“[A]ll the security controls in the world are useless if an attacker can manipulate an employee with system access,” according to the findings, which include an analysis of more than 450 data breach investigations in 2012.
Whether thieves are after customer data or a company’s intellectual property portfolio, employee email, mobile devices, network passwords, and social media can all open the door for an attack.
The proliferation of smartphones and mobile apps presents another set of security worries, “as these devices routinely connect to unknown networks every day,” says Trustwave. “Posting one’s place of work on Facebook might not seem dangerous,” the report warns, “but when combined with co-worker connections on LinkedIn, pictures of office parties from FlickR and check-ins on Foursquare, an attacker can create a very detailed picture of the internal workings of a company without ever setting foot inside.”
All in all, the authors identified employee education as integral to any other cyber defenses, arguing that “no policy enacted will have much impact if employees aren’t on board (especially if they don’t truly understand the consequences of their actions).”
“This awareness training must include case studies highlighting both obvious pitfalls (clicking on suspicious links) and not-so-obvious ones (posting company photos online in which staff members are wearing their security badges).”
Link: http://www.law.com/corporatecounsel/PubArticleCC.jsp?id=1202588933863&Employees_May_Be_a_Companys_Greatest_Cybersecurity_Vulnerability&slreturn=20130121081231