Security Awareness: Where Internal Weak Points Really Lie

Increasing digitization is raising the demands on IT security. However, incomplete digitization of processes in terms of security means that the ever-increasing threats directly impact information security and processes in companies. However, with solid security awareness combined with secure automated processes and solutions, companies can build their security from the inside. In this way, dangers that arise from human error can be avoided as far as possible.

Attacks often come from the outside. The German Federal Ministry for Information Security (BSI) estimates that there will be around 144 million malware programs in circulation in 2021. That is 394,000 new malware variants per day. Inadequately secured systems, missing or security-deficient solutions for collaborative work, and security awareness that has been neglected for too long are, in most cases, why malware has an extremely easy time with many corporate infrastructures.

Many security vulnerabilities are already inherent in the processes and technology used. They are caused by missing security software, carelessly configured firewalls, or due to programming errors in operating systems, web browsers, or other software used. Add to this unclearly defined or not cleanly structured processes or a Corona-related home office with its usually insecure VPN access. It is no wonder that companies and organizations are increasingly falling victim to phishing attacks, data leaks, and other cyber attacks.

In many cases, it is also the employees themselves who open the gateway for threats. Because people make mistakes. Not out of malice, but rather out of good faith or carelessness, they click on the infected attachment of a phishing email, which, when opened, infects the computer they are using or even the entire corporate network with malware. Or they are directed by hackers to a fake but seemingly trustworthy website, where they guilelessly divulge sensitive information such as login credentials, credit card numbers, or other sensitive information. Cybercriminals are increasingly successful with a broad, ever-changing repertoire of attack vectors, ranging from social engineering and phishing to drive-download. If an attacker succeeds in deceiving just one employee, he or she already jeopardizes the entire company’s security. When a security incident occurs, employees are unprepared. They react too slowly, incorrectly, or keep quiet about the incident for fear of consequences, thus unnecessarily increasing the damage.

Creating Security Awareness

To build a secure corporate structure from the inside out, organizations must increasingly sensitize their employees to security issues and create security awareness. For example, employees should know how to recognize a fake phishing email and be informed that ransomware locks a computer and encrypts the files on it to blackmail the victim.

In regular internal training and education, companies should provide their employees with basic knowledge about IT security and provide answers to urgent questions. For example, “Who do I need to inform when I open a suspicious attachment?” or “What is the right thing to do after an incident?” In this way, employees can better assess potential cyber threats and respond quickly and correctly in the event of a security incident. In addition, training increases awareness among the workforce that data theft can seriously jeopardize the company’s success. After all, according to the “Allianz Risk Barometer 2022”, cyber dangers represent the most significant risk for companies worldwide. This puts cybercrime ahead of business and supply chain disruptions, natural disasters or the Covid 19 pandemic.

Encryption Closes the Data Exchange Security Gap

For example, many companies still use unsecured channels to send their internal and external information, so cybercriminals can intercept the data without much effort. Since unprotected systems only use user authentication in exceptional cases, the sender cannot be sure whether his message has actually reached the intended recipient or whether it has been intercepted beforehand. Attackers often use the information for targeted spear phishing attacks and use the intercepted communication to compose emails and messages that appear as authentic as possible. Spear phishing attacks are usually difficult to detect, which is why they are among the biggest gateways. As with ordinary e-mail phishing attacks, malware gets directly onto the computer used by opening manipulated attachments or links and is fed into the overall system from there. However, the recipient is more easily fooled by the personalized cover letter.

Companies and public authorities should use communication channels with secure end-to-end encryption (E2EE) for sending e-mails and transferring files. This begins on the sender’s end device and extends along the entire transmission path to the recipient, where the data is stored and encrypted. In addition, E2EE provides each message with a unique cryptographic electronic lock to which only the recipient has the key. In this way, data and attachments are protected at all times. Attachments should always be encrypted automatically when sent, so it is impossible to manipulate them afterward.

However, the storage capacity of e-mail inboxes quickly reaches its limits, especially when sending large files. Since many companies do not provide DSVGO-compliant platforms for secure data exchange, employees often use free cloud solutions instead, which they are familiar with from their private lives, thus creating a dangerous shadow in IT. In addition to encrypted e-mail communication, companies should offer their employees secure data rooms. These create a protected environment in which users can store data securely and share it with customers or partners in a DSVGO-compliant manner.

More Security Through Structured Input Management

Another gateway that cybercriminals like to attack is so-called input management, i.e., the way sensitive data is recorded, processed and distributed in the company. This includes business-relevant information such as invoices or reminders or documents requiring exceptional protection such as job applications or sick notes. The risk of security breaches is exceptionally high if the data is received in an unstructured manner and stored, for example, in a functional mailbox with undefined responsibilities that many people can access. The larger the group of recipients, the more likely it is that they will include people with little or no training who will fail to recognize suspicious attachments and misjudge possible risks.

The group of recipients should therefore remain as small as possible. Here, it is advisable to use digital forms in which areas of responsibility and contact persons are precisely defined so that only authorized employees receive incoming information. This carefully selected group of people is usually briefed accordingly and can distinguish between business attachments and risks. If necessary, an intermediate virus scanner checks the attachments for malware before they are sent.

Security Through Automation

Another overall security risk in companies and government agencies is manually executed processes, where employees’ carelessness or ignorance often causes errors. By automating work processes, these weaknesses caused by the human factor can be largely eliminated, and the efficiency of the processes can be increased. The automation software translates process steps into code. This way, data is automatically captured and transferred to the processing system precisely. For this to work, however, structured data input is essential. Companies should also not tackle all processes at once but pick out those that can be easily automated. As a rule, these are very repetitive processes with many small steps.

Vulnerabilities can Be Minimized

Companies can therefore take various measures to strengthen their internal security. Because it remains to be said: Mistakes happen – to people and machines. But through the use of appropriate technologies and based on practiced security awareness, it is possible to minimize internal vulnerabilities and thus permanently increase the security of systems.