHER ASPECTS OF HUMAN ERROR6.
General Simple Human CarelessnessBy our nature, humans will suffer
lapses in concentration or oversights.In business, carelessness
like failure to double check standards or erroneouspublication of
data may have disastrous consequences.Example: AOL Release of
Search Data, 2006Solutions: Educationofemployeesabout
theirresponsibilities regarding data security and theuse of
technology to avoid data breaches Preparation & implementation
of data breachpolicies and response plans14 14. CONCLUSION Data
breaches not necessarily associated with new technologiesand genius
hackers Reality: Many can be associated with human error Ponemon:
78% - human negligence or maliciousness Many breaches can easily be
avoided Precautions can be aided by technology butold familiar
security fundamentals are key: Training & Education Policies,
Revisions & Analysis Data Encryption Common Sense & Sound
Judgement 15
