The emergence of artificial intelligence (AI) and machine learning (ML) may have sparked an arms race in the cyber security world, but humans remain the most important line of defence in this new environment.
This is according to Nick Dyer, Cybersecurity Expert at Arctic Wolf, who says: “The cyber security landscape has been transformed in recent years, and advancements are enabling today’s threat actors to deploy increasingly sophisticated attacks at the press of a button. The arms race has escalated, with bad actors undeterred by rules or regulations, and the shift towards AI-based security has made the margins between attackers and the defenders thwarting them even smaller than they were previously. In this environment, it is essential for organisations to understand that one of the most important steps they must take to strengthen their resiliency is to reduce human risk.”
All employees are responsible
Arctic Wolf research has found that nearly two-thirds (64%) of IT executives have clicked on phishing links themselves, suggesting that human risk isn’t just a new employee problem, but also a leadership one. Actions like re-using credentials, disabling security measures like multifactor authentication (MFA) and errant link-clicking place organisations at a massive cyber risk, regardless of the sophistication of their security environment. The overall security of organisations relies on all employees putting the work in to ensure they aren’t undermining security.
Buy-in and dedication from the C-suite to entry-level employees is fundamental to mitigating human risk. Despite the majority of IT leaders falling victim to phishing scams, 80% reported they were “confident” their organisation won’t fall for a phishing attack. Dyer says this disconnect means that, in some cases, the most effective change an organisation can make to lower human risk is to make security measures like MFA, virtual private networks and password managers mandatory.
Fostering a culture of cyber security
Dyer says business leaders and their employees must be more aware of the threats targeting their organisation’s cyber defences and must be trained to spot the key signs of an attack.
He notes: “While this is not an overnight task, improving cyber hygiene is a skill that anybody can learn, regardless of their knowledge of technology and cyber security.”
He says: “Due to the slim technological margins between good actors and bad actors, it is now organisations with a deeply ingrained culture of cyber security – employees who are trained to proactively report suspicious behaviour – which make the difference between falling victim to a ransomware attack and business as usual. For example, two of the largest recent breaches – MGM Casino and MOVEit – were carried out via social engineering tactics.”
As AI-based threats become more prevalent, employees should also be well-versed in the policies and procedures of reporting suspicious activity or verifying someone’s identity – as well as knowing what to do if a malicious link is clicked on, Dyer says.
“While many organisations conduct background checks on employees, monitor work devices for suspicious traffic and require periodic password updates or a password manager, vigilance is the key differentiator in this new age of threats,” he says.
Dyer notes that none of these tactics can be effective in boosting resiliency without an underlying foundation of trust. Employees need to feel empowered to share their security concerns, as updating and patching systems immediately is essential to a resiliency plan, he says.
Preparation is key
“The reality is, running a business includes vast security concerns, and if workers aren’t prepared for them, they can be easily missed,” Dyer says. “Background checks, people screenings, tools to mitigate phishing, shadow AI and more are just a few examples of opportunities for hackers which, if left unchecked, could easily lead to a breach and the stealing of business-critical information. It’s fundamental for security leaders to prioritise employees as a defence against attacks, or else no amount of technological investment will keep their organisation secure.”
Share